Privacy

We hereby inform you that, for the establishment and execution of contractual, pre-contractual and/or ongoing economic relationships with you, the undersigned may collect certain information classified as “Personal Data” under EU Privacy Regulation 679/2016, as specified below. The aforementioned law stipulates that any entity processing personal data must inform the data subject about which data are being processed and certain key aspects of the processing itself. Such processing must be carried out lawfully, fairly and transparently, safeguarding your privacy and your rights. In compliance with this regulation—and in keeping with our commitment to transparency and fairness towards our clients, which are fundamental principles of our business—we provide you with the following information.

Data Controller:
The Data Controller of your personal data is AGRICOLA MERSE Srl, represented by its legal representative pro tempore, who is responsible for the legitimate and proper use of your personal data and whom you may contact for any information or request at the following contact details:

Registered Office: Loc. Bagnaia Km 56 no. 5, 53016 Murlo (SI), Italy
Operational Headquarters: Strada Statale 223 “Siena – Grosseto” Km 56, 53016 Bagnaia, Murlo (SI), Italy
Email: info@labagnaiagolfresort.com

Data Processors:
Your data may also be disclosed to our External Data Processors, to whom we entrust certain processing activities. A complete list of such processors, along with the details of the data and processing entrusted to them, is available upon request to the Data Controller.

Nature and Categories of Data Processed:
We process your personal and fiscal data, economic and financial information, as well as other data necessary for administrative, fiscal and accounting obligations. We may also process your personal and contact details for the purpose of sending you commercial information, subject to your prior consent. We do not process any data that could be classified as sensitive under Article 9 of EU Regulation 2016/679.

Purpose of Processing:
The purpose of processing refers to the reason or aim for which data are collected. Depending on the purpose, your prior consent may be required before collection and subsequent processing can take place. Where such consent is necessary, the relevant purposes will be clearly outlined in a consent request form, through which you may freely provide your authorisation in whole or in part.
Below is a summary of the purposes for which your data are used, along with the corresponding legal basis:

Purposes
Promotional Activities: Promotional and Direct Marketing Activities via Electronic Means, Including the Sending of Informative and/or Advertising Material by Email or Traditional Methods Such as Telephone Calls by an Operator or Postal Mail
Photo Publication Activities for Advertising Purposes: Publication of Photographs for Advertising Purposes on Our Website, Magazines, Publications, Social Networks, etc., Collected During Events.

Legal Basis
Promotional Activities: European Union Regulation (GDPR 2016/679) Consent (Article 6 GDPR)
Photo Publication Activities for Advertising Purposes: European Union Regulation (GDPR 2016/679) Consent (Article 6 GDPR)

Your data will not be processed for purposes other than those stated above. Should this occur, we will provide you with detailed information regarding the new purpose.

Method of Processing:
The processing of data is carried out predominantly through automated means using procedures designed to ensure its security and confidentiality, including when employing technologically advanced tools such as the internet. Only data strictly necessary for the specified purposes will be processed.

Recipients and/or Categories of Recipients:
Your data may be disclosed by us—where “disclosed” means making the data known to one or more specific recipients—to the following recipients or groups of recipients:
- Entities authorised to access data by law, regulation or EU legislation, within the limits set by such provisions.
- Maintenance personnel of our IT systems and/or software providers, who may access the archives containing your data in case of system malfunctions or security issues, solely for the time necessary to restore full functionality.
- Parties requiring access to your data for auxiliary purposes related to the relationship between you and us, strictly to the extent necessary to perform their auxiliary duties (for example, banks and freight forwarders).
- Our consultants, to the extent necessary to carry out their assignments on our behalf, subject to our formal requirement to comply with privacy principles.
- External companies/consultants entrusted with certain processing operations, as specified in the section “Data Processors.”
- Internal personnel who may come into contact with your data in their capacity as data controllers or processors appointed by the data controller.

Data Disclosure:
Your data will not be disclosed by us—where “disclosed” means making the data known to unspecified parties by any means, including by making it available or accessible.

Data Transfer Outside the EU:
Your personal data will not be transferred to countries outside the EU or to international organisations.

Retention Period:
- Data of potential clients or suppliers for whom no sale or purchase has ever taken place will be retained for 2 years from the date of entry into the database.
- Data processed for marketing purposes will be retained for 2 years. At the end of this period, the data will be deleted or consent will be requested again.

Data Subject Rights:
- We also inform you of certain rights you may exercise if you believe that the processing we carry out violates the provisions of the Regulation.
- You have the right to request access to your personal data from the Data Controller (Article 15), as well as the rectification (Article 16) or deletion of such data (Article 17), the restriction of processing concerning you (Article 18), or to object to the processing of your data (Article 21).
- If you have given consent for one or more specific purposes, you have the right to withdraw that consent at any time (Article 13(2)(c)).
- You have the right to lodge a complaint with the Data Protection Authority (Article 77) or to seek judicial remedies (Article 79).

Obligation or Voluntariness of Data Provision and Consent:
Providing data for the purposes described in the “Purpose of Processing” section is voluntary and left to your discretion. It will not affect the provision of the requested service. For these purposes, your prior consent is required pursuant to Article 6(a) of EU Regulation 2016/679.

Siena, 16/07/2025