In the following chapters you will find information about how your personal data are treated. Your data may be collected during your navigation on our website or as a consequence of the services that we provide you. In order to take advantage of all the services offered by our website, it is necessary for us to collect and treat your personal data. The treatment of your personal data may consist in collecting, organising, storing, analysing, interpreting, modifying, selecting, comparing, using, connecting, blocking, communicating, cancelling and destructing data. The treatment of your personal data follows the principles of lawfulness and correctness, in compliance with the current law and EU Regulation 2016/679 of the European Parliament and Council. With this privacy notice, we like to inform you about the data we collect, why the collection is necessary, and also of your rights in connection with the treatment of your data.
Owner of the Treatment
The Owner of the Treatment of your personal data on this website site is Gardena.Net S.n.c. with legal offices at str. Chemun 13 - 39047 S. Cristina (BZ), VAT no. IT01619310210.
For more information, please contact us using the following addresses:
Tel +39 0471 790 007
Fax +39 0471 790 006
E-Mail: [email protected]
Internet: www.gardena.net
Purposes of the treatment
We treats your data for the following purposes:
- to fulfil legal obligations
- to fulfil contractual obligations
- to make available the requested information and deliver the agreed services
- to monitor system efficiency
- to carry marketing activities, such as forwarding commercial information and advertising material, market research activities
- to safeguard obligations (e.g.: payments)
- to ascertain the level of satisfaction for the quality of the products and services offered
Type of treatment
Your personal data are treated manually, but also electronically, mainly through the use of automated processes, depending on the objectives. In this case, we specifically use databases and computerised platforms that may be managed by both us and third parties. Each type of treatment guarantees the respect and the confidentiality of the data treated. We store such data and general information in the database and in the servers as logfiles. In order to provide you with a unique navigation experience, we need to collect some technical data that are necessary for the correct operation of the website:
- Browser type and browser version
- Operating system
- The „referrer“ website
- The on our website linked webpages
- Date and time of access
- IP address
- Other similar data and information
This data is processed in server log files to keep the website running reliably and to detect and resolve technical errors and security incidents. The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest is to ensure the secure and reliable operation of our website.
Period of data conservation
In compliance with current laws, the owner of the treatment has defined different periods of data conservation depending on their usage:
- As far as handling and answering your questions about products and activities, your personal data will be stored for a period of time strictly necessary for processing your request.
- As far as managing activities connected with the navigation through our website, your personal data will be stored for a period of time strictly necessary to satisfy your requests.
- As far as internal management and operational activities (for example time of conservation of invoices, administration, and tax information), your personal data will be treated for a period of time in line with the legal requirements for the specific purpose.
- As far as the handling of disputes and litigations, your personal data will be stored for the whole time strictly necessary for pursuing such matters, and in any case not beyond the applicable prescription limits.
Gardena.Net S.n.c. processes data that is collected during the request to the company. This processing is necessary for forwarding your request to the respective company.
Use of cookies
We use cookies to provide our website’s features and improve your browsing experience. Cookies are small text files stored on your device through your browser.
Strictly necessary cookies are used without requiring your consent. Cookies and similar tracking technologies that require consent are used only with your prior permission. You can change your preferences and withdraw your consent at any time through the cookie settings on our website. Withdrawal takes effect from that point onwards.
You can also delete stored cookies or block them through your browser settings. Doing so may limit some website features. Further information is available in the dedicated section.
Contact form
Should you decide to contact us using the contact form on our website, you will be asked to enter some personal data. This enables us to process your query. This is also the reason why the corresponding fields of the contact form are marked with an asterisk, or in any another way, as mandatory fields. The entering of personal or sensitive data other than those marked as mandatory will be at your discretion. Failure to enter, even in part, the mandatory information marked with an asterisk or similar character may result in the impossibility for us to answer your requests or deliver the requested services. The forwarding of requests using the contact form constitutes your implicit acceptance of the treatment of your personal data. The data that you transmit are treated and stored for a period of time strictly necessary for the processing of your request.
Newsletter
We send promotional newsletters based on your consent. They contain news, travel tips, offers and promotions from our company and our partners.
