GDPR and data processing

1. Who is responsible for what

The Supplier of the Service is TU Italia S.r.l., with registered office at Via Sommacampagna 9, 00185 Rome, Italy, VAT number IT09802381005, REA RM-1190289, email info@touroperate.com, telephone 0039 393 4578504.

For the personal data an Operator enters into the Service (its guides and suppliers, its staff, the participants of its departures), the Operator is the controller and TU Italia S.r.l. is the processor (art. 18.1 and art. A.1.1 of the Terms). For the data it needs to run its own relationship with the Operator (account, access, support, invoicing, the security of the Service) and for the visitors of the website, TU Italia S.r.l. is the controller, as described in the Privacy Notice.

2. The Data Processing Agreement

Annex A to the Terms is the Data Processing Agreement required by art. 28 GDPR. It forms an integral part of the Terms, so it applies to every subscription as part of the Terms the Operator accepts, and it governs the processing of the personal data contained in Customer Data.

It sets out the subject matter and duration of the processing, its nature and purpose, the categories of data subjects and of data, and the obligations and rights of both parties (arts. A.1 to A.7).

3. What the Service processes for an Operator

The processing covers the data needed to provide the Service, for the term of the contract and the periods set out in art. A.6: collection, recording, storage, consultation, retrieval, disclosure to the Operator and erasure, carried out by electronic means for the sole purpose of providing the Service’s management features (art. A.1.2).

Data subjects are the Operator’s end customers and participants, its contacts and staff, and its guides and suppliers; the data are identification and contact details, booking data and the operational notes the Operator enters. The Service is not intended for the systematic processing of special categories of data under art. 9 GDPR, and it does not collect or store end customers’ payment data (art. A.1.3).

4. TourOperate’s commitments as processor

Under art. A.2 of the Terms, TU Italia S.r.l. undertakes to:

• process the data only on the Operator’s documented instructions, save for legal obligations;
• ensure that the people authorised to process the data are bound by confidentiality;
• adopt the security measures required by art. 32 GDPR;
• respect the conditions for engaging sub-processors;
• assist the Operator with data subject requests and with its obligations under arts. 32 to 36 GDPR;
• inform the Operator without delay if an instruction infringes data protection law;
• make available the information needed to demonstrate compliance with art. 28 GDPR, and allow audits.

5. Security

The measures include role-based access control and the principle of least privilege, encryption of data in transit (TLS) and at rest, periodic backups and restore procedures, separation of environments and security updates, instructions and training for authorised staff, and an internal breach management procedure. They may be updated provided the overall level of protection is not reduced (art. A.3).

Access by TourOperate’s own support, administration and security staff is named, authenticated, limited to what is strictly necessary, recorded in dedicated logs and reviewed periodically (art. B.3).

6. Sub-processors

The Operator gives a general authorisation for the sub-processors needed to provide the Service. TU Italia S.r.l. imposes on each of them data protection obligations equivalent to those of Annex A and remains liable to the Operator for their performance (arts. A.4.1 and A.4.2). The sub-processors currently engaged for the Service are:

Mailbox, accounting, tax and legal suppliers act within the limits of their engagements; their identity can be requested at info@touroperate.com. Intended changes to the list are notified to the Operator at least 15 days in advance; the Operator may object on legitimate grounds and, failing an alternative, withdraw without penalty (art. A.4.1).

7. Transfers outside the European Economic Area

The primary database of the Service is hosted in the European Union, in the Frankfurt region. Some sub-processors are established outside the European Economic Area, in particular in the United States, and backup, support and ancillary services may involve processing outside the EEA.

Under art. A.5.2 of the Terms, TU Italia S.r.l. undertakes that each such transfer is covered by a transfer mechanism under Chapter V GDPR (an adequacy decision where one applies, or standard contractual clauses with the supplementary measures needed in the specific case), to keep the safeguards for each sub-processor documented, and to provide the Operator with their details and a copy on request at info@touroperate.com.

8. Personal data breaches

TU Italia S.r.l. notifies the Operator of any personal data breach without undue delay after becoming aware of it, with the information available that the Operator needs to meet its own obligations under arts. 33 and 34 GDPR (art. A.5.1).

9. Requests from data subjects

When a person asks to exercise their rights over data an Operator entered into the Service, the controller is that Operator. TourOperate forwards the request to the Operator without delay and assists it in responding (art. A.2(e) of the Terms and section 10 of the Privacy Notice).

For the data TU Italia S.r.l. processes as controller, requests are answered without undue delay and in any event within one month, extendable by two months in particularly complex cases (art. 12(3) GDPR).

10. Audits and verification

The Operator may carry out audits and inspections, itself or through an auditor it mandates, on reasonable notice; ordinarily once a year, without prejudice to any further audit required by law or by a supervisory authority, or following a personal data breach (art. A.2(g)).

On reasonable request the Operator can also obtain the access logs relating to its own tenant, the up-to-date list of sub-processors, and the contact point for security and data protection matters (art. B.6.1).

11. At the end of the contract

At the Operator’s choice, its data is returned in a standard machine-readable format and/or deleted together with the existing copies, subject to statutory retention obligations. The Operator can request the export for 30 days after termination; absent a different request, the data is then deleted, save for backups, which are kept isolated and overwritten according to ordinary cycles (arts. 10.4 and A.6).

One limit must be stated plainly: an email that has already been delivered cannot be recalled or erased. Erasure reaches the copies TourOperate holds; retention at the mail provider follows that provider’s policies, and the copy in the recipient’s mailbox is permanently outside TourOperate’s control.

12. Separation from EnRoma.com

TU Italia S.r.l. also runs the tour business EnRoma.com. Annex B of the Terms keeps it apart from Operators’ data: EnRoma.com uses the Service as an ordinary tenant with no privileged access, its tour staff are not authorised to access other Operators’ data, and Operators’ data, including in aggregated or derived form, is never used for EnRoma.com’s pricing, marketing, sales or positioning. A breach gives the Operator the right to terminate immediately, a free export of its data and compensation for the loss it proves, outside the liability caps of the Terms (arts. B.1 to B.5). The commitments are also summarised on the Trust page.

13. Contact and supervisory authority

Questions about data protection, security, the Data Processing Agreement and the sub-processors are handled at info@touroperate.com.

Data subjects also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of their country of residence.