According to Article 13 of EU Regulation 2016/679

In accordance with Regulation (EU) 2016/679 – GDPR regarding the protection of individuals with regard to the processing of personal data, as well as the free movement of such data (“Regulation”), C-WAY srl unipersonale, with registered office in Genoa, Area Porto Antico – Ponte Spinola, Tax Code and VAT Number 03789020108, as the Data Controller (“Controller”) as defined in Article 4, n. 7, of the Regulation, is required, pursuant to and for the purposes of Article 13 of the Regulation, subject to the changes and adaptations that may be necessary following the repeal and/or amendment of the Privacy Code, as well as European or national legislative interventions and/or measures by the competent Authorities subsequent to this, to provide certain information regarding the processing of personal data to its clients, also in their capacity as parents. This information should be read carefully before submitting any personal information and/or filling out any electronic forms available on the website www.c-way.it.

The information concerns the following:

A) Data Controller and Co-Data Controller
B) Personal data collected
C) Legal basis and purposes of data processing
D) Methods of processing and data retention period
E) Categories of data recipients
F) Nature – mandatory or optional – of the provision of users' personal data
G) Rights of the data subject and how to exercise them

A) Data Controller and Co-Data Controller

The Data Controller is C-WAY s.r.l. unipersonale, located in Genoa, Area Porto Antico – Ponte Spinola, VAT Number 03789020108. For quotes and bookings through the call center or if the site is used for purchasing online services, subscribing to the Newsletter, filling out contact forms, or simple registration on the site, the data will also be processed by Costa Edutainment S.p.A., with registered office in Riccione (RN), via Ascoli Piceno n. 6, and administrative office in Genoa, Area Porto Antico – Ponte Spinola, Tax Code and VAT Number 03362540100, as co-data controller. The Data Protection Officer can be contacted at the email address dpo@c-way.it. If you believe that the processing of your data has occurred in violation of the law, you may file a complaint with the Guarantor for the Protection of Personal Data.

B) Personal Data Collected

B.1) Browsing Data
The IT systems and software procedures used to operate the site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of internet communication protocols. This includes IP addresses (Internet Protocol) or domain names of the computers used by the users connecting to the site, URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the size of the file obtained in response, the numerical code indicating the status of the response given by the server, and other parameters relating to the user’s operating system and computing environment. This data is used solely for the purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning. The data may be used to ascertain responsibility in the event of hypothetical computer crimes against the site.

B.2) Data Provided Voluntarily by the User/Visitor
The optional, explicit, and voluntary sending of emails to the addresses indicated on this site involves the subsequent acquisition of the sender’s address, necessary to respond to requests, as well as other personal data included in the message or provided by phone or email to the call center. Such data will be processed exclusively to respond to the request or to provide the service. Specific summary privacy information is provided or displayed on the site pages prepared for specific requested services.

C) Legal Basis and Purposes of Data Processing

The legal basis on which the processing of your data is based is your consent, depending on the purposes for which it has been expressed. In some cases, such as the purchase of tickets or online packages, your lack of consent may result in the impossibility of providing the requested service.
Unless otherwise indicated regarding the cookie policy, personal data will be processed by CE and/or C-WAY exclusively for purposes related to those requested by the data subject and, in particular:

1. Contractual purposes strictly related to and instrumental to the conclusion of a contract, to the execution of pre-contractual obligations or arising from the contract concluded with the data subjects and/or to fulfill specific requests received from the data subjects before the conclusion of the contract, as well as to other activities connected and instrumental to the execution and management of the relationship and to the fulfillment of obligations arising from the contract itself, such as invoicing and/or sending service communications related to it.
   Providing personal data for the above purpose is not mandatory, but refusing to provide it entails – to the extent that such communication is functional to achieving the related purposes – the practical impossibility for the Controller to establish and/or manage the contractual relationship and fulfill the various obligations arising from it.

C.2) Fulfillment of legal obligations, both national and EU, as well as arising from regulations, laws, and/or orders of the competent Authority.
Providing personal data for this purpose is mandatory, and refusing to provide it entails – to the extent that such communication is functional to achieving the related purposes – the impossibility for the Controller to establish and/or manage the contractual relationship.

C.3) Pursuit of legitimate interests of the Controller, such as the management of complaints, disputes, contractual breaches, credit recovery, prevention and repression of unlawful acts, as well as the protection of the rights and legitimate interests of the Controller and/or third parties, even in judicial proceedings. The Controller’s interest corresponds to the constitutionally guaranteed right to action (Article 24 of the Constitution) and, as such, is socially recognized as prevailing over the interests of the individual data subject, with the consequence that the consent of the data subjects is not required for the processing of data for the above purpose.