We use a double opt-in process: after signing up, you will receive an email asking you to confirm your subscription. We record the date and time of your sign-up and confirmation as proof of your subscription. We use your registration details to send the newsletter and, where applicable, personalise it. The legal basis is Article 6(1)(a) of the GDPR. You can withdraw your consent at any time using the unsubscribe link in the newsletter. Withdrawal takes effect going forward. The data required to send the newsletter is generally retained for the duration of your subscription. A separate retention period applies to the tracking data described below.
We use rdcom/Kloudymail to send and analyse our newsletters. We have entered into a data processing agreement with the provider:
R&D Communication Srl
Via dei Castagni 9
37141 Montorio V.se, Italy
VAT no. 03269830232
The provider processes your email address and, where available, your name, language, IP address and registration details. With your consent, it also processes the open and click data described below. Further information is available in the provider’s privacy policy at https://rdcom.com/en/privacy-policy/.
Newsletter tracking
With your consent, we use tracking pixels and specially configured links to analyse our newsletters and improve their content and layout. Tracking pixels are invisible image elements that allow us to detect whether an email has been opened. The links allow us to identify which content is clicked. This information is linked to the individual newsletter recipient. Tracking opens and clicks at an individual level is based on your consent under Article 6(1)(a) of the GDPR and Article 122 of the Italian Data Protection Code.
You can withdraw your consent to open and click tracking at any time using the “Update profile” link in the newsletter. You will continue to receive the newsletter, but your opens and clicks will no longer be tracked individually. Alternatively, you can contact us using the details provided in this privacy policy. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal. Personal data relating to email opens and clicks is retained for 180 days in accordance with our service provider’s retention policy and then deleted.
Profiling
Profiling is any type of automated personal data processing activity that consists in using the information to assess, analyse and predict certain aspects of a natural person. For this type of marketing activities we signed agreements with third parties.
Collaboration with third parties
We use external service providers to operate our website and deliver our services. Where these providers process personal data on our behalf, we enter into data processing agreements with them. They process the data in accordance with our documented instructions and apply appropriate technical and organisational safeguards.
Some services may involve processing personal data outside the European Economic Area (EEA), which comprises the European Union member states, Iceland, Liechtenstein and Norway. Information about the respective recipients and the grounds for transferring data to countries outside the EEA is provided in the following sections on individual services.
Disclosure of your data
The personal data processed by Gardena.Net S.n.c. is subject to forwarding in the following cases. The personal data is stored for the purpose of fulfilling the contract (for example, via an inquiry to the hotel) and transmitted to our end customer.
- The personal data is transmitted to our business partners, who can promote their services on our platforms and for which the user can register. These services may be services related to our services, such as rental services
- The personal data is disclosed to subcontractors for technical checks, payments, identity and delivery services, analysis providers or credit insurance agencies
- The personal data will be communicated to the public administration and the authorities when required by law
- The personal data will be passed on to credit institutions with which we have business relations for the administration of receivables/payables as well as for arranging financing.
- The personal data will be passed on to any natural or legal, public and/or private person (legal, administrative and tax consultant offices, courts, chambers of commerce, etc.), if the passing on of the data proves to be necessary or expedient for the performance of our activities
User rights
You or your authorised representative can exercise your rights by contacting the data controller, Gardena.Net S.n.c., at Str. Chemun 13, 39047 S. Cristina (BZ), Italy, or by emailing [email protected]. Your contact person is Klaus Kaserer. The affected person has the right to obtain a copy of the data in our possession, which will be made available in accordance with the terms of current regulations.
In specific cases, we do reserve the right to store some information for legal purposes (for example in case of suspected fraud, or breach of the general terms and conditions). Should you believe that your rights have been violated, you can contact the relevant data protection authorities or take legal action.
