PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

This Privacy Notice is provided pursuant to Regulation (EU) 2016/679 ("GDPR") and the applicable national legislation on the protection of personal data and describes how the personal data of users who browse and use the website http://www.arabba.it are processed.

1. Data Controller
The Data Controller of the personal data collected through the website is:
Arabba Fodom Turismo
Via Mesdì 66/A-B - Arabba
32020 Livinallongo del Col di Lana (BL) – Italy
E-mail: info@arabba.it
For any request concerning the processing of personal data and the exercise of the rights provided for under the GDPR, the data subject may use the contact details indicated above.
Any additional contact details of the Data Controller and, where appointed, of the Data Protection Officer (DPO), are indicated in the relevant contact section.

2. Types of personal data processed
Different categories of personal data may be processed through the website, depending on the services and functions actually used by the user.
By way of example, the following data may be processed:
* identification and contact data, such as first name, last name, e-mail address and telephone number;
* data contained in requests for information submitted through the website;
* data relating to requests, bookings and purchases of tourism services, where applicable;
* data provided for participation in events, initiatives or activities organised or promoted through the portal;
* data provided when subscribing to the newsletter;
* data relating to communications with Arabba Fodom Turismo;
* browsing data and technical data relating to the device used;
* IP address and information relating to the browser and operating system;
* data collected through cookies and similar technologies;
* information voluntarily entered by the user while using the virtual assistant based on Artificial Intelligence KOSMO.

The website does not require users to enter special categories of personal data pursuant to Article 9 of the GDPR.
Users are therefore invited not to provide, through the website forms or through the virtual assistant, data concerning health, religious beliefs, political opinions, biometric data or other information belonging to special categories of personal data, unless this is strictly necessary and permitted by the applicable legislation.

3. Browsing data
The IT systems and software procedures used to operate the website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.
This category may include, by way of example:
* IP addresses;
* device identifiers;
* URI/URL addresses of the requested resources;
* date and time of the request;
* method used to submit the request to the server;
* size of the file obtained in response;
* numerical code relating to the status of the server response;
* information relating to the user's operating system, browser and IT environment.

Such data are processed to enable the proper functioning of the website, ensure the security of the systems, prevent unlawful use and, where provided for by applicable legislation, carry out statistical analyses.
Browsing data may also be used to ascertain possible liability in the event of cybercrime or unlawful use of the website.

4. Purposes of processing
Personal data may be processed for the following purposes:
a. enabling browsing and the proper functioning of the website;
b. responding to requests for information and assistance;
c. providing information relating to the area, accommodation facilities, events, activities and tourism services;
d. managing requests relating to accommodation facilities, stays, bookings and tourism services, where applicable;
e. managing any purchases of products or services made through the portal;
f. managing registrations and participation in events and initiatives;
g. sending newsletters and information communications, in the cases and in accordance with the procedures provided for by applicable legislation;
h. providing assistance through the virtual assistant;
i. ensuring the security of the website and IT infrastructure;
j. preventing abuse, improper use and fraudulent activities;
k. complying with obligations imposed by laws, regulations and European legislation;
l. establishing, exercising or defending a right of the Data Controller in judicial or extrajudicial proceedings;
m. carrying out statistical and technical analyses concerning the functioning of the website, within the limits permitted by applicable legislation.

5. Legal basis for processing
Personal data are processed on the basis of one or more of the following lawful grounds provided for by Article 6 of the GDPR:
* the consent of the data subject, where required by applicable legislation;
* the performance of a contract or the implementation of pre-contractual measures taken at the request of the data subject;
* compliance with a legal obligation to which the Data Controller is subject;
* the pursuit of the legitimate interests of the Data Controller, for example to ensure system security, prevent abuse and protect its rights.
Where processing is based on consent, the data subject may withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

