Privacy Policy

PRIVACY STATEMENT PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679

and Art. 13 of Legislative Decree 196/03 as amended by Legislative Decree 101/2018

Lotti Spa, in its capacity as data controller of personal data pursuant to Article 13 of EU Regulation 679/2016 - General Data Protection Regulation ("GDPR"), in compliance with the obligations dictated by the legislator to protect privacy, hereby wishes to inform you in advance, both of the use of your personal data and of your rights, by communicating the following:

The 'Data Controller'

Lotti Spa, pursuant to Art. 24 of the EU Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter: "EU Regulation"), is the Data Controller and in implementation of Art. 13 of the EU Regulation, informs you that the personal data acquired, also with reference to existing legal relationships such as, pre-contractual relationships (quotations), contractual relationships stipulated (Mooring Contract, Annual and Multiannual Port Services, Arrival Cards), subscription to Newsletter services and port services carried out through the website or through social networks, are subject to processing in compliance with the aforementioned legislation.

In connection with the aforementioned processing operations, the Controller provides, inter alia, the following information.

'Personal data' (pursuant to Article 4 number 1 of EU Regulation 2016/679) means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, by reference in particular to an identifier such as a name, an identification number, location data, an online identifier or to one or more features of his or her physical, physiological, genetic, mental, economic, cultural or social identity;

"Processing" (ex Article 4 number 2 of the EU Regulation 2016/679), means any operation or set of operations, performed with or without the help of automated processes and applied to personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, comparison or interconnection, restriction, erasure or destruction;

Such processing must be based on the principles of fairness, lawfulness and transparency, protecting your confidentiality and your rights.

Personal data collected

The personal data collected concern:

Identification data of both the owner/user of the boat and the identification data of the crew (if any) and the boat's data (company name or company name, i.e. name and surname of the natural persons, address of residence and/or correspondence, head office, telephone, fax, e-mail, tax data);
Data on existing legal relations for the reservation, mooring, storage, yard service, rental or purchase of mooring services;
Generic personal contact data relating to and necessary for subscription to the Newsletter and access to the contact and service request area on the site;
Particular' data insofar as they can detect the presence and activities of the person: Video surveillance images.
Identity and contact details of the internal Privacy Delegate for the Data Controller

Name and Surname or Company Name: Privacy Office Porto (components)

Domicile or registered office address: Viale San Bartolomeo 394 - La Spezia 19126

Telephone contact details: 0187532223

Email contact details: privacy@portolotti.it

Purpose of processing

The purposes of the processing of personal data are as follows:

Fulfilment of obligations provided for by laws, regulations, EU legislation, or provisions issued by Authorities and Supervisory and Control Bodies in connection with or in any case related to the existing and/or future legal relationship.
Fulfilment of administrative, accounting, tax obligations;
Management and organisational processes;
Provision of care and support services;
Surveillance services, protection of clients' property and assets of the data controller;

The following table specifies for each of the purposes identified above the legal basis, the categories of personal data, and the relevant retention period:

*Categories of recipients

In relation to the purposes indicated, the data may be communicated to the following subjects and/or categories of subjects indicated below, or they may be communicated to companies and/or persons who provide services, including external services, on behalf of the Controller. For the sake of clarity, we indicate their different types, purely by way of example, but not exhaustively:

Accounting management consultants;
Law firms;
IT service companies and software providers;
Control and supervisory bodies.

The list of external Recipients/Responsible Persons with further useful identification data is available from the Data Controller.

Transfer of data to third countries outside the EU

No transfer of personal data to non-EU territory takes place.

Storage period

Please refer to table 1 in column 4 (retention period)

Rights of the data subject

The data subject, in relation to the personal data covered by this information notice, is entitled to exercise the rights provided for in the EU Regulation below:

the data subject's right of access [Art. 15 of the EU Regulation] (the possibility to be informed about the processing carried out on one's Personal Data and, if necessary, to receive a copy of it);
Right to rectification of one's Personal Data [Art. 16 of the EU Regulation] (the data subject has the right to rectification of inaccurate personal data concerning him/her);
right to erasure of one's own Personal Data without undue delay ("right to be forgotten") [Art. 17 of the EU Regulation] (the data subject has, as well as will have, the right to erasure of his or her own data); right to restriction of processing of one's own Personal Data in the cases provided for in Art. 18 of the EU Regulation, including in the case of unlawful processing or contestation of the accuracy of Personal Data by the data subject [Art. 18 of the EU Regulation];
right to data portability [Art. 20 of the EU Regulation], the data subject may request his or her Personal Data in a structured format in order to transmit it to another data controller, in the cases provided for in that Article;
Right to object to the processing of one's Personal Data [Art. 21 of the EU Regulation] (the data subject has, as he or she will have, the right to object to the processing of his or her Personal Data);
right not to be subject to automated decision-making processes, [Art. 22 of the EU Regulation] (the data subject has, as will have, the right not to be subject to a decision based solely on automated processing).

Further information on the rights of the data subject can be obtained by asking the Data Controller for a full extract of the above-mentioned articles.

The above rights may be exercised in accordance with the Regulation by writing to the data controller by sending an email to: privacy@portolotti.it in accordance with Article 19 of the EU Regulation. Informing the recipients to whom the personal data have been disclosed of any rectification, erasure or restriction of processing required, where possible.

If the purpose of the processing pursued has consent as its legal basis, the data subject may revoke it at any time by sending an email to: privacy@portolotti.it

Pursuant to Article 7 of the EU Regulation, revocation of consent shall not affect the lawfulness of processing based on consent given before revocation.

Right to lodge a complaint

If the data subject considers that his or her rights have been compromised, he or she has the right to lodge a complaint with the Italian Data Protection Authority, in accordance with the procedures indicated by the Authority itself at the following address: www.garanteprivacy.it

Mandatory provision of personal data

Please note that if the processing purposes have a legal or contractual (or even pre-contractual) obligation as a legal basis, the data subject must necessarily provide the requested data.

Failure to do so will make it impossible for the Controller to pursue the specific processing purposes.

The Company does not use any automated decision-making process.

Treatment modalities

Personal data will be processed in paper, computerised and telematic form and entered in the relevant databases (customers, users, etc.).The personal data will be processed in paper, computer and telematic form and entered into the relevant databases (customers, users, etc.), which may be accessed and thus become known to the employees expressly designated by the Data Controller as Persons in charge of and authorised to process personal data, who may carry out consultation, use, processing, comparison and any other appropriate operation, including automated operations, in compliance with the provisions of the law necessary to guarantee, among other things, the confidentiality and security of the data as well as their accuracy, updating and relevance to the stated purposes.

Changes and updates

This notice is valid from the date indicated in its heading.

Porto Lotti Spa may also make amendments and/or additions to the said notice as a consequence of any subsequent regulatory changes and/or additions. The changes will be notified and the interested party may view the text of the constantly updated information notice on the website at: https://www.portolotti.it/it/148/privacy.aspx in the section dedicated to the Privacy Policy.

Rev. 00/23