1. Data Controller
The Data Controller for your personal data is ASSO SpA, which is responsible to you for the lawful and proper use of your personal data. You may contact ASSO SpA for any information or requests using the following contact details:
Data Controller: ASSO SpA
Legal Representative: LUCA RETINI
Headquarters: Via di Gello 167/6B 56038 Ponsacco PI
VAT Number: 02303630509
Contact Information:
Phone: 0587 398274
Certified email (PEC): asso.spa@pec.it
2. Types of data collected, purposes, and legal basis.
The Personal Data processed is collected either directly from the User/Data Subject or automatically through the website.
Data provided directly by the User/Data Subject:
Thedata provided directly by the User/Data Subject consists of all Personal Data entered by the User/Data Subject on the website or otherwise provided to the Data Controller by any means. Such data will be processed in compliance with the confidentiality guarantees and security measures provided for by applicable law, including through the use of electronic tools directly and/or via third parties, for the purposes listed below along with the relevant legal basis:
A)
PURPOSE: Purposes strictly related to the implementation of pre-contractual measures and to respond to specific requests from the User/Data Subject.
DATA PROCESSED: First Name , Last Name, Email, Phone Number, Company Information.
LEGAL BASIS: Contract to which the data subject is a party and/or the implementation of pre-contractual measures taken at the data subject’s request.
B)
PURPOSE: Exercise of the Data Subject’s rights, such as the right to defend oneself in court
DATA PROCESSED: First Name , Last Name, Email, Phone Number, Company Information.
LEGAL BASIS: Legitimate interest
C)
PURPOSE: Direct and indirect marketing and market research, for the purpose of sending newsletters, emails, text messages, instant messages, and WhatsApp messages containing advertising and informational material.
DATA PROCESSED: First Name , Last Name, Email, Phone Number, Company Information.
LEGAL BASIS: Consent
D)
PURPOSE: Direct and indirect marketing and market research, for the purpose of sending newsletters, emails, SMS messages, instant messages, and WhatsApp messages containing advertising and informational material from third parties (e.g., the Data Controller’s partners)
DATA PROCESSED: First Name , Last Name, Email, Phone Number, Company Information.
LEGAL BASIS: Consent
E)
PURPOSE: Reservation, reception, and administrative/accounting services.
DATA PROCESSED: First Name , Last Name, Email, Phone Number, Company Information.
LEGAL BASIS: Contract to which the data subject is a party and/or the implementation of pre-contractual measures taken at the data subject’s request.
F)
PURPOSE: Reservation , reception, and administrative/accountingservices .
DATA PROCESSED: First Name , Last Name, Email, Phone Number, Company Information.
LEGAL BASIS: Contract to which the data subject is a party and/or the implementation of pre-contractual measures taken at the data subject’s request. The User/Data Subject assumes responsibility for the Personal Data of third parties obtained, published, or shared through this Application and warrants that they have the right to communicate or disclose such data, thereby releasing the Data Controller from any liability toward third parties.
Data collected automatically through the website:
Automatically collecteddataconsists of information gathered automatically through the website www.umamivap.com (including from third-party applications integrated into this Application), such as: the IP addresses or domain names of the computers used by the User/Data Subject connecting to this website, the URI (Uniform Resource Identifier) addresses, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server’s response (successful, error, etc.), the country of origin, the characteristics of the browser and operating system used by the visitor, various time-related details of the visit (such as the time spent on each page), and details regarding the path taken within the Application, with particular reference to the sequence of pages viewed and parameters related to the User’s/Data Subject’s operating system and computing environment. Complete details on each type of data collected are provided in the relevant sections of this website’s cookie policy.
Automatically collected data is processed exclusively for the purposes for which it is collected, as described below.
The Data Controller processes the data provided by data subjects to enable the website to function, optimize and distribute traffic, as well as for the additional purposes described in this document and in the cookie policy.
3. Whether the provision of data is mandatory or optional, and the consequences of a refusal to provide such data
Theprovision of data for the purposes referred to in points (a) and (b) is optional but necessary for the performance of the contract.
The provision of data for the purposes described in points c and d is optional, and your data may be used only with your consent; if you do not give your consent, your data will not be processed for the purposes described in those points.
Unless otherwise specified, all data required to browse the site is mandatory. If the User/Data Subject refuses to provide this data, it may be impossible for this Application to provide the Service. In cases where this Application indicates that certain data is optional, Users are free to choose not to provide such data, without this having any impact on the availability of the Service or its functionality. Users who have questions about which data is required are encouraged to contact the Data Controller.