6. Virtual assistant based on Artificial Intelligence
The portal www.arabba.it provides users with a virtual assistant based on Artificial Intelligence technologies, developed and provided by AI KOSMO S.r.l.
The virtual assistant is intended solely to provide tourism information, support the search for information, content and services available on the portal, and assist users with navigation and the management of their requests.
The use of the virtual assistant is optional.
During interaction with the virtual assistant, the following data may be processed:
* content and information voluntarily entered by the user into the conversation;
* data necessary to manage the request;
* technical data necessary for the operation and security of the service.
The system analyses the text of the user's request in order to understand its content and purpose and provide a relevant response or, where necessary, enable the involvement of the appropriate staff.
The Data Controller invites users not to enter unnecessary personal data into the virtual assistant and, in particular, special categories of personal data pursuant to Article 9 of the GDPR.
Purposes of processing
Data processed through Artificial Intelligence may be used to:
* provide the information requested by the user;
* manage requests for assistance;
* improve the quality and effectiveness of the service;
* ensure the security and proper functioning of the platform;
* prevent improper or fraudulent use;
* comply with legal obligations.
Legal basis
The processing of personal data through the virtual assistant is carried out, depending on the specific activity, on the basis of Article 6(1)(b) GDPR, where necessary to provide the service requested by the user, and Article 6(1)(f) GDPR, for the purposes of the legitimate interests pursued by the Data Controller in ensuring the security, proper functioning and improvement of the service.
Where consent is required for specific functions, processing will be carried out on the basis of the validly given consent of the user.
Technology provider
The service is provided using technology developed by AI KOSMO S.r.l.
AI KOSMO S.r.l. acts as the technology provider and, where appointed by the Data Controller, as a Data Processor pursuant to Article 28 GDPR, on the basis of a specific data processing agreement.
The Data Controller contractually regulates the processing operations entrusted to the provider and verifies that the activities carried out on behalf of the Data Controller are performed in compliance with the applicable legislation.
Transparency regarding the use of Artificial Intelligence
Users are informed, at the time of their first interaction, that they are interacting with an Artificial Intelligence system.
The indication of the artificial nature of the system is integrated directly into the virtual assistant's interface.
The service is therefore used in compliance with the transparency obligations provided for by the applicable European legislation concerning Artificial Intelligence.
According to the provider's statements, AI KOSMO S.r.l. does not perform emotion recognition, does not carry out biometric categorisation and does not generate synthetic audio or video content falling within the definition of a deepfake.
Human oversight and automated decisions
The Artificial Intelligence chatbot is an information support tool for staff and does not make decisions based solely on automated processing which produce legal effects concerning the user or similarly significantly affect the user, within the meaning of Article 22 GDPR.
The possibility of human intervention is provided for, including at the user's request or where the response provided by the virtual assistant is insufficient or incomplete.
Accuracy of responses
The responses provided by KOSMO are automatically generated using Artificial Intelligence technologies and are intended solely for informational purposes.
The responses may contain inaccuracies, omissions or information that is not up to date.
For information requiring official confirmation or a specific assessment, users are invited to contact Arabba Fodom Turismo directly through the ordinary contact channels indicated on the portal.
Data retention and transfers
Data processed through the virtual assistant are retained for the period necessary for the purposes for which they were collected and in accordance with the procedures and time limits established by the Data Controller and the agreements with the providers involved.
Where processing involves transfers of personal data to countries outside the European Economic Area, such transfers will be carried out in compliance with Articles 44 et seq. of the GDPR and the safeguards provided for by the applicable legislation.

7. Contact and information requests
The website allows users to submit requests for information and assistance relating to the area, accommodation facilities, events, activities, tourism services and other initiatives promoted through the portal.
The data entered in the relevant forms will be processed in order to respond to the request and provide the requested information or service.
The provision of data marked as mandatory is necessary in order to process the request.

8. Bookings and tourism services
The portal may allow users to request information, check availability, make bookings or purchase tourism services and products.
The necessary personal data will be processed for the management of the request, booking, purchase and any related administrative, tax and accounting obligations.
Some services may be managed through external platforms or providers. In such cases, the processing of personal data may also be governed by the privacy notices of the relevant providers.

9. Newsletter
Users may voluntarily subscribe to the Arabba Fodom Turismo newsletter through the relevant form.
An e-mail address is required for subscription and additional data necessary for managing the service may also be requested.
The data will be used to send newsletter communications and, where applicable, information and promotional communications for which valid consent has been obtained.
Users may withdraw their consent at any time and unsubscribe from the newsletter by using the relevant link contained in the communications received or by contacting the Data Controller.

10. Job offers published by tourism operators
The portal may publish job advertisements and job offers submitted directly by tourism operators who are members of the tourism association.
With regard to such content, Arabba Fodom Turismo acts as a publisher and disseminator of the advertisement and does not directly manage the selection of candidates.
Any personal data contained in the advertisements are published on the basis of the information provided by the operator requesting publication.
Users interested in job offers are invited to use exclusively the contact details and application procedures indicated in the individual advertisement.
Any applications, CVs or further personal data sent directly to the tourism operator will be processed by that operator as an independent Data Controller, in accordance with its own privacy notice.
Arabba Fodom Turismo is not responsible for the subsequent processing of data carried out directly by the tourism operator that published the job offer.

11. Disclosure of data to third parties
Personal data may be disclosed, within the limits of the purposes indicated in this Privacy Notice, to parties that assist the Data Controller in managing the website and the services offered.
Such parties may include, by way of example:
* hosting and IT infrastructure providers;
* technical service and maintenance providers;
* e-mail and newsletter service providers;
* providers of booking systems and tourism service management systems;
* providers of statistical analysis tools;
* cybersecurity service providers;
* providers of Artificial Intelligence technologies;
* consultants and professionals assisting the Data Controller;
* authorities and public bodies in the cases provided for by law.