Below we are summarizing the rights of an affected person:
- Right to receive confirmation of the data treatment
Each affected person has the right to ask the owner of the personal data treatment if the data are being treated. Anyone wishing to exercise this right may contact us at any time. - Right of information
Each affected person has the right to obtain at any time and free of charge information regarding the treatment of their own personal data. The notification must contain the following information:- the purposes of the treatment
- the types of personal data being treated
- the recipients or categories of recipients to whom your personal data have been or will be disclosed, particularly recipients in third countries or international organisations. Where your data are transferred to a third country or an international organisation, you also have the right to information about the appropriate safeguards relating to the transfer.
- the period of conservation contemplated for the treatment and the storage of the personal data
- the possibility to issue a complaint with the data protection authorities
- in those cases when the personal data were not collected or treated by the company, the possibility of obtaining appropriate information on their source and origin
- the possibility of automated decisions, even when contemplated by art. 22, par. 1 and 4 of the GDPR on the profiling of personal data, and in this case obtain appropriate and supported information regarding the logics followed for such decisions and the possible consequences that this solution may bring for the the affected person.
- Right of correction of personal data
The affected person has the right to request the immediate correction of any errors in their own personal data. - Right of cancellation
The affected person has the right to ask the owner of treatment to immediately delete their own personal data, if at least one of the following conditions is met and that the processing of the personal data is not required:- The personal data are no longer needed for the purposes for which they were collected or otherwise processed.
- You withdraw the consent on which the processing is based under Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for processing your data.
- You object to the processing under Article 21(1) of the GDPR and there are no overriding legitimate grounds for continuing it, or you object to processing for direct marketing under Article 21(2) of the GDPR.
- The personal data are not being treated in a compliant way.
- The cancellation of the personal data is required to fulfil a legal obligation contemplated by national or EU laws, to which the owner of treatment must abide.
- The personal data have been treated following the requests of services by a minor, in compliance with the provisions of art. 8, paragraph 1 of the GDPR.
- Right of limitation of the treatment
The affected person has the right to ask the owner of treatment to limit the processing if one of the following conditions persists:- The correctness of the personal data is disputed by the affected person. The limitation shall apply for a period of time that will give the responsible person the possibility to verify the correctness of the personal data.
- The treatment is not in compliance with current laws; the affected person refuses the cancellation of the personal data, asking instead their limitation.
- The owner of the treatment no longer needs the personal data for the purpose of the treatment, but the data subject requires the same to assert, exercise or defend their rights for legal action.
- The affected person has disagreed to current treatment according to art. 21, paragraph 1 of the GDPR and it has not yet been clarified if the legitimate reasons of the owner of the treatment have priority on those of the affected person.
- Right of data transmissionWhere processing is automated and based on your consent under Article 6(1)(a) or Article 9(2)(a) of the GDPR, or on a contract under Article 6(1)(b), you have the right to receive the personal data you provided to us in a structured, commonly used and machine-readable format. You may transmit these data to another controller without hindrance from us. You may also request that we transfer them directly to another controller where technically feasible. Exercising this right must not adversely affect the rights and freedoms of others.
- Right to object
You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions. We will then stop processing your data unless we demonstrate compelling legitimate grounds that outweigh your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims.
You may also object at any time to the use of your personal data for direct marketing, including related profiling, without giving a reason. If you object, we will stop using your data for these purposes. - Automated individual decision-making, including profilingYou have the right not to be subject to a decision made solely through automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. Exceptions apply where the decision is necessary to enter into or perform a contract between you and us, is authorised by applicable EU or Member State law providing appropriate safeguards, or is based on your explicit consent.
Where a decision is necessary for a contract or based on your explicit consent, we provide appropriate safeguards, including at least the right to human intervention on our part, to express your point of view and to challenge the decision. - Right to withdraw the consent to the data treatment
The affected person has the right to withdraw at any time the consent to the treatment of their own personal data previously granted to the owner of the treatment.
Place of the data treatment
Your personal data is processed at our business premises and by the service providers we use. Processing may also take place outside the European Economic Area (EEA). Further information is available in the sections on individual services. For further information, please contact us at the addresses indicated in the “Legal info” section.
