PRIVACY NOTICE – TOURISM OFFICE
Privacy notice provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and Articles 13 and 14 of Law No. 171 of 21 December 2018, as amended.
This notice describes how the Tourism Office processes your personal data.
a) Data Controller
The Data Controller of the personal data processed by the Public Administration is the State Congress, acting through the Director of the Public Function, as the subject appointed to exercise the functions of Data Controller pursuant to State Congress Resolution No. 5 of 11 March 2019, as amended by State Congress Resolution No. 28 of 22 May 2023.
Address: Via della Capannaccia, 13 – 47890 San Marino – Republic of San Marino
Tel: (+378) 0549 882837
Fax: (+378) 0549 882835
Email: info.direzionegeneralefunzionepubblica@pa.sm
b) Data Protection Officer (DPO)
The Data Protection Officer is designated pursuant to Article 38 of Law No. 171/2018 and, within the Public Administration, is identified as the “Procurement, Contracts and Personal Data Protection Office” (as provided for by State Congress Resolution No. 13 of 2 May 2022).
Data subjects may contact the Data Protection Officer for all matters relating to the processing of their personal data and the exercise of their rights under the aforementioned law.
Contact details:
Address: Via della Capannaccia, 13 – 47890 San Marino
Tel.: 0549 883496
Email: ufficio.rpd@pa.sm
c) Purposes of processing
Your personal data will be processed for all activities related to handling the requests submitted by you, in particular for the following purposes:
1. management of administrative proceedings aimed at adopting an administrative measure;
2. compliance with legal and contractual obligations;
3. registration in the Register of Professional Tourism Operators and related supervision;
4. fulfilments related to the opening of new accommodation facilities, their conversion or requests for classification;
5. internship/traineeship activities;
6. access to administrative documents or civic access;
7. fulfilment of obligations required by tendering or selection procedures;
8. management of incoming and outgoing electronic and paper correspondence: the optional, explicit and voluntary sending of emails or paper correspondence to the addresses of the Tourism Office entails the acquisition of the sender’s address, necessary to respond to requests, as well as any other personal data included in the correspondence;
9. complaint management;
10. publication of personal data of Professional Tourism Operators on the website www.visitsanmarino.com
11. publication of personal data relating to extra-hotel accommodation activities on the website www.visitsanmarino.com
12. creation of databases for direct marketing activities: personal data, specifically email addresses, voluntarily provided by the data subject to use tourism-related activities and/or services offered by the Tourism Office, will be included in a specific database and used for promotional purposes;
13. sending promotional material (via specifically created mailing lists), informational material, commercial and/or advertising communications relating to events, services, activities and initiatives of the Tourism Office;
14. personnel management (Public Administration employees only).
The Tourism Office does not collect any information that is not necessary for the execution of the above-mentioned purposes and for the performance of tasks carried out in the public interest or connected with the exercise of public authority, within the administrative processes and procedures it manages.
According to the applicable legislation, the processing of your data will be carried out in compliance with the principles of lawfulness, fairness, transparency and protection of your privacy and rights.
d) Legal basis for processing
For the purposes referred to in points 1, 2, 3, 4, 5, 6, 7, 8, 9 and 14, processing is lawful pursuant to Law No. 171/2018, Article 5, paragraph 1 letter e), according to which “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.
Therefore, the processing of the data you provide does not require your consent, as it is lawfully carried out for the performance of tasks in the public interest or connected with the exercise of public authority.
Processing is also lawful pursuant to the following legislation: Law No. 22 of 27 January 2006 and subsequent amendments; Regulation No. 3 of 8 June 2010 and subsequent amendments; Delegated Decree No. 121 of 25 August 2023; Delegated Decree No. 129 of 30 September 2013 and subsequent amendments; Delegated Decree No. 26 of 2 March 2015 and subsequent amendments.
For the purposes referred to in points 10, 11, 12 and 13, processing is carried out on the basis of the data subject’s consent.
e) Categories of personal data processed
The personal data processed for the performance of tasks in the public interest or connected with the exercise of public authority include:
a) personal identification data;
b) contact details;
c) identity documents;
d) navigation data;
e) bank details;
f) any additional data voluntarily provided by the user.
