PRIVACY POLICY

SappadaSki is a project of Travel One S.r.l., which is the sole controller of the data collected through the Site:

• Travel One S.r.l. – registered office Via Sabbiadoro 1, 33054 Lignano Sabbiadoro (UD), Italy
• Operational office: Via Latisana 35c, 33054 Lignano Sabbiadoro (UD), Italy
• Tax code/VAT no. 02885660304
• Phone +39 0431 720428 – WhatsApp +39 345 1440110
• E-mail sappada@travelone.it and info@travelone.it

Travel One S.r.l. has not appointed a data protection officer (DPO), as it is not required to do so under Article 37 GDPR. For any question about the processing of your data, you can write to the addresses above.

When you visit the Site, the hosting provider's servers automatically record some technical data about the request: IP address, browser type and operating system (user agent), address of the requested page, date and time.

• Purpose: delivering the pages, ensuring the security and proper functioning of the Site, preventing abuse.
• Legal basis: the controller's legitimate interest in the security and functioning of the Site (Article 6(1)(f) GDPR).
• Retention: the technical logs are kept by the hosting provider for a few days, unless they are needed to investigate computer crimes at the request of the authorities.

These data are not used to identify or profile you. The Site does not use any statistics or traffic analysis tools (no Google Analytics). The fonts are hosted on the Site itself and the video cover images are served from our own domain: when you open the pages, your browser does not contact Google Fonts or YouTube.

Through the form on the Contact page we collect: first name and surname, e-mail address, telephone number (optional), subject of the request, message, Site language and date of submission.

• Purpose: replying to your request for information or for a quotation on ski passes, packages and services.
• Legal basis: taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR). Providing the data is optional, but without name, e-mail and message we cannot reply to you.
• Where they are stored: in the Google Cloud Firestore database (Firebase service); they are read only by authorised Travel One S.r.l. staff in the restricted management panel.
• Retention: 24 months from submission, then automatic deletion. If a contract follows the request, the necessary data are processed for its performance and kept for the period required by law (see section 7). You can ask for earlier deletion at any time.

Please do not include in your message data concerning health or other special categories of data unless strictly necessary for the request (for example dietary or accessibility needs): in that case we will use them only to reply to you.

If you subscribe to the newsletter at the bottom of the pages, we collect: e-mail address, date and time of subscription, text of the consent you accepted and Site language.

• Purpose: sending you by e-mail the newsletter of SappadaSki / Travel One S.r.l. with offers and news.
• Legal basis: your consent (Article 6(1)(a) GDPR and Article 130 of the Privacy Code), given by ticking a separate, unticked checkbox. Without consent you cannot subscribe; the rest of the Site remains fully usable.
• Retention: until you withdraw your consent.
• Withdrawal: you can unsubscribe at any time using the link in every e-mail or by writing to sappada@travelone.it or info@travelone.it. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal (Article 7(3) GDPR).

Some pages contain videos published on YouTube, a service of Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). Until you choose to watch them you only see a cover image served from our own domain: no data is sent to Google.

The YouTube player, in privacy-enhanced mode (youtube-nocookie.com domain), is loaded only if you have accepted videos in the cookie banner, or when, after the notice shown in the video frame, you click "Watch the video" (the click records your consent). From that moment Google receives your IP address and the technical data of your device and may set cookies or similar tools; it processes them as an independent controller under its own privacy policy and may transfer them to the United States.

• Legal basis: consent (Article 6(1)(a) GDPR and Article 122 of the Privacy Code).
• Withdrawal: at any time via "Cookie preferences" at the bottom of every page; cookies already set by Google can be deleted in your browser settings.

If you write to us by e-mail, call us or contact us on WhatsApp, we use the data you provide (for example name, phone number, e-mail address, content of the message) only to reply to you and handle your request (Article 6(1)(b) GDPR or, for general communications, point (f)). The WhatsApp service is provided by WhatsApp Ireland Ltd., which processes the data as an independent controller under its own privacy policy.

The Site contains simple links, without plugins or embedded content, to third-party sites: the Sappada webcam (Panomax), the Infoneve snow report of PromoTurismoFVG, the SappadaSki Facebook and Instagram pages, WhatsApp and the website www.travelone.it. No data is sent to these sites until you click the link; once on their site, processing is governed by their own privacy policies, as independent controllers.

The Site does not offer online bookings or payments and does not collect payment data. Bookings are made by e-mail, by phone, at the Travel One office, on the website www.travelone.it (where that site's privacy notice applies) or through partner agencies.

If you purchase a package or a service, the necessary data are processed for the performance of the contract (Article 6(1)(b) GDPR) and to comply with tax and accounting obligations (Article 6(1)(c) GDPR), and are kept for 10 years (Article 2220 of the Italian Civil Code).

Services for minors (for example Winter Camp and the School Project) are requested and booked by parents, guardians or teachers. The Site does not knowingly collect data of minors: if you are under 14, please do not send us personal data through the forms.

The data are processed by authorised and instructed Travel One S.r.l. staff (Article 29 GDPR and Article 2-quaterdecies of the Privacy Code) and, on behalf of the controller, by the following providers appointed as processors (Article 28 GDPR):

• Vercel Inc. (United States) – hosting of the Site: the server functions run in the Washington D.C. region (USA) and the pages are delivered through a worldwide CDN. Privacy policy
• Google – Firebase services: Cloud Firestore database (data location: United States, nam5 multi-region) for information requests and newsletter subscriptions, and Cloud Storage (United States) for the images of the Site's content. Privacy policy

For YouTube videos, Google Ireland Ltd. acts as an independent controller (section 5). Data may be disclosed to the authorities where required by law. They are not disseminated or sold to third parties. The up-to-date list of processors is available on request.

Some providers are based in, or store data in, the United States. The transfer takes place on the basis of the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (10 July 2023), for providers that participate in it (list of certified organisations), and in any case of the standard contractual clauses approved by the Commission (Article 46 GDPR) included in the contracts with the providers. You can request a copy by writing to the controller.

• Browsing data: a few days in the hosting provider's logs, unless needed to investigate crimes.
• Form requests: 24 months from submission, then automatic deletion.
• Newsletter: until consent is withdrawn.
• Contractual, tax and accounting data: 10 years.
• Cookie choice: 6 months, after which you are asked again.

We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

We adopt appropriate technical and organisational measures (Article 32 GDPR): encrypted connections (HTTPS), database access rules that allow the public only to submit the forms and not to read data, access to the data restricted to authorised staff with personal credentials.

At any time you can exercise the rights provided for by Articles 15-22 GDPR:

• access to your data and a copy of them;
• rectification of inaccurate or incomplete data;
• erasure ("right to be forgotten");
• restriction of processing;
• portability of the data you have provided to us;
• objection to processing based on legitimate interest;
• withdrawal of consent, without affecting the lawfulness of prior processing.

To exercise them, write to sappada@travelone.it or info@travelone.it, or by post to the registered office. We will reply within one month of receipt of the request (Article 12(3) GDPR), which may be extended in the cases provided for by law.

If you believe that the processing infringes the law, you can lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority, Piazza Venezia 11, 00187 Rome, Italy – www.garanteprivacy.it) or with the supervisory authority of the EU Member State where you live or work, or take legal action (Articles 77-79 GDPR).

This notice may be updated, for example in case of new services or changes in the law. The date of the last update is shown at the top of the page.