Return Policy in accordance with Art. 13 of EU Regulation 2016/679

Dear Customer,
pursuant to Art. 13 of EU Regulation 2016/679 (i.e., the GDPR), and in relation to the personal data that Bibione Terme S.p.A. will come into possession of, we wish to inform you of the following:

1. Purposes of processing
Your personal data, freely provided and collected in connection with the activities carried out by Bibione Terme S.p.A., will be processed for the following purposes:

• Sending communications for promotional and marketing purposes;
• Marketing our products and/or services on our e-commerce site (pool passes, wellness packages, cosmetic products, etc.);
• Statistics and customer profiling.
  

Your data will also be processed for the purposes provided for by the current anti-money laundering legislation (Legislative Decree 231/2007 and subsequent amendments).
The data processed (which may be of a general, identifying, sensitive, or criminal nature) is up-to-date, complete, and does not exceed the purposes listed above for which it is collected and subsequently processed.
Other purposes relate to ordinary administrative, commercial, and marketing activities.

2. Methods of processing
The data will be processed, with the necessary security and confidentiality, through the following methods:

• Collection of data from the data subject (e.g., completion of a paper questionnaire);
• Collection of data electronically (completion of an electronic form);
• Processing carried out with the aid of electronic and automated tools.
  

3. Legal basis for processing
The provision of general, sensitive, and criminal personal data is strictly necessary for the purposes set out in point 1.

4. Refusal to provide data
You have the right to refuse to provide your personal data. However, such refusal will result in the inability to receive the requested service, making it impossible to complete the registration process, and the Data Controller will not be able to fulfill its contractual obligations.

5. Communication of data to third parties
Your personal data will be processed by the Data Controller, the Data Processors appointed by it, and strictly authorized data processors.
Your data may be communicated to:

• Companies/professional firms providing assistance, consultancy, or collaboration to the Data Controller in accounting, administrative, tax, legal, fiscal, and financial matters;
• Public administrations for the performance of institutional functions within the limits established by law or regulations;
• Third-party service providers to whom communication is necessary to fulfill the services subject to the contract;
• Inspection bodies responsible for verifying and monitoring compliance with legal obligations.

Finally, your data may be communicated to:

• Google and other search engines;
• Social Networks (Facebook, Instagram, etc.);
• Competent authorities;
• Ensoul S.r.l.;
• Shopify International Limited;
• Intuit Mailchimp;Zoho Corporation;
• Aleapro Snc.
  

6. Disclosure of data
Sensitive data is not subject to disclosure except for purposes strictly related to the performance of the contractually assumed obligation.

7. Transfer of data abroad
The collected data may be transferred to countries within the European Union and to third countries outside the European Union.

8. Data retention period
The collected data will be retained for a period of no less than 10 years. This period may be extended in the event of a specific legal obligation.

9. Data Subject Rights
You have the right:
To access your personal data;
To obtain the rectification or erasure of such data or the restriction of processing affecting you;
To object to processing (subject to the limitations set out in point 3);
To data portability;
To withdraw consent;
To lodge a complaint with the supervisory authority (Italian Data Protection Authority).

10. Data Controller and Data Protection Officer
The Data Controller is Bibione Terme S.p.A., with registered office at Via delle Colonie n. 3 - 30028 Bibione (VE), represented by its Legal Representative Vardanega Alessandro.
Data Controller contact details
Email: segreteria@bibioneterme.it
PEC: bibionetermespa@pec.it
Tel: 0431-441111
Fax: 0431-441199
The designated Data Protection Officer (DPO) is Mr. Occari Nicola, who can be contacted at the following addresses: Email: dpo@bibioneterme.it

Privacy Notice pursuant to and for the purposes of EU GDPR 2016/679 relating to the protection of personal data processing

Dear Customer,
in your capacity as “Data Controller” and “Data Subject” (i.e. the person to whom the data subject to processing refers), we wish to inform you of the essential elements of the processing carried out.

1. Purposes of processing
The collection and processing of identifying and special categories of personal data are carried out for the following purposes:

• Compliance with regulatory obligations: All operations required by regulatory, tax and fiscal obligations arising from the operation of the thermal spa facility.
• Provision of healthcare services: The establishment and performance of relationships aimed at providing the requested healthcare services.
• Establishment of relationships: Operations strictly connected to and necessary for the establishment of the aforementioned relationships, including the collection of preliminary information.
• Management of relationships with the Customer: Administrative, accounting, order, shipping, invoicing, and service management activities, as well as the management of any disputes.
• Customer satisfaction and statistics: Monitoring customer satisfaction levels and compiling statistics for internal use.
  

