Information pursuant to art. 13 of the Reg. (EU) 2016/679
Dear user,

Identity and contact details of the Data Controller and the DPO
Pursuant to art. 13 of Regulation (EU) 2016/679, TERME DI ACQUI SPA, in person of the legal representative pro-tempore,
with headquarters in Genoa 16125, via Rio Torbido 40, VAT No. 00161640065, tel 010.83401, e-mail: privacy @
informs you to be the owner of the processing of personal data provided by the user (hereinafter, also Customer), at the
time of registration and / or because of the interaction with the website https: // www., and / or, and / or, all sites owned by Terme di Acqui spa
The Data Protection Officer (DPO) is domiciled at the headquarters of the company and can be contacted at the following addresses
tel. 010.8340306, e-mail:

Purpose and legal basis of the treatment
The personal data provided by the user of the site are processed to fulfill pre-contractual obligations (responding to your
requests for information) or to execute the contract with the customer concerning the provision of accommodation and / or
catering services and / or SPA and wellness center, and / or spa treatment services, marketing services provided by the Data Controller.
The contract and / or the fulfillment of pre-contractual or legal obligations is the legal basis of the treatment pursuant to
art. 13, c. 1, lett. c). In the event that the Customer communicates through the “notes” of the FORM on the website, particular
categories of data (eg data on the health of the Customer, allergies, intolerances, pathologies), pursuant to art. 9 Regulation
(EU) 2016/679, the legal basis of the processing is represented by the explicit consent of the Customer.
The communication of personal data is a necessary requirement for fulfilling pre-contractual obligations, for the conclusion and
for the execution of the contract: the Customer has the obligation to provide personal data as the failure to communicate the same
does not allow the fulfillment of obligations pre-contractual and / or the stipulation and / or execution of the contract and / or
the fulfillment of legal obligations.

Newsletter service
The optional, explicit and voluntary sending of messages to the Terme di Acqui SpA contact addresses, as well as the completion
and submission of the forms on the site, entail the acquisition of the sender’s contact details, necessary to respond to the requests
of the User, as well as all personal data included in the communications.
By entering the e-mail address the User accepts the use of our data for sending newsletters. The legal basis for this data processing
is the legitimate interest of Terme di Acqui S.p.A. pursuant to art. 6 (1f) Regulation (EU).
Naturally, the User has the possibility to cancel the newsletter subscription at any time and to revoke the authorization issued for
the future. To this end, the User must click on the corresponding button in the newsletter received. The e-mail address will be
immediately deleted from our system.

Expression of explicit consent pursuant to art. 9 c. 1 Regulation (EU) 2016/679.
In the event that the Customer communicates, through the “Notes” of the FORM on the website, particular categories of data (for
example data on the health of the Customer, allergies, intolerances, diseases, treatments required), pursuant to art. 9 Regulation
(EU) 2016/679, the compilation and submission of the FORM represent a manifestation of free will, specific, informed, and an unequivocal
positive action with which the Customer expresses his explicit consent that the personal data that the concern are subject to treatment by the owner.

Type of data processed
Personal data, common and / or belonging to particular categories of data (Article 9 of Regulation (EU) 2016/679) collected and processed
by the Data Controller may fall into the following categories:
ï identification data of the Customer (name, surname, gender, address, e-mail, telephone, social security number, VAT number, telephone
number, city, province, state);
ï data identifying the current commercial relationship (bank details, accounting and tax data, any payment documents, etc.).
ï data relating to the health of the client (allergies, intolerances, diseases, treatments required).
These data are provided by the customer directly.

Recipients and categories of recipients of personal data
Personal data may be communicated to the following recipients or categories of recipients: employees of the Data Controller (booking
office, marketing) authorized to process, system administrators, labor consultants and / or accounting and / or legal consultants, bound
to professional secrecy, suppliers and / or service companies, financial intermediaries. We provide these entities with only the data
necessary to perform the concorded services
and the same act as Data Processors, pursuant to art. 28 Regulation (EU) 2016/679, based on the instructions received from the Owner.
Personal data may also be disclosed to employees of administrative, commercial and technical departments of companies belonging to the
same corporate group of which the Data Controller is a member.
It is also possible that such data are communicated to financial administrations or public bodies in fulfillment of legal obligations.
Any form of dissemination of data to unidentified third parties is excluded.

Methods of processing and data retention period
Personal data will be processed in paper form, computerized and telematic and entered in the relevant databases, which will be able to
access, and therefore become aware of, the authorized treatment such as: employees of the commercial area, production, administration-accounting,
processing center, as well as operators in the management and maintenance of electronic instruments, quality and safety, subject to authorization.
The Data Controller does not transfer personal data of the Customer either to third countries or to international organizations.
The data will be retained until the termination of the negotiation relationship, subject to compliance with the legal obligations that require
the Data Controller to retain the data of the customer for a longer period and subject to the limitation period of the rights arising from the
contract. We inform you that the processing of your personal data will not be the subject of an automated decision-making process or profiling.

Use of cookies.
To know the types of cookies used by the website, the Customer can compare the relative “cookie policy” available on the website.

Customer rights
The Customer maintains for the duration of data processing access and control powers over his personal data. Consequently, he has the right
to ask the Data Controller, pursuant to art. 15 and ss. of the 2016/679 EU Regulation:
ï confirmation that data processing is in progress and access to personal data;
ï the rectification, deletion, updating and data portability (which is the right to receive, in a structured format, in common use and
automatically readable by personal data, the personal data concerning the data supplied to the Data Controller and the right to transmit
this data to another data controller);
ï the limitation of the processing of personal data concerning you, or the right to object to the processing of data for legitimate reasons;
ï the withdrawal of consent at any time, without prejudice to the lawfulness of the treatment based on the consent given prior to the
revocation, if the processing is based on art. 6, par. 1, lett. a), or on art. 9, par. 2, lett. to).
Furthermore, you are entitled to lodge a complaint with the Guarantor for the protection of personal data, located in Piazza Montecitorio 115/121,
00186, Rome.
All rights that are recognized by the Regulation (EU) 2016/679 may be exercised against the Owner through a written request sent to the following

The Data Controller