PRIVACY POLICY
Pursuant to the articles 13 and 14 of EU Regulation No. 679 of 2016, each interested party has the right to be informed of the purposes and methods with which the personal data provided will be processed.
CITY TOURS CO, LTD, in compliance with its Privacy Policy, informs you of the following:
Data Controller
CITY TOURS CO, LTD
Devonshire House, 582 Honeypot Lane, Stanmore, Middlesex, HA7 1JS, United Kingdom
Contacts D.P.O. designated
Email: ceo@citytoursco.com
As a Data Controller, pursuant to art. 13 of the UK Data Protection Act 2018 ("UK GDPR") and art. 13 of the EU Regulation n. 2016/679 ("GDPR"), your data will be processed in the following manner and for the purposes stated below.
Types of Data Collected
Among the Personal Data collected by this Company, either independently or through third parties, are: usage data, name, surname, telephone number, email address, data relating to payment systems, economic and financial data.
All Data required by this Company are mandatory, unless otherwise specified. If the User refuses to provide them, it may be impossible to provide the Service.
Purpose of the Processing
Your personal data is processed:
A) Without your express consent (art. 6 lett. b), e) GDPR), for the following Service Purposes:
- Conclude the contracts and/or professional assignments.
- Fulfill pre-contractual, contractual, and fiscal obligations.
- Fulfill legal obligations, including anti-money laundering.
- Exercise the rights of the Owner, such as defense in court.
B) Only with your specific and distinct consent (Article 7 GDPR) for Marketing Purposes:
- Send newsletters, commercial communications, advertising material regarding products or services.
- Send promotional communications from third parties.
If you are already a customer, we may send commercial communications regarding similar services unless you object (Art. 21 UK GDPR).
Mode and Place of Processing
Treatment Modalities
The Data Controller uses appropriate security measures to prevent unauthorized access, disclosure, modification, or destruction of data.
Processing is carried out using IT and/or telematic tools.
Third parties (IT providers, marketing agencies, hosting providers, etc.) may be appointed Data Processors.
Data may be communicated without consent to:
- Supervisory Bodies,
- Judicial Authorities,
- Insurance companies,
Subjects to whom communication is required by law.
Legal Basis of Processing
Processing is lawful if:
- The User has given consent;
- Necessary to execute a contract;
- Necessary to comply with a legal obligation;
- Necessary to pursue a legitimate interest.
Place of Processing
Data is processed at the headquarters of the Data Controller or third-party processors.
Data may be transferred outside the United Kingdom. Information on such transfers is available on request.
Period of Conservation
- Contract-related data: kept until contract completion.
- Legitimate interest data: kept until the interest is satisfied.
- Data based on consent: kept until revoked.
After expiration, data will be deleted and rights cannot be exercised anymore.
User Rights
Users have the following rights under Article 15 GDPR:
Right to obtain:
- Origin of personal data
- Purpose and methods of processing
- Logic of electronic processing
- Identification details of the controller and processors
- Subjects to whom data may be communicated
Right to confirm the existence of data and receive it in intelligible form.
Right to obtain:
- Updating, rectification, integration of data
- Deletion, anonymization, or blocking of data processed unlawfully
Right to object, in whole or in part:
- For legitimate reasons, to data processing
- To direct marketing (automated or traditional)
Additional rights (Articles 16–21 GDPR):
- Right to rectification
- Right to be forgotten
- Right to restriction of processing
- Right to data portability
- Right to object
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
Details on the Right to Object
Users may object to processing carried out:
- In the public interest
- For the legitimate interests of the Controller
For direct marketing, users may object without providing any reason.
How to Exercise Rights
Requests must be sent to the Data Controller using the contacts provided.
Requests are processed free of charge within one month.
Defense in Court
Personal Data may be used in court or in preparation for possible legal action.
The User acknowledges that the Data Controller may be required to disclose Data by public authorities.
Changes to the Privacy Policy
The Data Controller may modify this Policy at any time by notifying Users.