Data will be processed in accordance with the principles of fairness, lawfulness, transparency, and the protection of confidentiality and rights.
The contractual, service provision, commercial dispute, and promotional purposes relate to the processing of the Customer's personal data only. The Customer's personal data will be processed throughout the duration of the established relationships and subsequently for the fulfillment of all legal obligations, as well as for future commercial purposes.

2. Methods of processing
Data processing is carried out both automatically (on electronic or magnetic media) and non-automatically (on paper media), in compliance with the confidentiality and security rules provided by law, subsequent regulations, and internal provisions.

3. Location of processing
Data is processed and stored at the premises located at Via delle Colonie 3, 30028 Bibione (VE). Furthermore, it is processed by professionals and/or companies entrusted with technical, development, management, and administrative-accounting activities. Data will not be transferred outside the European Union (EU).

4. Mandatory or optional nature of data provision
Some data are essential for establishing the relationship aimed at providing the healthcare service, while others are ancillary. Data provision is mandatory only for those for which a regulatory or contractual obligation is provided.

5. Consequences of a refusal to provide data

• Regulatory or contractual obligation: A refusal would prevent the performance or continuation of the Contract, constituting unlawful processing.
• No legal obligation: The refusal would not have the same consequences but would prevent the performance of ancillary operations.
  

6. Communication of data
Data may be communicated to:

• Public and private entities: Financial Administration, Tax Police Authorities, Judicial Authorities, Labour Inspectorate, Local Health Authority, Social Security Institutions, ENASARCO, Chamber of Commerce, etc.
• Authorized parties: Entities that may access data pursuant to legal provisions.
• Professionals and consultants: Consulting companies and other professionals.
  Sensitive data will not be subject to dissemination and/or transfer, except to achieve the specified purposes and subject to your prior written authorization.
  

7. Data retention periods
Data will be retained for:

• Administrative and accounting activities: 10 years, as established by Art. 2220 of the Italian Civil Code, except in cases of delayed payments justifying an extension.

8. Data subject rights
The Customer may exercise the rights provided for by European Regulation 2016/679 and current legislation, including:

• Access to personal data
• Rectification or erasure of data
• Restriction of processing
• Objection to processing
• Data portability
• Withdrawal of consent
• Lodging a complaint with the supervisory authority
• In the event of consent to processing, the data subject may withdraw it at any time, except for mandatory obligations provided by the legislation in force at the time of the withdrawal request. To exercise these rights, contact the Data Controller using the contact details provided below.
  

9. Data Controller and DPO (Data Protection Officer)
The Data Controller is BIBIONE TERME S.P.A., with registered office at Via delle Colonie 3, San Michele al Tagliamento (VE), 30028 - Fraz. Bibione (VE). Rights may be exercised by sending communications to:
Email: info@bibioneterme.it
PEC: bibionetermespa@pec.it
The company has appointed a Data Protection Officer (DPO) as the single point of contact for privacy matters, who can be contacted at the email address: dpo@bibioneterme.it.

Privacy notice pursuant to and for the purposes of EU GDPR 2016/679 on the protection of personal data processing

In your capacity as “Data Controller” and “Data Subject”, i.e., the person to whom the data subject to processing refers and/or who manages it under your responsibility, we wish to inform you of the essential elements of the processing carried out.

1. Purposes of processing
Personal data is collected and processed for the purpose of:

• fulfilling all operations required by regulatory obligations, tax and fiscal provisions arising from the conduct of business activities and the requirements provided for in anti-money laundering matters;
• establishing and executing current contractual relationships, as well as any pre- and post-sales assistance activities;
• operations strictly connected to and instrumental for the start of the aforementioned relationships, including the acquisition of preliminary information prior to the conclusion of the Contract;
• managing relationships with the supplier for administration, accounting, orders, shipping, invoicing, services, and management of any disputes;
• evaluating suppliers and carrying out related statistical processing.
  

The data will be processed in accordance with the principles of fairness, lawfulness, transparency, and the protection of your confidentiality and your rights. The contractual, service provision, commercial and non-commercial dispute, and promotional purposes concern the processing of the Supplier's personal data only. The Supplier's personal data will be processed throughout the duration of the established contractual relationships and also subsequently for the fulfillment of all legal obligations as well as for future commercial purposes.

