This page contains a description of the policies for managing the website in regard to processing the personal data of the users who visit the site and their privacy. This information is provided pursuant to article 13 of GDPR 679/2016 – Laws concerning the Protection of Personal Data and the individuals who interact with the web services of Raro Discovery Srl Società Benefit, which is accessible by telematics means through the following web addresses:

• https://rarodiscovery.com/
• https://golfcharme.com/
• https://travelandsavour.com/
• https://cambuse.it/
• https://theruralcollection.com/
• https://rarotravelatelier.com

which corresponds to the home page of Raro Discovery Srl Società Benefit websites with operational headquarters in Via Friuli, 7 – 20135 Milan.

The information provided does not concern other online websites, pages or services that can be accessed via hyperlinks on the above websites but relate to resources outside Raro Discovery Srl Società Benefit domains.

DATA CONTROLLER

Following access to this website, data pertaining to persons that are identified or identifiable may be processed. The “Data Controller” of the personal data collected following a visit to our website or any other data used for providing our services is Raro Discovery Srl Società Benefit, with registred offices in Viale Dalmazia, 25 – 26900 Lodi (LO).

PLACE WHERE DATA IS PROCESSED

Data processing related to the web services of this website and of the websites managed by Raro Discovery, including without limitation rarodiscovery.com, rarotravelatelier.com, golfcharme.com, travelandsavour.com, cambuse.it and rarotravelatelier.com, is carried out using infrastructure and hosting services provided by Aruba S.p.A., Via San Clemente n. 53, 24036 Ponte San Pietro (BG), Italy (https://www.aruba.it). Such data are processed only by personnel in charge of processing on instructions from the Controller, or by persons entrusted to carry out occasional maintenance and technical support operations.

The personal data obtained from the users who submit requests or through informative material (informative notes, newsletters, registration, etc) is used only to carry out the services or assistance requested and is not transmitted to third parties, except in the following possible cases:

• Business partners of Raro Discovery Srl Società Benefit to whom it communicates the data exclusively for the generation and management of digital cards to use specific online services, including Takyon S.r.l. Via Crema n. 15, 20135 Milan (MI);
• Persons, companies or professional offices who lend assistance and consulting services to Raro Discovery Srl Società Benefit concerning accounting, administrative, legal, financial and tax matters;
• Subjects who are authorized to have access to the data by law or through requests by the authorities;

CATEGORIES OF PROCESSED DATA – LEGAL BASIS – NATURE OF DATA PROVISION

NAVIGATIONAL DATA

The information systems and software procedures relied upon to operate this web site acquire personal data as part of their standard functioning; the transmission of such data is an inherent feature of Internet communication protocols. Such information is not collected in order to relate it to identified data subjects, however it might allow user identification per se after being processed and matched with data held by third parties.

This data category includes IP addresses and/or the domain names of the computers used by any user connecting with this web site, the URI/URL (Uniform Resource Identifier /Locator)  addresses of the requested resources, the time of such requests, the method used for submitting a given request to the server, returned file size, a numerical code relating to server response status (successfully performed, error, etc.), and other parameters related to the user’s operating system and computer environment. The data necessary for the use of web services are also processed in order to:

• obtain statistical information on the use of services (most visited pages, number of visitors by time or day, geographical areas of origin, etc.);
• check the correct functioning of the services offered.

The data will be used to ascertain responsibility in the event of hypothetical IT crimes against the site.

Legal Basis: The processing is necessary for the pursuit of the legitimate interest of the data controller or third parties, provided that the interests or fundamental rights and freedoms of the data subject who require the protection of personal data do not prevail, taking into account the reasonable expectations of the interested party and the activities strictly necessary for the functioning of the site and navigation itself. (Art. 6, par. 1, lett. f) and Recital 47 of the GDPR).

Nature of Data Provision: The provision of data is necessary for browsing the website.

DATA CARRIED OUT THROUGH SOCIAL MEDIA PLATFORMS

Regarding the processing of personal data carried out by the managers of the Social Media platforms used by the Data Controller, please refer to the information notice provided by them through their respective privacy policies. The Data Controller processes the personal data provided by users through the pages of the dedicated Social Media platforms, to manage interactions with users (comments, public posts, etc.) and in compliance with current legislation.

DATA VOLUNTARILY PROVIDED BY THE USER

Sending messages, on the basis of the user’s free, voluntary, explicit choice, to this website contact addresses, or sending private messages to the data controller social media pages and profiles (where this option is available), and filling in and sending the forms made available on the data controller websites entail the acquisition of the sender’s contact information – which is necessary to provide a reply – as well as of any and all the personal data communicated in that manner.

Data will be retained only for registration request to send the newsletters or special offers and will not be disclosed to anyone.

The personal information regarding the individual who visited the website is not collected or used.

I visitatori del sito possono registrarsi al nostro servizio di newsletter. Con la registrazione, l’indirizzo e-mail dell’utente verrà automaticamente inserito in una lista di contatti a cui potranno essere trasmessi messaggi e-mail contenenti aggiornamenti periodici con informazioni, anche di natura commerciale e promozionale, relativi a iniziative, eventi o promozioni del titolare del trattamento.