Providing such data is voluntary but necessary to process your requests; failure to provide them, or providing incomplete or inaccurate data, will make it impossible to handle your request.
f) Categories of recipients of personal data
The Tourism Office may transfer your data to other Public Offices and may acquire your data from other Public Offices. Processed data may also be communicated to public bodies and other public entities (including foreign entities), in accordance with applicable legislation.
Without prejudice to disclosures required by law or contractual obligations, all data collected by the Public Administration may be processed, without your consent and solely for the performance of tasks in the public interest or connected with the exercise of public authority:
* by offices and services of the entire Extended Public Sector;
* by third parties authorised by the Public Administration to perform or involved in public service activities;
* in the case of data relating to job seekers intended to facilitate matching supply and demand of employment, by the general public of internet users, upon the express request of the workers concerned pursuant to Article 95 of Law No. 171/2018.
Your data may also be transferred, without prior authorisation and without your consent:
* to and from all Member States of the European Union and to countries that benefit from an adequacy decision by the European Commission pursuant to Regulation (EU) 2016/679;
* to and from all foreign States with which the Republic of San Marino has entered into bilateral agreements or treaties providing for the exchange of personal data and regulating safeguards for their processing;
* where the transfer is necessary for important reasons of public interest;
* where the transfer is necessary to establish, exercise or defend a legal claim;
* where the transfer is made from a register intended to provide information to the public and which may be consulted either by the general public or by anyone demonstrating a legitimate interest, provided that the requirements for consultation laid down by specific laws are met. In such cases, the transfer may not concern all personal data or entire categories of personal data contained in the register.
g) Browsing data
Access to and navigation of the website visitsanmarino.com takes place through a web browser. Certain data necessary for internet navigation may, by their nature, allow users to be identified through processing and association with data held by third parties. These include IP addresses or domain names of the computers used by users, URI (Uniform Resource Indentifier) addresses of requested resources, time of the request, etc.
Such data are used solely to obtain anonymous statistical information on site usage and to check its correct functioning, and are deleted immediately after processing. Data may be used to ascertain liability in the event of computer crimes against the site.
h) Cookies
No profiling cookies or other tracking methods are used. The site uses only session cookies (which are not stored persistently on the user’s device and disappear when the browser is closed), strictly limited to the transmission of session identifiers necessary to ensure secure and efficient site navigation. These cookies do not allow the acquisition of personally identifiable user data.
Providing such data is voluntary but necessary to process your requests; failure to provide them will make it impossible to handle your request.
i) Online payments
When you make an electronic payment on the Tourism Office portal, you access fully secure pages. Our systems do not store any data relating to the payment instrument used. The information necessary to complete the transaction is acquired directly by the service provider. All transaction elements are encrypted and confidential.
j) Processing methods
Personal data are processed using electronic and paper-based tools. Specific security measures are adopted to prevent data loss, unlawful or incorrect use and unauthorised access.
k) Data retention period
Your data are retained for no longer than necessary to achieve the purposes indicated above. Once information is no longer useful for a specific function or current business, it may still be retained in accordance with State archival rules.
l) Rights of the interested party
The rights of the interested party in relation to the processing of personal data are provided for in Articles 15 to 22 of Law No. 171/2018, including:
* the right to obtain confirmation as to whether or not personal data concerning them are being processed and, where that is the case, access to the data and related information;
* the right to obtain rectification of inaccurate personal data without undue delay;
* the right to obtain completion of incomplete personal data;
* the right to obtain restriction of processing in the cases provided for by law, provided that such processing is not necessary to pursue a relevant public interest.
For a complete list of data subject rights, please refer to Articles 15 to 22 of Law No. 171/2018.
m) Complaints and reports
In the event of complaints, reports or requests for information regarding the exercise of your rights, you may contact the Personal Data Protection Authority:
Address: Contrada Omerelli, 43 – 47890 San Marino – Republic of San Marino
Tel: (+378) 0549 883154
Email: ufficio.segreteria@agpdp.sm