2. Anti-Money Laundering and Counter-Terrorism
The provision of data required by anti-money laundering and counter-terrorism regulations is mandatory, and any refusal to respond precludes the requested professional service and may result in the reporting of the transaction to the competent supervisory body. In this regard, it is specified that the processing of personal data connected to anti-money laundering obligations will take place with regard to the specific methods of execution imposed on non-financial operators by the Regulation on the identification and retention of information provided for in Art. 3, paragraph 2, of Legislative Decree no. 56/2004 and adopted by Ministerial Decree no. 143/2006. Other information may also be obtained from public sources to comply with the obligations referred to in Legislative Decree 231/2007.

3. Methods of processing
The data is processed for the stated purposes using both automated methods, on electronic or magnetic media, and non-automated methods, on paper media, in compliance with the confidentiality and security rules provided by law, subsequent regulations, and internal provisions.

4. Location of processing
The data is currently processed and stored at the office located at Via delle Colonie 3, San Michele al Tagliamento (VE), 30028 - Fraz. Bibione (VE). It is also processed on behalf of the company by professionals and/or companies commissioned to carry out technical, development, management, and administrative-accounting activities. The data will not be transferred outside the European Union (EU).

5. Mandatory or optional nature of data provision
Some data are essential for establishing or executing the contractual relationship, while others may be considered ancillary to these purposes. Data provision to the company is mandatory only for data for which a regulatory or contractual obligation is provided for.

6. Consequences of a refusal to provide data
In cases where data provision is required by a regulatory or contractual obligation, any refusal would leave the Supplier unable to perform or continue the Contract, as it would constitute unlawful processing. In cases where no legal obligation to provide data is provided for, the refusal would not have the consequences mentioned above, but would still prevent the performance of ancillary operations.

7. Communication of data
Without prejudice to communications and disclosures made in the performance of legal obligations, data relating to your legal entity may be communicated in Italy and/or abroad to:

• Professionals and consultants, consulting firms, factoring companies, credit institutions, debt collection companies, credit insurance companies, commercial information companies, companies operating in the transport sector;
• Public and private entities, also following inspections or audits, such as: the Financial Administration, Tax Police Authorities, Judicial Authorities, the Italian Exchange Office, the Labour Inspectorate, Local Health Authorities, Social Security Institutions, ENASARCO, the Chamber of Commerce, etc.;
• Other companies within the BIBIONE TERME S.p.A. Group;
• Entities that may access your data by virtue of a legal provision.
  

Sensitive data, although processed in a completely anonymous form, will not be subject to any form of disclosure and/or transfer, except exclusively for the achievement of the purposes stated herein and subject to your specific written authorization.

8. Transfer of data abroad
Supplier data is not transferred outside the European Union.

9. Data retention periods
The data provided will be stored in our archives according to the following parameters:

• For administration, accounting, orders, management of budgeting and the entire production, assistance, and maintenance flow, shipping, invoicing, services, and management of any disputes: 10 years, as established by law pursuant to Art. 2220 of the Civil Code, without prejudice to any delayed payments of fees that justify an extension.
• For the purposes referred to in points 5 above, the retention periods are until the expiration of the contract and/or the commercial supply relationship.
  

10. Data subject rights
Regarding the personal data themselves, the Supplier may exercise the rights provided for within the limits and under the conditions provided for by European Regulation 2016/679 and current legislation. In the event of signing any form of consent to the processing requested by BIBIONE TERME S.P.A., please note that the data subject may revoke it at any time, without prejudice to the mandatory obligations provided for by the regulations in force at the time of the revocation request, by contacting the Data Controller at the contact details provided below.

11. Data Controller and Data Processor
The Data Controller, whom you may contact to exercise the rights mentioned above, is BIBIONE TERME S.P.A., with its registered office at Via delle Colonie 3, San Michele al Tagliamento (VE), 30028 - Fraz. Bibione (VE). The Data Processor is the current Legal Representative. You may also exercise your rights by sending communications to the following email address: info@bibioneterme.it or bibionetermespa@pec.it. The company has appointed a Data Protection Officer (DPO) as the single point of contact for privacy matters, whom you can contact at dpo@bibioneterme.it.