Types of data processed

In relation to the purposes described below, the Data Controller may process the following categories of data:

Browsing data

• IP address, date and time of the request;
• pages visited, pages of origin (referrer), device and browser parameters;
• technical logs generated by security systems and hosting services.

This data is processed in an aggregate form or in any case not immediately traceable to the user's identity, unless necessary to ascertain responsibility in the event of computer crimes or abuse.

Data provided via the “Contact us” form

• name, surname;
• e-mail address;
• any additional information entered in the “Short description” field.

These data are provided voluntarily by the user to allow the Data Controller to manage and respond to requests sent via the site.

Data provided via the “Work with Us” form

• name, surname, email address;
• category of interest (e.g. pizza chef, waiter, bartender, lifeguard);
• information entered in the “Short description” field;
• data contained in the attached CV (training and professional courses, contact details, skills, any particular data entered spontaneously by the interested party).

Providing the requested data in the fields marked as mandatory is necessary in order to evaluate the application and carry out personnel selection activities.

Purpose of processing and legal bases

• Management of contact requests – respond to requests for information or assistance sent via the form or contact details indicated on the site.
  Legal basis: execution of pre-contractual or contractual measures (art. 6, par. 1, letter b, GDPR) e legitimate interest of the Data Controller to manage the requests (art. 6, par. 1, letter f).
• Staff selection – evaluate the applications received via the “Work with Us” page and contact the candidate for any interviews or further information.
  Legal basis: execution of pre-contractual measures upon request of the interested party (art. 6, par. 1, letter b, GDPR) and, for any particular data entered spontaneously, implied consent in voluntary communication (art. 9, par. 2, letter e).
• Technical management and site security – guarantee the correct functioning of the pages, the security of the systems and prevention/fraud.
  Legal basis: legitimate interest of the Data Controller (art. 6, par. 1, letter f).
• Fulfillment of legal obligations – fulfill obligations established by laws, regulations or requests from the Authority.
  Legal basis: fulfillment of legal obligations (art. 6, par. 1, letter c).
• Direct marketing activities (only if services such as newsletters, sending of promotional communications, etc. are activated in the future and subject to your specific and separate consent).
  Legal basis: consent of the interested party (art. 6, par. 1, letter a), revocable at any time.

No automated decision-making processes or profiling activities are carried out that are capable of producing legal effects on the interested party or significantly impacting him or her personally.

Rights of the interested party under the GDPR

As an interested party, you are granted the rights provided for by the articles. 15–22 of the GDPR. In particular, you have the right to:

• Right of access – obtain confirmation as to whether or not data concerning you is being processed and receive a copy;
• Right of rectification – request the correction or updating of inaccurate or incomplete data;
• Right to erasure (“right to be forgotten”) – obtain the cancellation of personal data in the cases provided for by the art. 17 GDPR;
• Right to limit processing – request the limitation of processing in certain cases (contested accuracy, illicit processing, exercise of your right in court);
• Right to data portability – receive the personal data provided by you in a structured, commonly used and machine-readable format and transmit it to another owner, where technically feasible;
• Right of opposition – object at any time, for reasons related to your particular situation, to processing based on the legitimate interest of the Data Controller;
• Right to withdraw consent – if the processing is based on consent, you can revoke it at any time, without prejudice to the lawfulness of the processing carried out before the revocation;
• Right to lodge a complaint – submit a complaint to the competent Supervisory Authority (in Italy, the Guarantor for the Protection of Personal Data) if you believe that the processing violates the legislation on the protection of personal data.

The exercise of rights is free, except in the cases provided for by the art. 12, par. 5, GDPR, and can be done by contacting the Data Controller directly at the contact details indicated in the last tab.

Data controller and contacts

The Data Controller is:

Bar Restaurant Pizzeria Lido Mojito
by Procopius Michael
88841 Capo Rizzuto – Island of Capo Rizzuto (KR), Italy
E-mail: info@barmojitocaporizzuto.com
Tel.: 329 978 7155 – 388 499 9244

To exercise your rights or for any request relating to the processing of personal data, you can write to the email address indicated, specifying "Privacy request - GDPR" in the subject.

Recipients and categories of subjects who process the data

The data may be processed by:

• internal staff authorized by the Owner (e.g. adequately trained administrative and dining room staff);
• suppliers of technical and IT services (e.g. hosting companies, site maintenance, email providers);
• professional consultants (e.g. tax, legal, labor consultants), to the extent necessary for the execution of their duties;
• subjects and bodies to whom communication is mandatory by law or by order of the Authority.

These subjects act, depending on the case, as data controllers (pursuant to art. 28 GDPR) or as independent data controllers. The updated list of data controllers is available upon written request to the Data Controller.

Place of processing and extra-EU transfers

The processing connected to the site's web services normally takes place within the European Economic Area (EEA). If it becomes necessary to transfer data to third countries, the Data Controller will guarantee compliance with the conditions set out in the articles. 44–49 GDPR (e.g. adequacy decisions of the EU Commission, standard contractual clauses).

Data retention times

• Contact details collected via the “Contact us” form: kept for the time necessary to manage the request and in any case no longer 12 months from the closing of the ticket, except for further legal obligations.
• Application data and CV collected through “Work with Us”: normally kept until 24 months from receipt, for evaluations of present and future positions, unless advance cancellation is requested by the interested party.
• Navigation data and technical logs: kept for periods compatible with the technical and security needs of the site (normally no longer 12 months), except for checks for IT crimes.
• Data processed for legal obligations: kept for the periods established by applicable legislation (e.g. tax, civil, labor).

Once the retention period has expired, the data will be irreversibly deleted or made anonymous, except for any needs for the assessment, exercise or defense of a right in court.