Per iscriversi alla Newsletter si possono utilizzare i form di iscrizione presenti sul sito inserendo il proprio nome e indirizzo e-mail. I dati inseriti saranno utilizzati al solo fine di inviare la nostra newsletter via e-mail e non saranno comunicati a terzi. Le newsletter saranno inviate attraverso la piattaforma Brevo di proprietà de “Brevo SAS” con server in Unione Europea (Francia) che agisce in qualità di responsabile del trattamento

1. Newsletter

Site visitors can register for our newsletter service. By registering, the user’s e-mail address will automatically be included in a list of contacts to which e-mail messages will be sent. The newsletter will be containing periodic updates with commercial and promotional information relating to initiatives, events or promotions of the data controller.

To subscribe to the newsletter, you can use the registration forms on the site by entering your name and e-mail address. The information supplied with the registration form will be only used to sending our newsletter via e-mail and will not be disclosed to third parties. The newsletters will be sent through the Brevo platform owned by “Brevo SAS” based in European Union (France), acting as data processors.

Legal Basis: the processing is based on the consent to the processing of personal data (Recitals 42 and 43 and art. 6, §. 1, lett. a) of the GDPR).

Nature of Data Provision: The data provision is necessary. Failure to provide the necessary data will make it impossible to be contacted and receive information.

1. NFT Claiming and Blockchain Interaction

If the user chooses to use the “Claim Your NFT” feature available on the Raro Travel Atelier website (www.rarotravelatelier.com), certain personal data necessary for the provision of the service, including identification details and email address, will be shared with: Takyon S.r.l. Via Crema n. 15, 20135 Milan (MI), Italy Tax Code / VAT No. 12424180961.

Takyon S.r.l. processes such data as a Data Processor, appointed by Raro Discovery Srl Società Benefit pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR), solely for the activities required to generate, manage and distribute the digital assets associated with the “Claim Your NFT” service. Personal data will be processed by Takyon exclusively on the basis of Raro Discovery Srl Società Benefit’s instructions and only for purposes strictly related to the provision of the service requested by the user.

As part of the service, the data provided by the user (such as name, email, and telephone number) will be stored on the Data Controller’s IT systems (off-chain archiving) for the purposes of the service and for the periods required by law, and will not be recorded in clear or pseudonymized form on the blockchain in any way. This personal data will be used solely to enable the creation and assignment of a unique digital card (NFT) on the Polygon blockchain. The NFT will contain exclusively technical information and numeric identifiers with no direct information value (anonymous data).

Where a wallet address is provided by the user, this address will necessarily be recorded on the blockchain as part of the transaction. The wallet address is the only identifier registered on the decentralized network and will not be associated, within the blockchain, with other personal data of the user in clear or pseudonymized form. The user acknowledges that Polygon is a public blockchain network whose infrastructure is distributed globally, including locations outside the European Union. Information recorded on the blockchain may therefore be replicated across multiple network nodes and, due to the nature of blockchain technology, technical transaction records (as the recording of the wallet address and the transaction) may not be modified or deleted once validated.

The unique digital cards generated through the service will be made available to the user for download and digital storage, including through Apple Wallet and Google Wallet, in accordance with the procedures communicated at the time of the request.

Legal Basis: the execution of pre-contractual measures adopted at the request of the data subject. (Recital 44 and Art. 6, §. 1, lett. b of the GDPR).

Nature of Data Provision: The communication of personal data to Data Processor is necessary for the provision of the service requested by the user.

1. Personal Data Processing Collected from Curriculum Vitae

You can use the Raro Discovery contact to send candidates’ CVs both on paper and in an electronic format. Providing spontaneous and voluntary of the Curriculum Vitae data will be considered as implicitly informed consent by the data subjects for personal data processing contained, only following the purposes related to the selection of potential candidates.

The data processed for the purpose of selection of candidates are personal useful to search for the particular profile. In general, the nature of the data is normal, except in some cases where you may indicate any sensitive data necessary to identify the specific requirements of the regulations, such as specifying a particular protected class, the suitability for certain jobs and / or start-ups required, within the limits set by the General Provision of June 5, 2019 which modified the General Authorisation of the Garante (Italian Supervisor Authority) no. 1 of December 15, 2016 on the processing of sensitive data in work relationships;

Legal Basis: the processing is based on the consent to the processing of personal data (Recitals 42 and 43 and art. 6, §. 1, lett. a) of the GDPR) and/or the processing is necessary for the execution of a contract of which the data subject is a party or for the execution of pre-contractual measures adopted at the request of the same. (Recital 44 and Art. 6, §. 1, lett. b of the GDPR).

Nature of Data Provision: The provision of personal data is mandatory, failure to provide the necessary data will make it impossible to apply.

General Rules for providing the CV

Any CV received spontaneously, replying to a job advertisement, will be stored directly by person in charge of the processing in accordance with the safety guidelines of personal data adopted in compliance with the security measures according to Chapter IV Section 2 of GDPR 679/2016. These will be printed only on the occasion of a meeting and a conversation with the data subject.

To send Curriculum Vitae use the following addresses: Human Resources Dpt, Raro Discovery Srl Società Benefit, Via Friuli, 7 – 20135 Milano

Linkedin: RARO DISCOVERY JOBS

1. Administrative, Financial and Accounting Data Management

For organisational, administrative, financial nature and for accounting and customer/user data management, it is possible that the data controller may process the relevant personal data.

Legal Basis: The processing is necessary for the execution of a contract of which the data subject is a party (Recital 44) or for the fulfillment of legal obligations (Recital 45) – art. 6 §. 1 lett. b) and c) of the GDPR.

Nature of Data Provision: The provision of personal data is mandatory, as it is essential to be able to execute legal obligations.

1. Cookies and Tracking Technologies Used

In this website we are applied cookies technologies for different purposes, including computer technology authentication or to monitor sessions, and to store specific technical information regarding the users that access to the web server provider, in compliance with Guidelines on cookies and other tracking tools adopted on the websites (10 June 2021) of the Italian Data Protection Authority and Guidelines of the European Data Protection Board (EDPB) of May 2020. More information on the cookies adopted available in the Cookie Policy of this site web.

Legal Basis: For the non-technical cookies and similar technologies, the processing is based on the consent to the processing of personal data (Recitals 42 and 43 and art. 6, §. 1, lett. a of the GDPR). The consent is given through the banner and the cookie policy of the website.

Nature of Data Provision: See the cookie policy in the website footer.

PERIOD FOR DATA RETENTION – CRITERIA USED

According to the provisions set forth in art. 5 par. 1 lett. e) of the Regulation (EU) 2016/679, collected personal data shall be kept in a form which permits identification of data subjects for a period not exceeding the purposes for which the personal data were collected and subsequently processed.

Data retention periods depend on the purposes of the processing:

• purposes related to technical navigation data for the correct functioning and browsing the website: data are kept for no longer than seven days (except where judicial authorities need such data for establishing the commission of criminal offences);
• purpose of reply to info request/services supply request (up to 12 months for contact requests; 10 years for administrative / accounting / financial documentation relating to the provision of a service);
• data collection for staff recruitment (up to 12 months). In principle, the data collected during the recruitment process will be deleted as soon as it becomes apparent that no job offer will be made or that the offer will not be accepted by the candidate;
• newsletter, marketing or promotional communications in general (up to 24 months -until withdrawal of consent)
• purpose of administrative / accounting / financial management: 10 years as required by law for the conservation of administrative / accounting / financial documentation.
• purpose of cookie management: See the cookie policy in the website footer.

TRASFERS OF PERSONAL DATA TO THIRD COUNTRIES

Personal data is not transferred to non-EU third countries, except for any cases described above where the controller provide appropriate safeguards, in compliance with the provisions of Chapter V of the GDPR 679/2016, in particular it takes place on the basis of an adequacy decision of the EU Commission vs third country or an international organization (Article 45 GDPR), particularly:

• for transfers to England the decision on the adequate protection of personal data by the United Kingdom of 28.6.2021 adopted by the EU Commission;
• for transfers to the USA, the decision on the adequacy of the protection provided by the EU-U.S. Privacy Shield Framework of 10 July 2023.
•  

OPTIONAL DATA PROVISION

Subject to the specifications made with regard to navigation data, users are free to provide the personal data listed in the request forms of travel agency or referred to in contacting the travel agency in order to provide CV or to request delivery of information materials and other communications. Failure to provide such data may entail the failure to be provided with the items requested.

PROCESSING ARRANGEMENTS AND DATA PROTECTION MEASURES

Personal data is also processed with automated means for no longer than is necessary to achieve the purposes for which it has been collected indicated in this information. The Data Controller and the Data Processors ensures the adoption of appropriate technical and organisational measures to ensure a level of security appropriate to the risk and that personal data are processed adequately and in accordance with the purposes for which they are processed, in compliance with the provisions of the art. 32 of the GDPR 2016/679. Specific security measures are implemented

to prevent the data from being lost, used unlawfully and/or inappropriately, and accessed without authorisation. There is no provision for an automated decision-making process for the processing of personal data.

DATA SUBJECTS’ RIGHTS

The data Controller is Raro Discovery Srl Società Benefit, RARO DISCOVERY. You may contact controller at any time to exercise your rights as provided for in Chapter III GDPR 679/2016, in particular, the right to request access to and rectification or erasure of personal data or restriction of processing concerning you or to object to processing, the right to obtain a copy of the personal data being processed as well as the right to data portability.

RIGHT TO LODGE A COMPLAINT

If a data subject considers that the processing of personal data relating to him or her as performed via this website infringes the Regulation, he or she has the right to lodge a complaint with the Data Protection Authority pursuant to Article 77 of the Regulation, or to an effective judicial remedy pursuant to Article 79 of the Regulation.