PARKANDCRUISE.COM PRIVACY POLICY
Who is the Data Controller?
International Shore Services Sarl, with its registered office at Rue du Conseil-Général, 14, Geneva (Switzerland) (IDI: CHE-241.222.668) (hereinafter, the “Data Controller”).
How can I contact him?
The company's contact information is as follows:
Peo: support@parkandcruise.com
Address: Rue du Conseil - General, 14 - Geneva (Switzerland)
1. Introduction
Under the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act, legal entities are not considered data subjects; therefore, the European regulation does not apply to them. However, if personal data relating to a natural person is included in the context of collecting corporate data, that person shall be considered a data subject under the aforementioned regulation and law, and the relevant legislation shall apply accordingly.
2. What types of data processing are carried out through the website? What are the legal bases, purposes, and retention periods?
| REGISTRATION FOR INDIVIDUALS |
| PURPOSE |
The purpose of data processing is to register so that you can make purchases more easily; and to exercise or protect a right in the event of a dispute. |
| LEGAL BASIS |
Consent. In the event of a dispute, the legal basis is the legitimate interest of the data controller. |
| SHELF LIFE |
The data will be processed for 3 years or for a longer period in the event of a legal dispute. |
| ADDITIONAL INFORMATION |
Registration is not required to make purchases; you can also proceed as a "guest." |
| REGISTRATION FOR AGENCIES |
| PURPOSE |
The purpose of data processing is to register in order to make purchases on behalf of your customers; and to exercise or defend a right in the event of a legal dispute. |
| LEGAL BASIS |
Contract performance. In the event of a dispute, the legal basis is the legitimate interest of the data controller. |
| SHELF LIFE |
The data will be processed for 3 years or for a longer period in the event of a legal dispute. |
| ADDITIONAL INFORMATION |
The User is entirely free to provide the requested data, as there is no legal obligation to do so. However, if the User chooses not to provide the data marked as essential, the Data Controller will not be able to fulfill the stated purpose. |
| PURCHASE |
| PURPOSE |
The primary purpose of data processing is to enable the User to purchase the requested service; furthermore, the data is necessary to comply with legal obligations (including accounting and tax obligations). The data may be used in the event of disputes regarding the proper fulfillment of the contract. |
| LEGAL BASIS |
Performance of a contract and the resulting fulfillment of the legal obligations incumbent upon the data controller. In the event of a legal dispute, the data will be processed to bring or defend against legal action, which constitutes the legitimate interest of the data controller. |
| SHELF LIFE |
The data will be deleted 10 years after the contract has been fulfilled. It may be retained for a longer period only in the event of disputes and, therefore, to exercise or defend a right based on the data controller’s legitimate interest. |
| ADDITIONAL INFORMATION |
Providing this information is mandatory; if you refuse to provide it, you will not be able to purchase the requested services. |
| BUY WITH QUICK CHECKOUT |
| PURPOSE |
The primary purpose of data processing is to enable the User to purchase and receive the service purchased. The data is also necessary to comply with legal obligations (including accounting and tax obligations). Finally, it may be needed in the event of disputes regarding the proper fulfillment of the contract. |
| LEGAL BASIS |
Performance of a contract and the resulting fulfillment of the legal obligations incumbent upon the data controller. In the event of a legal dispute, the data will be processed to bring or defend against legal action, which constitutes the legitimate interest of the data controller. |
| SHELF LIFE |
The data will be deleted 10 years after the contract has been fulfilled. It may be retained for a longer period only in the event of disputes and, therefore, to exercise or defend a right based on the data controller’s legitimate interest. |
| SOURCE AND CATEGORIES OF PROCESSED DATA |
If you make a purchase using the quick checkout option, your personal, billing, and contact information will be imported from PayPal (Art. 14 of the GDPR). |
| TRANSACTIONAL EMAILS |
| PURPOSE |
The purpose of data processing is to send the User information regarding the purchase made or to complete the registration. |
| LEGAL BASIS |
Performance of the Contract. |
| SHELF LIFE |
Until the order is completed or the registration is completed. |
| ADDITIONAL INFORMATION |
Transactional emails are sent to facilitate better order management and to provide the customer with confirmation of their purchase and registration. |
| NEWSLETTER / DEM |
| PURPOSE |
The purpose of data processing is to send the User newsletters and direct email marketing messages, either through traditional methods or automated means. |
| LEGAL BASIS |
Consent given by the data subject. |
| SHELF LIFE |
1 year from the last mailing or until consent is revoked. |
| ADDITIONAL INFORMATION |
Consent may be withdrawn at any time. The User is under no obligation to provide the requested data, as there is no legal requirement to do so. However, if the User chooses not to provide the data marked as essential, the Data Controller will not be able to fulfill the stated purpose. |
| CONTACT |
| PURPOSE |
The purpose is to contact the company to request information. |
| LEGAL BASIS |
Processing of pre-contractual measures carried out at the request of the data subject or for the performance of a contract. |
| SHELF LIFE |
We will process the data for as long as necessary to respond to requests, and we will subsequently delete the data. We review the data for obsolescence every 12 months. |
| ADDITIONAL INFORMATION |
The User is entirely free to provide the requested data, as there is no legal obligation to do so. However, if the User chooses not to provide the data marked as essential, the Data Controller will not be able to fulfill the stated purpose. |
| REVIEWS |
| PURPOSE |
The goal is to share one's experience and promote the company. |
| LEGAL BASIS |
The Data Controller’s legitimate interest in requesting the review and the Data Subject’s consent to the importation of the review posted on the Verified Reviews platform. |
| SHELF LIFE |
Reviews will be published on the website until they become obsolete and/or until consent is revoked. |
| ADDITIONAL INFORMATION |
Data submission for the request is automatic and occurs upon purchase of the service. Additionally, if you submit a review, it may be posted on the Parkandcruise.com website. |
| NAVIGATION DATA |
| PURPOSE |
Website Security. |
| LEGAL BASIS |
We will process the data based on the company’s legitimate interest in cybersecurity and compliance with legal obligations. The legal basis for processing cookies other than those that are necessary is consent. |
| SHELF LIFE |
24 months. |
| ADDITIONAL INFORMATION |
For information regarding cookies, please refer to the relevant privacy policy. |