C.4) Newsletter and marketing activities: with the user’s consent and until revoked, to carry out communication, dissemination, and marketing activities (such as, merely as examples but not exhaustive, sending informational newsletters, promotional and advertising material, and conducting related analyses on registered users, which allow C-Way S.r.l. and CE to improve the services and products offered to their clients);

C.5) Marketing and promotional activities of third parties: with the user’s consent and until revoked, to allow the use of the provided data for marketing and promotional activities of third parties.
Providing data for this purpose is optional and therefore requires the consent of the data subjects. Data subjects can express or deny their consent and, likewise, revoke the previously expressed consent or dissent at any time and with effect from the declaration of revocation. The lack of consent for processing for the aforementioned purpose will not compromise or limit in any way the processing for the other purposes indicated in points A), B), and C), nor will it prejudice the establishment and/or management of the contractual relationship and the fulfillment of the various obligations arising from it.

D) Methods of Processing and Retention Period

The data acquired by the Data Controller is processed lawfully, fairly, transparently, with limitations on purposes and retention, data minimization, accuracy, integrity, and confidentiality.
Data processing will be carried out using manual methods (using paper media) and electronic methods (using computer media), employing security measures aimed at ensuring the confidentiality of personal data and preventing unauthorized access by unauthorized persons.
Personal data will be retained for the duration of the commercial relationship and for as long as necessary to pursue the purposes described in this Privacy Notice (for example, if the user subscribes to a newsletter, for the duration of that subscription, until its closure). After this period, the user’s personal data will be retained only to comply with legal and regulatory obligations (for example, for 10 years in the case of accounting purposes; for the duration of the mandatory retention obligation in the case of tax purposes; etc.) or to allow the Company to maintain proof of respective rights and obligations.

E) Categories of Data Recipients

The personal data of the Data Subject processed by the Data Controller:

• will not be disclosed, nor will it be made known to unspecified subjects, in any possible form, including making them available or simply consulting them;
• may be disclosed (in whole or in part, as appropriate to their respective competence and functionally related to the assigned tasks) to employees of the Data Controller (in particular, employees of the commercial, administrative, and accounting offices, as well as those responsible for entry and cash operations). The Data Controller has expressly authorized all aforementioned individuals who perform tasks involving the processing of personal data and has provided them with specific written instructions regarding the security and correct processing of personal data, including delimiting their scope and permissions;
• furthermore, for the pursuit of the aforementioned purposes, the Data Controller reserves the right to communicate the data of the Data Subjects to recipients belonging to the following categories of external processors to whom specific instructions have been provided: (i) professional firms or professionals conducting activities instrumental to those of the Data Controller (e.g., accountants); (ii) companies providing services for the supply and management of procedures and information systems, communication networks, and protection and security systems; (iii) other service providers performing outsourced activities on behalf of the Data Controller;
• finally, the Data Controller, for the pursuit of the aforementioned purposes, may communicate the data to: (i) judicial authorities, upon their request; (ii) any subjects to whom current legislation and/or the contract imposes an obligation of communication.

F) Nature – Mandatory or Optional – of Providing Users' Personal Data

Providing certain personal data is optional, but refusal to provide them may result – to the extent that such communication is functional to achieving the relevant purposes – in the practical impossibility for the Data Controller to establish and/or manage the contractual relationship and fulfill the various obligations arising from it. For form completion/online purchases, providing certain personal data is partly necessary (i.e., for those data fields marked with an asterisk) so that the Data Controllers can meet the user’s needs within the functionality of the sites. The failure to provide, partially, or inaccurately provide the personal data marked with an asterisk, being necessary for the execution of the requested service, will prevent such execution; whereas the failure to provide, partially, or inaccurately provide optional non-essential personal data will not have any consequences. Any requests for data exceeding the essential ones will be proposed separately with specifications of the processing purposes and any communications to allow for their potential denial.

G) Rights of the Data Subject and How to Exercise Them

We inform you that at any time, and in the presence of legal conditions, you have the right to request C-WAY to allow you access to your personal data, to rectify or delete them, to withdraw consent, as well as to limit processing. You may also oppose the processing and exercise the right to data portability by simply communicating via email as described below.

These rights can be exercised by communicating via email to the addresses privacy@costaedutainment.com and/or privacy@c-way.it, or by writing to the address of the Data Controller specified above. The user may also, if they have consented, oppose the processing for the purpose of sending digital material (newsletters, informational/advertising material, etc.) conducted using the user's email address by clicking on a specific “link” present in every email message.

If you believe that the processing of your Data has occurred in violation of the law, you may file a complaint with the Data Protection Authority.