Privacy policy

Privacy Notice pursuant to Article 13 of EU Regulation 2016/679

Dear Customer,

pursuant to Article 13 of EU Regulation 2016/679 (GDPR), and in relation to the personal data that Bibione Terme S.p.A. will acquire, we wish to inform you of the following:

  1. Purposes of Processing:

Your personal data, freely provided and acquired in the course of Bibione Terme S.p.A.'s activities, will be processed for the following purposes:

  • Sending communications for promotional and marketing purposes;
  • Marketing our products and/or services through our e-commerce platform (pool tickets, wellness packages, cosmetic products, etc.);
  • Statistics and customer profiling.

Your data will also be processed for the purposes required by the current anti-money laundering regulations (D.LGS. 231/2007 and subsequent amendments).

The data processed (which may be common, identifying, sensitive, or judicial in nature) will be accurate, complete, and not excessive in relation to the purposes for which they were collected and subsequently processed.

Other purposes relate to ordinary administrative, commercial, and marketing activities.

  1. Processing Methods:

The data will be processed, ensuring the necessary security and confidentiality, using the following methods:

  • Collection of data from the data subject (e.g., filling out a paper questionnaire);
  • Collection of data electronically (filling out an online form);
  • Processing using electronic and automated tools.
  1. Legal Basis for Processing:

The provision of common, sensitive, and judicial personal data is strictly necessary for carrying out the activities described in point 1.

  1. Refusal to Provide Data:

You have the right to refuse to provide your personal data. However, such refusal will result in the inability to receive the requested service, making it impossible to complete the registration process, and the Data Controller will not be able to fulfill contractual obligations.

  1. Disclosure of Data to Third Parties:

Your personal data will be processed by the Data Controller, by the Data Processors appointed by them, and by strictly authorized personnel.

Your data may be disclosed to:

  • Companies/professional firms providing assistance, consultancy, or collaboration to the Data Controller in the areas of accounting, administration, tax, legal, and financial matters;
  • Public administrations for the performance of institutional functions within the limits set by law or regulations;
  • Third-party service providers to whom data disclosure is necessary to fulfill the contractual services;
  • Supervisory bodies responsible for checks and controls related to compliance with legal obligations.

Your data may also be disclosed to:

  • Google and other search engines;
  • Social networks (Facebook, Instagram, etc.);
  • Competent authorities;
  • Ensoul S.r.l.;
  • Shopify International Limited;
  • Intuit Mailchimp;
  • Zoho Corporation;
  • Aleapro Snc.
  1. Data Dissemination:

Sensitive data are not subject to dissemination except for purposes strictly related to fulfilling contractual obligations.

  1. Transfer of Data Abroad:

The collected data are not expected to be transferred to countries outside the European Union or to third countries outside the European Union.

  1. Data Retention Period:

The collected data will be retained for a period of not less than 10 years. This period may be extended in accordance with a specific legal obligation.

  1. Rights of the Data Subject:

You have the right:

  • To access your personal data;
  • To obtain the rectification or deletion of the data or the limitation of processing;
  • To object to processing (with the limitations mentioned in point 3);
  • To data portability;
  • To withdraw consent;
  • To lodge a complaint with the supervisory authority (Data Protection Authority).
  1. Data Controller and Data Protection Officer (DPO):

The Data Controller is Bibione Terme S.p.A., located at Via delle Colonie n. 3 - 30028 Bibione (VE), represented by the legal representative Alessandro Vardanega.

Contact details of the Data Controller:

The designated Data Protection Officer (DPO) is Mr. Nicola Occari, who can be contacted at: