Explore Sicily with Us

1. Data Controller and Data Processors

The data controller is Kemedia s.r.l., based in Catania, via VIII Strada n.7 – industrial zone, represented by its legal representative SCALIA Massimo. For the purposes of this privacy notice, the Data Controller or the Data Protection Officer (DPO) can be contacted at the following addresses: privacy@kemedia.it or by registered letter to: Kemedia s.r.l., via VIII Strada n.7 – industrial zone (95100) Catania.

2. Personal Data Processed

Kemedia processes your personal data and the data of participants in the service/trip that you may provide, as well as personal data of any minors participating in the purchased service provided by the person exercising parental responsibility, and therefore the collected data, such as:

• • Direct and indirect personal identification data
• • Special categories of data pursuant to Art. 9 and 10 of EU Reg. 2016/679 (e.g. personal details, name and surname, addresses, tax code/VAT number, email, phone)
• • Data necessary for the execution of services and tax/legal obligations

In addition, Kemedia processes – on a non-exclusive basis – the data necessary for the execution of, or to follow up, even solely for informational purposes and/or to formulate estimates, services, contracts or any other legal relationship in force or being executed or being terminated, as well as any data relating to the payment of fees, invoices and necessary for tax and legal compliance purposes.

In the event that you proceed with the booking or purchase of a tourist service also on behalf of other persons, we will also process the data of other participants provided by you. We recommend that you do so only with the prior consent of the persons concerned, including with regard to data processing. Upon subscription, Kemedia will send an email to the address you have provided also to those individuals, to ensure that they are aware of and have understood and accepted the data processing as described in this notice.

Where at the time of registration/information request/booking, through the forms provided on the website www.etnatribe.it, the relevant consent has been given, we also process data relating to travel preferences, interests or other data useful for the purposes referred to in points 3.c) and 3.d).

2.1 Data Processing for Requests and Bookings

In the case of information requests, questions, contact requests, catalogue or service requests, estimates or bookings, Kemedia processes your data, and therefore the collected data, for the fulfilment of the request made. Furthermore, your data will be retained by Kemedia to allow, if necessary, subsequent communications or the sending of new documentation related to the request, or to be entered in the requests/estimates/bookings register. Some of the requested data may be processed for the purpose of verifying the identity of the applicant and understanding the purpose of the request.

3. Purpose of Processing

a) Purposes related to requests

The processing of personal data for this service is aimed at managing the user's request, subsequent contact with the user and sending the relevant response, the pre-contractual and contractual phase based on the consent expressed by the user and through acceptance of the conditions expressed herein.

As for the possible subsequent contractual phase, we inform you that the contractual purposes concern – and are necessary for – the pursuit of the contractual and business relationship, therefore:

• • in execution of its management;
• • for the conclusion, management and execution of contractual relationships, to respond to customer requests, for the communication of notices regarding the purchased tour package or tourist services or other additional and ancillary services (e.g. information relating to purchased tourist services;
• • modification of contractual conditions; cancellations, etc.);
• • for the organisation of a tour package;
• • to facilitate the purchase of related tourist services;
• • for the intermediation in the purchase of a tour package organised by third parties or individual tourist services provided by third-party suppliers (e.g. hoteliers, carriers, etc.);
• • for the management of travel organisation, emergency management, hotel/room accommodation management and the relationship with other travel participants;
• • for the intermediation in the purchase of financial/insurance services ancillary to and connected with tour packages/tourist services facilitated or purchased individually (e.g. medical/health policies or luggage insurance, cancellation, assistance to travellers in difficulty, consumer credit financing);
• • to fulfil the task relating to the issuance of visas;
• • for registration on the website and/or app or for filling in forms on the website or app; communications with the customer.

b) Legal purposes:

1. to comply with obligations under laws, regulations, national, EU and international legislation or arising from provisions issued by legally authorised Authorities (including – where applicable – from foreign countries);
2. to pursue, ascertain and/or defend, where applicable, a right or legitimate interest of Kemedia in the management of any disputes including legal proceedings;
3. to comply with obligations in the tax and accounting field;
4. to comply with obligations related to traveller health and safety regulations;
5. to comply with obligations related to passenger and freight transport regulations;
6. accounting administration, invoice issuance and management, contract management, payment and collection management.