3. What else do I need to know?
The data will be processed lawfully, fairly, and with the utmost confidentiality, in compliance with appropriate security measures as required by the Federal Data Protection Act and the Regulation. Processing will be carried out using digital means. The data will not be made public, with the exception of data related to reviews. Furthermore, the user will not be subject to automated decision-making processes such as profiling unless they consent to this by installing cookies or other tracking tools; for information on the regulations governing these, please refer to the relevant privacy notice.
4. Who will my data be shared with?
The Data Controller may disclose the data to any party to whom such disclosure is required by law for the fulfillment of the purposes provided for by law or is necessary for the performance of the contract. The Data Controller also engages certain companies or IT tools that process the personal data of data subjects exclusively in the Data Controller’s interest, such as couriers, all of whom have been duly appointed as data processors pursuant to Article 28 of the GDPR. The data will also be disclosed to payment gateways acting as independent data controllers. The list of data processors is available on-site. Finally, users’ data may be disclosed to third parties acting as independent data controllers for the purpose of finalizing and fulfilling the contract.
5. Where is the data stored and transferred?
Personal data will be processed and stored on servers located both within and outside the EU (specifically, between Italy and Switzerland and vice versa). The Data Controller guarantees that transfers outside the EU are carried out in accordance with Articles 44–47 of Chapter V of the GDPR through the signing of standard contractual clauses and/or pursuant to the EU Commission’s Adequacy Decision of July 26, 2000.
6. What are my rights, and how can I exercise them?
a) Rights of the data subject
As a data subject, the user has the rights set forth in Article 15 et seq. of the Regulation, specifically:
- 1. RIGHT OF ACCESS (Art. 15 GDPR – Art. 24 LPD): The data subject has the right to obtain confirmation as to whether or not personal data concerning him or her exist, even if not yet recorded, and to have such data communicated to him or her in an intelligible form.
- 2. RIGHT TO RECTIFICATION (Art. 16 of the GDPR – Art. 32 of the LDP): The data subject has the right to obtain the rectification of inaccurate personal data concerning him or her, as well as the completion of incomplete personal data.
- 3. RIGHT TO ERASURE (Art. 17 GDPR – Art. 32 LDP): The data subject has the right to obtain the erasure of personal data for specific reasons, such as the withdrawal of consent, objection to processing, or if the data are no longer necessary for the purposes for which they were collected and processed, or in the event of unlawful processing. It will not always be possible to proceed with erasure, but it will certainly be the responsibility of the data controller to provide adequate justification.
- 4. RIGHT TO RESTRICTION OF PROCESSING (Art. 18 GDPR – Art. 32 LDP): The data subject has the right to obtain restriction of processing in specific circumstances, such as, for example, when a request for rectification or objection is pending while the requests are being evaluated.
- 5. RIGHT TO DATA PORTABILITY (Art. 20 of the GDPR – Art. 28 of the LDP): If the processing is based on consent or a contract and is carried out using automated means, the data subject may receive the data in a structured, commonly used, and machine-readable format, or request that the data be transmitted to another data controller.
- 6. RIGHT TO OBJECT (Art. 21 of the GDPR – Art. 37 of the LDP): The data subject has the right to object, in whole or in part:
- (a) on legitimate grounds, to the processing of personal data concerning him or her, even if such data is relevant to the purpose for which it was collected;
- (b) the processing of personal data concerning him or her for purposes not covered by Article 2.
The user may submit a request to object to the processing of their personal data pursuant to Article 21 of the GDPR, setting forth the reasons justifying the objection: the Data Controller reserves the right to evaluate the request, which would not be accepted if there are compelling legitimate grounds for processing that override the user’s interests, rights, and freedoms.
- 7. RIGHT TO FILE A COMPLAINT: The data subject has the right to file a complaint with the competent supervisory authority pursuant to Article 77 of the GDPR—Article 49 of the LDP—if he or she believes that the processing of his or her data is in violation of applicable law.
b) Operating procedures:
The data subject may exercise the rights set forth in the preceding article at any time by contacting the data controller at the addresses listed above.
Latest version:
This privacy policy was drafted by Polimeni.Legal