Google Analytics
We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We use this service to understand how visitors use our website, improve its content and features, and measure the effectiveness of our marketing activities. Google Analytics is loaded only after you have given your consent. It uses cookies and similar technologies to collect information about your use of the website. This includes, for example, the pages you visit, your interactions, the timing and duration of your visit, technical information about your browser and device, how you reached our website, and your approximate location. This data is associated with pseudonymous identifiers. For visits from the European Union, Google states that it uses IP addresses to determine approximate location information and then discards them without storing them in Google Analytics. This does not automatically make the other usage data collected anonymous.
Google Signals and integration with Google Ads
We use Google Signals and have linked Google Analytics to Google Ads. Where you have consented to the relevant analytics and advertising features, we can use them to evaluate our campaigns and create audiences for interest-based advertising. Google Signals allows Google to link usage information across devices for people who are signed into their Google accounts and have enabled personalised advertising. We receive aggregated reports, for example on demographics and interests. For remarketing purposes, your activity on our website may be used to infer interests and create advertising audiences. This allows ads relevant to your interests to be shown on Google services and other websites in Google’s advertising network. This constitutes a form of profiling.
Legal basis and withdrawal of consent
Processing is based on your consent under Article 6(1)(a) of the GDPR. Article 122 of the Italian Data Protection Code also applies to storing information on your device and accessing that information. You can withdraw your consent at any time through the cookie settings on our website. Withdrawal takes effect going forward and does not affect the lawfulness of processing carried out before you withdrew your consent. You can also prevent Google Analytics from collecting your data by installing the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout?hl=en).
Data retention
We have set a retention period of 14 months in Google Analytics for the user-level and event-level data covered by this setting. Once the applicable period expires, this data is deleted through Google’s automated deletion processes. Aggregated statistical reports are not affected by this setting. Further information is available in Google’s guidance on Analytics data retention (https://support.google.com/analytics/answer/7667196?hl=en).
Recipients and international data transfers
Google processes Analytics data on our behalf under its data processing terms (https://business.safety.google/adsprocessorterms/). When linked advertising features are used, further processing is also governed by the terms applicable to those features and the consent you have given.
Data may also be transferred to Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework. Transfers covered by this framework are based on the European Commission’s adequacy decision under Article 45 of the GDPR. For other transfers not covered by an applicable adequacy decision, Google’s contractual terms provide, in particular, for the use of Standard Contractual Clauses. Details are available in Google’s information on international data transfers (https://business.safety.google/adsdatatransfers/).
Further information is available in Google’s Privacy Policy (https://policies.google.com/privacy?hl=en), its guidance on safeguarding data in Google Analytics (https://support.google.com/analytics/answer/6004245?hl=en) and the Google Analytics Terms of Service (https://marketingplatform.google.com/about/analytics/terms/gb/).
Meta Pixel, Conversions API and Advanced Matching
We use the Meta Pixel and Conversions API provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”) on this website. These tools allow us to measure the effectiveness of our advertising on Facebook and Instagram and show website visitors advertising based on their interests (remarketing). Creating audiences based on browsing behaviour constitutes a form of profiling.
These services are used only with your prior consent. Usage data, such as page views and clicks, and technical information, including your IP address, browser information and cookie identifiers, are transmitted to Meta through your browser and a server-side connection. Meta may associate this data with an existing Facebook or Instagram account.
We also use automatic and manual Advanced Matching. Information provided on our website, such as your email address, first name and surname, may be hashed before being transmitted to Meta to improve the attribution of website activity to advertisements and the creation of audiences. Hashing does not anonymise the data.
The legal basis is your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Article 122 of the Italian Data Protection Code. You may withdraw your consent at any time through the cookie settings on our website, with effect for the future. Withdrawal does not affect the lawfulness of processing carried out beforehand.
To the extent that the collection and transmission of data fall within the scope of joint controllership, we and Meta act as joint controllers under Article 26 GDPR. You may exercise your rights against either party. The relevant agreement is available at (https://www.facebook.com/legal/controller_addendum).
Data may also be transferred to Meta Platforms, Inc. in the United States. Where these transfers fall within the scope of Meta’s certification under the EU-US Data Privacy Framework, they are based on the European Commission’s adequacy decision. Further information: (https://www.facebook.com/privacy/policies/data_privacy_framework).