Parties processing personal data on behalf of the Data Controller are, where necessary, appointed as Data Processors pursuant to Article 28 GDPR.

12. Third-party services and content
The website may integrate services, content, widgets, maps, videos, analytical tools and other components provided by third parties.
The use of such services may involve the processing of personal data and, in some cases, the disclosure of technical information to the relevant provider.
Among the services that may be present on the website, depending on the functions actually active, may include:

* Google services;
* Google Maps and related services;
* statistical analysis tools;
* YouTube;
* Facebook and Instagram;
* Vimeo;
* Hotjar;
* Google Tag Manager;
* Outdooractive;
* booking systems;
* Artificial Intelligence services and technologies;
* other widgets, iframes and embedded content.

The list of services must be kept up to date in relation to the technologies actually installed and used on the website.
Where the activation of third-party services requires the user's consent, such services will be activated in accordance with the applicable legislation and the preferences expressed by the user through the consent management system.

13. Transfer of data to third countries
Some technology service providers may be established in, or use infrastructure located in, countries outside the European Economic Area.
Where processing involves the transfer of personal data to a third country, the Data Controller shall ensure, within the scope of its responsibilities, compliance with Articles 44 et seq. of the GDPR, using, where applicable, an adequacy decision of the European Commission, Standard Contractual Clauses or other safeguards provided for by applicable legislation.

14. Data retention period
Personal data are retained for no longer than is necessary to achieve the purposes for which they were collected.
The retention period varies depending on the type of processing.
In particular:
* data relating to contact requests are retained for the time necessary to manage the request and any subsequent relationship;
* data relating to bookings and purchases are retained for the period necessary to manage the relationship and for any additional periods required under civil, tax and accounting legislation;
* newsletter data are retained until consent is withdrawn or the user unsubscribes from the service, without prejudice to any further retention requirements provided for by law;
* data relating to job offers are processed and published for the period necessary to manage the advertisement, in accordance with the arrangements agreed with the operator requesting publication;
* data processed through the KOSMO virtual assistant are retained in accordance with the time limits established by the Data Controller and the agreements with the providers involved;
* technical data and security logs are retained for the period necessary to ensure the security and proper functioning of the systems, in compliance with the principle of data minimisation.

At the end of the relevant retention periods, the data will be deleted, anonymised or retained further only in the cases provided for by law.

15. Cookies and similar technologies
The website uses cookies and similar technologies to ensure the proper functioning of its pages, improve the browsing experience, carry out statistical analyses and, where applicable and subject to prior consent, provide personalised content or services.
Depending on their function, cookies may be classified as:
* technical or necessary cookies;
* analytical cookies;
* functionality cookies;
* profiling or marketing cookies, where present.
Cookies that are not strictly necessary for the operation of the website are used according to the preferences expressly indicated by the user through the consent management system.
For detailed information on the cookies actually used, the relevant providers, purposes and methods for changing preferences, please refer to the Cookie Policy and the consent management panel available on the website.

16. Links to third-party websites and services
The website may contain links to websites, platforms or services operated by third parties.
The Data Controller is not responsible for the manner in which such parties process users' personal data.
Users are therefore invited to consult the relevant privacy notices before providing personal data to such parties.

17. Data security
The Data Controller adopts appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing, in accordance with Article 32 GDPR.
The measures adopted are intended, among other things, to prevent:
* unauthorised access;
* loss or destruction of data;
* unauthorised disclosure;
* unauthorised alteration;
* unlawful or improper use of data.
The security measures are periodically assessed and updated in relation to technological developments, identified risks and the characteristics of the processing carried out.

18. Minors
The website is not specifically intended for the collection of personal data relating to minors.
The Data Controller invites minor users not to provide personal data through the website without the involvement and, where necessary, the authorisation of the person exercising parental responsibility.
Particular attention should be paid to the use of the virtual assistant: users are invited not to enter unnecessary personal data concerning themselves or third parties into the conversation.

19. Rights of the data subject
In the cases provided for by Articles 15 et seq. of the GDPR, the data subject may exercise the following rights:
* obtain confirmation as to whether or not personal data concerning them are being processed;
* obtain access to their personal data;
* obtain the rectification of inaccurate data or the completion of incomplete data;
* obtain the erasure of data in the cases provided for by law;
* obtain restriction of processing;
* object to processing in the cases provided for by applicable legislation;
* receive their data in a structured, commonly used and machine-readable format, where the conditions for the right to data portability are met;
* withdraw previously given consent where processing is based on consent.
Requests may be sent to the Data Controller using the contact details indicated in this Privacy Notice.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali, which is the competent supervisory authority.

20. Updates to this Privacy Notice
This Privacy Notice may be updated from time to time in order to adapt it to legislative, technological or organisational changes or to developments in the services offered through the website.
Users are invited to consult this page periodically in order to check for any updates.

Last updated: August 2026.