4. Processing methods
The Data Controller implements appropriate security measures to prevent unauthorized access, disclosure, alteration, or destruction of Personal Data.
The processing is carried out using computer and/or telecommunications tools, in accordance with organizational procedures and logic strictly related to the purposes indicated.
If you provide your consent to the processing of your personal data for profiling purposes, the processing will be carried out using data processing tools that, through cross-referencing, will create a commercial and behavioral profile of you. The processing carried out in this manner is expected to result, by way of example, in the sending of highly targeted commercial communications, the offering of discounts, the sending of invitations to events deemed to be of interest, etc.
In any case, the User/Data Subject has the right to request human intervention in the decision-making process by the Data Controller, to express their opinion, to obtain an explanation of the decision reached, and to challenge the decision itself.
5. Recipients
In addition to the personnel responsible for processing your data, your datamay also be disclosed to the following parties, who may also be appointed, if necessary, as Data Processors by the Data Controller:
1. Partners, consultants, and companies that assist the Company with IT and infrastructure;
2. Partners, other companies, professionals, and agents who collaborate with the Company to provide services;
3. The Company’s business partners;
4. Company employees and staff responsible for communications, reservations, and guest services;
5. Employees and staff responsible for accounting and administrative services.
An updated list of data processors may be requested from the data controller at any time.
The data will not be disclosed in any other manner.
6. Location of processing
TheData is processed at the Data Controller’s operational offices and at any other location where the parties involved in the processing are located. For further information, please contact the Data Controller.
Data provided directly by the User/Data Subject and collected automatically may be transferred to a country other than the one in which the User/Data Subject is located, including outside the European Economic Area. In such cases, ASSO SpA ensures that the processing of your Personal Data by the recipients to whom the data is transferred is carried out in compliance with European Regulation 679/2016, always in accordance with the principles set forth in Article 45 of the GDPR 2016/679 regarding the existence of an adequacy decision by the European Commission, or, in the absence of such decisions, in compliance with Article 46 regarding transfers subject to appropriate safeguards, or in compliance with Article 49(1)(b)—transfers necessary for the performance of a contract concluded between you and the Data Controller or for the implementation of pre-contractual measures.
7. Retention period
Data Provided Directly by the User/Data Subject
Personal Dataprovided directly by the data subject and collected for the purpose of responding to specific requests and/or for the conduct of pre-contractual or contractual negotiations will be processed and retained for the period of time necessary to fulfill the purposes indicated above and, in any case, no longer than 2 years from the date of collection. Personal Data collected for purposes related to the Data Controller’s legitimate interest will be retained until such interest is satisfied. In the event of pending legal proceedings, the data will be further processed until the proceedings are resolved. Furthermore, the Data Controller may be required to retain Personal Data for a longer period in compliance with a legal obligation or by order of an authority.
Personal Data collected for the purposes of direct and indirect marketing and market research, as well as for sending newsletters, communications, and advertising and informational materials, will be processed and retained for the period of time necessary to achieve the aforementioned purposes and, in any case, for no longer than 2 years from the date of collection.
Personal Data collected for the purposes of targeted marketing will be processed and retained for the period necessary to achieve the purposes indicated above, and in any case no longer than one year from the date of collection.
The data collected automatically will be retained for the period specified in the cookie policy.
At the end of the retention period, the Personal Data will be deleted. Therefore, once this period expires, the right of access, erasure, rectification, and data portability can no longer be exercised.
Data collected automatically through the website
Thedata collected automatically will be retained for the period specified in the cookie policy.
At the end of the retention period, the Personal Data will be deleted. Therefore, once this period expires, the right of access, erasure, rectification, and data portability can no longer be exercised.
8. Rights of the User/Data Subject
Pursuant to Articles 15 through 22 of the GDPR, every User/Data Subject has the right to obtain confirmation as to whether or not their Personal Data exists, even if not yet recorded, and to receive such data in an intelligible form.
In particular, the data subject has the right to obtain from the Data Controller information regarding:
1. the origin of the Personal Data;
2. the purposes and methods of processing;
3. the logic applied in the case of processing carried out with the aid of electronic/IT tools;
4. the identification details of the Data Controller, Data Processors, and designated representative;
5. the subjects and categories of subjects to whom the data may be disclosed or who may become aware of it in their capacity as designated representative within the territory of the State, Data Processors, or persons in charge of processing.
In addition, the data subject has the right to obtain from the Data Controller:
1. the updating, rectification, or supplementation of their data;
2. the erasure, anonymization, or blocking of data processed in violation of the law;
3. access to their data, namely confirmation as to whether or not Personal Data concerning them is being processed;
4. restriction of processing, data portability, that is, the right to receive the Personal Data concerning you in a structured format;
5. the right to lodge a complaint with the Supervisory Authority.
Finally, the data subject has the right to object, in whole or in part, on legitimate grounds, to the processing of Personal Data concerning him or her, even if such data is relevant to the purpose for which it was collected. In particular, the data subject has the right to object to the processing of Personal Data concerning him or her for the purpose of sending commercial advertising material or for commercial communication purposes. The rights referred to in the preceding points may be exercised by writing to us at the contact information provided in point 1 of this privacy policy.
Please note that you have the right to access your personal data at any time by submitting your request to our designated data controller, who will respond to your inquiry, by sending a registered letter with return receipt or a certified email (PEC) to the addresses listed below:
1. Data Protection Officer – ASSO SpA – Via di Gello 167/6B 56038 Ponsacco
2. Certified Email (PEC) Address: asso.spa@pec.it
9. List of linked websites and applications:
Belowis a list of websites and applications linked to www.umamivap.com that can be accessed directly from the site’s pages, along with a link to each site’s privacy policy.
Facebook
PURPOSE: We partner with Facebook to promote landing pages, products, services, and multimedia content, as well as to gather information about how you use and interact with our website through behavioral metrics in order to improve and market our products and services. Website usage data is collected using first-party and third-party cookies and other tracking technologies to determine the popularity of products/services and online activities. Additionally, we use this information for website optimization, fraud prevention, security, and advertising purposes.
PRIVACY URL: https://www.facebook.com/about/privacy/previous# :~:text=Information%20associated%20with%20yo
Google
PURPOSE: We partner with Google to promote landing pages, products, services, and multimedia content, as well as to gather information about how you use and interact with our website through behavioral metrics in order to improve and market our products and services. Website usage data is collected using first-party and third-party cookies and other tracking technologies to determine the popularity of products/services and online activities. Additionally, we use this information for website optimization, fraud prevention, security, and advertising purposes.
PRIVACY URL: https://policies.google.com/privacy
Instagram
PURPOSE: We partner with Instagram to promote landing pages, products, and services, as well as multimedia content, and to gather information about how you use and interact with our website through behavioral metrics in order to improve and market our products and services. Website usage data is collected using first-party and third-party cookies and other tracking technologies to determine the popularity of products/services and online activities. Additionally, we use this information for website optimization, fraud prevention, security, and advertising purposes.
PRIVACY URL: https://help.instagram.com/519522125107875/?maybe_redirect_pol=0
TikTok
PURPOSE: We partner with TikTok to promote landing pages, products, and services, as well as multimedia content, and to gather information about how you use and interact with our website through behavioral metrics in order to improve and market our products and services. Website usage data is collected using first-party and third-party cookies and other tracking technologies to determine the popularity of products/services and online activities. Additionally, we use this information for website optimization, fraud prevention, security, and advertising purposes.
PRIVACY URL: https://www.tiktok.com/legal/privacy-policy-eea?lang=it
WhatsApp
PURPOSE: We work with WhatsApp to provide access to group chats, direct messages, instant messaging, and the sending of multimedia content
PRIVACY URL: https://faq.whatsapp.com/general/security-and-privacy/
Microsoft
PURPOSE: We partner with Microsoft Clarity and Microsoft Advertising to track how you use and interact with our website through behavioral metrics, heat maps, and session replays to improve and market our products and services. Website usage data is collected using first-party and third-party cookies and other tracking technologies to determine the popularity of products/services and online activities. In addition, we use this information for website optimization, fraud prevention, security, and advertising purposes.
PRIVACY URL: https://privacy.microsoft.com/privacystatement
LinkedIn
PURPOSE: We partner with LinkedIn to promote landing pages, products, services, and multimedia content, as well as to understand how you use and interact with our website through behavioral metrics in order to improve and market our products and services. Website usage data is collected using first-party and third-party cookies and other tracking technologies to determine the popularity of products/services and online activities. Additionally, we use this information for website optimization, fraud prevention, security, and advertising purposes.
PRIVACY URL: https://it.linkedin.com/legal/privacy-policy
Last Updated: 07/01/26