Information on further processing, retention periods and the settings available to you can be found in Meta’s Privacy Policy (https://www.facebook.com/privacy/policy/).
YouTube
We embed YouTube videos on our website. YouTube is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The YouTube player is loaded only with your prior consent. When it loads, information including your IP address, browser and device details, the page you have visited and your use of the videos may be transmitted to Google. If you are signed in to your Google account, Google may associate this information with your account.
We use privacy-enhanced mode. This limits the use of video views to personalise your YouTube experience but does not prevent the processing of personal data.
The legal basis is your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Article 122 of the Italian Data Protection Code. You may withdraw your consent at any time through the cookie settings on our website, with effect for the future. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Data may also be transferred to Google LLC in the United States. Where these transfers fall within the scope of Google’s certification under the EU-US Data Privacy Framework, they are based on the European Commission’s adequacy decision. Further information on international data transfers is available at (https://policies.google.com/privacy/frameworks?hl=en).
Information on how your data is processed, retention periods and the settings available to you can be found in Google’s Privacy Policy (https://policies.google.com/privacy?hl=en)
Google Maps
We use Google Maps, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to display interactive maps on our website. The maps are loaded only with your prior consent. When they load, information including your IP address, browser and device details, the page you have visited and your use of the maps may be transmitted to Google. This also applies if you do not have a Google account. If you are signed in to your Google account, Google may associate this information with your account.
The legal basis is your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Article 122 of the Italian Data Protection Code. You may withdraw your consent at any time through the cookie settings on our website, with effect for the future. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Data may also be transferred to Google LLC in the United States. Where these transfers fall within the scope of Google’s certification under the EU-US Data Privacy Framework, they are based on the European Commission’s adequacy decision. Further information on international data transfers is available at (https://policies.google.com/privacy/frameworks?hl=en).
Information on how your data is processed, retention periods and the settings available to you can be found in Google’s Privacy Policy (https://policies.google.com/privacy?hl=en).
SSL certificate
We treat personal data collected on the website using computerised processes. Personal data are protected by Secure Socket Layer (SSL) encryption. This technology protects the user from the risk of unintentional disclosure of personal data when using an unprotected connection.
The user is notified when accessing a protected connection by a padlock icon. By clicking the padlock icon, the user can then make sure that the SSL certificate is valid and up to date.
Hotjar
We use the Hotjar Ltd advertisement analysis service. By using these technologies, we get to know how visitors behave on the website, for example by scrolling down. We know which sections users visit and how many times they click on the single section. This tool also enables us to obtain opinions directly from website users. This information helps us rendering the navigation faster and more enjoyable.
By using this tool, we pay special attention to the treatment of personal data. We learn which section is clicked the most, the mouse movements on the website, how many times the website is scrolled down, the size and characteristics of the screen used for the navigation, the type of navigation tool (PC, laptop, mobile device, ...), the browser, the country of the visitor and the selected language. To prevent the usage of Hotjar, simply install a so-called “Do Not Track-Header”. If you visit our website using several different browsers, make sure to install a “Do Not Track-Header” on each browser. For more information visit the following link: https://www.hotjar.com/opt-out . For the privacy notice visit the following link: https://www.hotjar.com/privacy.
ADDITIVE+ Vouchers
On our website you have the possibility to buy vouchers. To process your purchase and to save and store your data we use software provided by ADDITIVE s.n.c., 39011 Lana (BZ), Italy (“ADDITIVE”). Through the use of these services and systems your data will be processed and stored, at least in part, also outside of the EU or the EEC. The adequate level of data protection is based on an adequacy decision taken by the European Commission (“Privacy Shield”) or on data processing agreements.
The data you provide is required to fulfil the contract or to carry out pre-contractual measures. Without this data we cannot conclude a contract with you. The data will not be transferred to an outside third party, except for your credit card data which will be transferred to the payment provider and to our tax accountant to fulfil our tax obligations.
The data processing takes place in accordance with the requirements of art. 6 para. 1 lit a (consent) and/or lit b (processing necessary for the performance of a contract) of the GDPR.