We also remind you that at the time of registration/information request/booking, through the forms provided on the website www.etnatribe.it, you were asked to express your consent regarding the processing for the additional purposes indicated below and your decision has been recorded by us. Therefore, processing for the purposes referred to in points 5.c) and 5.d) will only take place where you have given your express consent at that time. We further remind you that you have the right to request information regarding the consent given or to revoke any consent given by exercising the rights referred to in point 8) and 8.1) of this privacy notice.

c) Business and statistical purposes (with consent):

• • Statistical processing and market research
• • Communication and commercial promotion activities

d) Marketing and profiling purposes (with consent):

• promotional activities of Kemedia and/or commercial partners, carried out both by automated means (e.g. email, SMS, instant messaging applications, etc.) and by non-automated means (e.g. ordinary mail, telephone with operator, etc.);
• in particular, Kemedia may use your email address, provided at the time of purchase of tour packages or tourist services, to send informational and promotional communications related to similar services and products offered by Kemedia and/or commercial partners to whom the data may be transmitted;
• the commercial partners to whom data may be transmitted belong to the following categories: accommodation facilities / airlines and shipping companies / railway carriers / road carriers / travel agencies and travel agency networks / insurance companies;
• profiling activities, i.e. analysis, including by means of (including automatic) profiling systems, of customer preferences and, in particular, preferences relating to travel, tourist destinations, regions, cities, etc., in order to improve the service offering and commercial information presented, making them more consistent with the customer's interests; this activity may also take place through the administration of satisfaction questionnaires;
• the processing also concerning special or judicial personal data, as defined pursuant to Art. 9 and 10 EU Reg., may be carried out within the limits and for the purposes set out above. Therefore, special data will only be subject to processing required by law or contract or in any case as provided for in this privacy notice. Your data will in no case be used for purposes other than those indicated above and with particular respect for the principles of lawfulness and fairness in order to protect confidentiality.

4. Processing Methods

Processing is carried out in full compliance with the Law and the adequate technical and organisational security measures of the Company in accordance with EU Reg. 2016/679, in order to minimise the risks of unauthorised disclosure and access, accidental or unlawful access to transmitted personal data, destruction, modification, loss, unavailability.

Processing is carried out using computer, electronic and manual/paper tools, in order to guarantee, first and foremost, data confidentiality.

Personal data (photographs and audio-video recordings) may be processed for communication and promotion activities relating to services offered by Kemedia on its social media channels (Facebook, Twitter, Instagram, YouTube, etc.).

The posing and use of images are considered free-of-charge services. Kemedia undertakes not to use the images in any way that may be detrimental to the dignity, reputation or decorum of the data subject.

The posing and use of images are considered free-of-charge services.

Kemedia undertakes not to use the images in any way that may be detrimental to the dignity, reputation or decorum of the data subject.

Your data will be processed by Kemedia's internal staff and therefore by persons specifically appointed as authorised persons or data processors, as provided for by EU Reg. 679/2016. We inform you that the staff authorised to process the collected data has been adequately instructed and trained on the purposes and methods to be followed in carrying out their duties. We inform you that, where possible, your data will also be processed in anonymous, aggregated or pseudonymised form in compliance with the principles of minimisation and pseudonymisation provided for by EU Regulation 679/2016.

5. Disclosure and Communication of Data

Data may be communicated, to the extent necessary, to:

• suppliers of the company and, in particular, suppliers of tourist services included in the packages sold, or providing related or individually purchased services;
• insurance companies providing ancillary coverage connected with purchased tour packages and tourist services;
• persons, companies, associations or professional firms providing services or assistance and consultancy activities in favour of the Company in order to protect its rights (e.g. accountants, lawyers, tax consultants, auditors, consultants in auditing or due diligence operations, etc.);
• persons, companies, or agencies providing marketing and analysis services or consultancy activities in favour of the Company;
• persons whose right to access personal data is recognised by law and/or secondary legislation or by provisions issued by legally authorised Authorities, including airport, port, customs and border authorities;
• external IT consultants and technicians; document archiving companies;
• third-party technical service providers, postal couriers, electronic and IT services, hosting providers, management software; in some situations, some data may be temporarily transferred, for the duration of the service only, to servers (cloud) external to Kemedia;

Furthermore, for the purpose of fulfilling the contract or services provided and in any case for booking needs, we inform you that your personal data and the data of persons provided by you, as well as personal data of any minors participating in the purchased service, may also be communicated to other trip participants (e.g. in the case of cumulative or group booking receipts to be provided to all participants); furthermore, we inform you that in the communications referred to in point 5.2), your first name and that of persons on whose behalf you have booked or purchased a service may in any case be communicated, together with your departure airport and details of any room companions, to other trip participants or service users.

5.1 Data Disclosure Outside the EU

We inform you that your data may be communicated and processed by companies, professionals, natural persons or service providers in general, which may be based in non-EU countries where data protection laws may not be equivalent to those applied in the EU. Therefore, we inform you that: your data subject to extra-EU transfer, primarily and wherever possible, is subject to pseudonymisation; processing will take place provided that certain conditions laid down by the applicable legislation are met and in any case within the limits provided, specified and indicated in this notice and with particular reference to the purposes; in some specific cases of data communication outside the EU, Kemedia requires guarantees of an adequate level of personal data protection, as well as requiring that adequate technical and organisational security measures are in place to protect personal data against accidental or unlawful destruction, accidental loss or alteration, unauthorised disclosure or access, and against all other unlawful forms of processing. Therefore, particularly in order to provide the requested service and only in the cases and within the limits specified, the data may be transmitted and processed, in any case in compliance with EU Reg. 2016/679, also outside Italy or the European Union. The data subject has the right to exercise their rights regarding personal data protection before the Italian national authorities and specifically before the Italian Data Protection Authority. For further information on current security measures, please contact the Data Controller.

