Privacy Policy

PRIVACY POLICY

This privacy policy describes how personal data of users visiting https://www.gruppomassa.com are processed.

1. DATA CONTROLLER

The Data Controller is Massa srl, with registered office at Via degli Aranci, 160 - 80067 Sorrento (NA), Italy.
Phone: +39 081 8771371 / +39 081 8072925
Email: info@gruppomassa.com

2. LEGAL FRAMEWORK

This policy is provided pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) and the applicable Italian legislation, including Legislative Decree 196/2003 as amended. The information provided to data subjects must include, among other things, the controller’s identity, purposes and legal basis of processing, recipients, retention period, rights of the data subject and, where applicable, transfers to third countries.

3. TYPES OF DATA PROCESSED

The following categories of personal data may be processed:

Browsing data: IP address, requested URI resources, date and time of requests, browser and operating system information, response status and other technical data necessary for website operation and security.
Data voluntarily provided by the user: name, surname, email address, telephone number and any information included in messages sent via contact forms, email or booking/request forms.
Booking and stay request data: where the user submits requests for availability, quotations or reservations, data necessary to manage such requests may be processed.
Cookie and tracking data: technical cookies and, where applicable, analytics or marketing tools, subject to the preferences expressed by the user through the cookie banner and dedicated cookie policy.

4. PURPOSES OF PROCESSING AND LEGAL BASIS

Personal data may be processed for the following purposes:

Website operation and security – legal basis: legitimate interest of the controller and, where necessary, compliance with legal obligations.
Handling contact requests, information requests and booking-related requests – legal basis: performance of pre-contractual measures requested by the data subject and/or performance of a contract.
Administrative, legal and accounting obligations – legal basis: compliance with legal obligations.
Direct marketing, newsletters or promotional communications – legal basis: consent of the data subject, where required.
Statistical analysis and service improvement – legal basis: legitimate interest and/or consent, depending on the type of tracking tool used.

5. NATURE OF DATA PROVISION

Providing personal data for browsing is necessary for the technical operation of the website. Providing data in contact, request or booking forms is optional, but failure to provide the requested data may make it impossible to respond to the request or provide the requested service.

6. PROCESSING METHODS

Personal data are processed using electronic and, where necessary, paper-based tools, in accordance with principles of lawfulness, fairness, transparency, data minimisation and confidentiality. Appropriate technical and organisational security measures are adopted to prevent unauthorised access, disclosure, alteration or destruction of data.

7. DATA RETENTION

Data are retained for no longer than necessary for the purposes for which they were collected, in accordance with the principle of storage limitation. In particular:

technical browsing data: for the time strictly necessary for website operation and security, except where longer retention is required for the establishment, exercise or defence of legal claims;
contact and information request data: for the time necessary to handle the request and for any subsequent related administrative needs;
booking/request data: for the time necessary to manage the pre-contractual or contractual relationship and to fulfil related legal obligations;
marketing data: until consent is withdrawn or the data subject objects, without prejudice to any legal obligations.

8. RECIPIENTS OF DATA

Personal data may be processed by authorised personnel and may be disclosed, where necessary, to service providers acting as data processors, such as hosting providers, IT support providers, booking or communication service providers, and consultants assisting the controller in legal, tax or organisational matters. Data will not be disclosed to the public unless required by law.

9. INTERNATIONAL DATA TRANSFERS

If some service providers are located outside the European Economic Area, personal data will be transferred only where permitted under the GDPR, for example on the basis of an adequacy decision by the European Commission or other appropriate safeguards.

10. COOKIES AND TRACKING TOOLS

This website may use technical cookies necessary for operation and, where applicable, analytics or marketing tools. Any non-technical cookies or other tracking tools requiring consent will be activated only after the user’s consent has been collected through the cookie banner, in accordance with the applicable legal framework and the Italian Data Protection Authority’s guidelines. Users can review or change their preferences at any time through the cookie management tools made available on the website.

11. DATA SUBJECT RIGHTS

Under Articles 15 to 22 GDPR, data subjects may exercise the following rights, where applicable:

right of access;
right to rectification;
right to erasure;
right to restriction of processing;
right to data portability;
right to object to processing;
right to withdraw consent at any time, where processing is based on consent.

Requests may be sent to: info@gruppomassa.com

12. RIGHT TO LODGE A COMPLAINT

If the data subject believes that the processing of personal data infringes the GDPR, they have the right to lodge a complaint with the competent supervisory authority.

13. UPDATES TO THIS POLICY

This privacy policy may be updated over time, including to reflect changes in the services offered, the technologies used or the applicable legal framework. Users are therefore invited to consult this page periodically.