5.2 Communication of Data to Service Participants for Organisational Purposes

In addition to what is indicated regarding the communication of your data to service participants for contractual purposes and service execution (see point 5, last paragraph), we inform you that close to the service execution date, for organisational purposes or for the management of hotel/room accommodations and emergency management, your personal data – specifically name, surname, telephone number and email address – may be communicated to all other participants by email. Furthermore, such data may be communicated, for the same purposes, by email to a limited number of travellers in the event that further information is requested (for example, specifically, regarding hotel/room accommodation and sharing with individual participants).

6. Nature of Data Provision

When contacting us or making a request, the provision of personal data is mandatory as refusal to consent to processing, within the limits of this privacy notice, may make it impossible to fulfil the request or send documentation, information, estimates, informational material or catalogues. Consent to the processing of personal data as indicated in points 3.c) and 3.d) as well as consent to the processing referred to in point 5.2) is optional. As for the possible subsequent contractual phase, we inform you that the provision and consent to the processing of personal data is mandatory as refusal, within the limits indicated in the preceding points, or refusal to provide them in whole or in part, may result in the impossibility for Kemedia to execute the contract or business agreement or to comply with a legal obligation to which the Data Controller is subject or for the pursuit of the legitimate interest of the data controller or of third parties. Furthermore, we inform you that, given the nature of the service, failure to consent to processing as provided for and described in point 5.1) [Disclosure or communication of personal data outside the EU] will make it impossible to enter into a contractual relationship relating to travel/services outside the EU.

7. Duration and Data Retention

In compliance with the principles of proportionality and minimisation of processing, the duration of processing is equal to the duration of the contractual or business relationship or in any case equal to the time used to manage the information/estimate request submitted. We also inform you that the retention of your data may be extended even after the end of the relationship of any kind or nature with Kemedia; data will be retained for the time necessary to comply with legal obligations, particularly in terms of social security contributions, tax and fiscal matters and in any case for the legal compliance purposes provided for the specific type of legal or business relationship and will in any case be retained, commensurating the degree of indispensability, for the time strictly necessary to achieve the purpose of the activity. Data processed (with express consent through the forms provided on the website www.etnatribe.it) for the purposes referred to in points 3.c) and 3.d) will be retained, commensurating the degree of indispensability, for the time strictly necessary to achieve the purpose of the activities referred to in the above points. In any case, user data is not retained by Kemedia for a period exceeding 60 months.

8. Rights of the Data Subject

At any time, as a data subject, you may exercise your rights towards the data controller, subject to identity verification, as provided for under EU Regulation 679/2016. Pursuant to Art. 12 et seq. of EU Reg. 679/2016, data subjects have the right to contact the Data Controller and/or Data Processor to access personal data concerning them. In particular, pursuant to Art. 15 of EU Regulation 2016/679, the data subject, where identifiable, has the right to obtain confirmation as to whether or not personal data concerning them exists, their communication in intelligible form and therefore access to their personal data, as well as to obtain information concerning:

• a. the purposes of the processing;
• b. the categories of personal data concerned;
• c. the recipients or categories of recipients to whom personal data have been or will be disclosed, particularly recipients in third countries or international organisations;
• d. where possible, the envisaged period for which personal data will be stored, or, if not possible, the criteria used to determine that period;
• e. the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
• f. the right to lodge a complaint with a supervisory authority;
• g. where personal data are not collected from the data subject, any available information as to their source;
• h. the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

Information is provided free of charge; pursuant to Art. 12(5) of EU Reg. 2016/679, in the case of manifestly unfounded, excessive and/or repetitive requests, the controller may charge a reasonable fee for the administrative costs of providing the information, for the communication or for taking the requested action, or refuse to act on the request. The data subject may obtain the erasure, rectification, anonymisation or blocking of data processed in violation of the law, or may exercise the right to data portability.

In particular, we remind you that you have the right to request information – or in any case exercise any request referred to in point 8) – regarding the processing of your personal data for the purposes referred to in points 3.c) and 3.d) [business and statistical purposes and marketing, promotional purposes, data transfer to third parties and profiling purposes] and regarding the processing as indicated in point 5.2) [communication of data to trip/service participants for organisational purposes] of this notice and therefore regarding consent given or not given.

In this sense, given what is indicated above in point 8), you have the right to request information regarding consent given or to revoke any consent given by exercising the rights referred to in point 8).

For the purposes of this privacy notice or for the requests/communications referred to above, the Data Controller or the Data Protection Officer (DPO) can be contacted at the email address privacy@kemedia.it or by registered letter to: Kemedia s.r.l., via VIII Strada n.7 – industrial zone (95100) Catania.

9. Complaint

The data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) according to the procedures available at www.garanteprivacy.it