PRIVACY INFORMATION AND COOKIES IN ACCORDANCE WITH ART. 13 OF EU REGULATION N. 2016/679 OF 27 APRIL 2016 AND COOKIES

This information is provided in accordance with and for the purposes of art. 13 of EU Regulation no. 2016/679 of 27 April 2016 (therefore also”GDPR”) relating to the protection of individuals with regard to
the processing of personal data. Specifically, the AmbraRoute KFT company, as the acting ‘Data Processor’, wishes to inform that, with the implementation of the obligations deriving from the GDPR, it
is required to provide some information concerning the methods and purposes of the processing of personal data, of which the same may come into possession following consultation and of use of the website by the user.

A.
DATA PROCESSOR
The Data Processor for all personal data collected and processed is the AmbraRoute KFT company, located in 9700 Szombathely, via Kiskar utca 1. 2. HungaryWebsite: www.kheper21.com Email address: info@kheper21.com

B. DATA PROCESSED AND PURPOSEOF TREATMENT

1. TYPES OF DATA PROCESSED
Reservations1.1 The optional and voluntary sending of a request to book a tour involves the filling in the appropriate form and the indication of the following mandatory personal data: name, surname, telephone number and e-mail address of the contact person; as well as, name, surname, gender, age and height of each participant.1.2 Confirmation and payment of the reservation, through the section “check your reservation”, involves the acquisition of billing data (name, surname, tax code and residence). The data used for payment are acquired directly by the requested payment service manager without being processed by the Data Processor.1.3 The optional and voluntary compilation of the “Create your trip” form entails the acquisition of the following mandatory personal data: name, surname, telephone number and e-mail address.
Information request2.1 The optional and voluntary compilation of the form “for any other information contact us”,present in the “Contacts” section of the website, involves the acquisition of the following personal data: name, surname, e-mail.2.2 The optional and voluntary sending of electronic communications or requests to the mail address on the site, implies the acquisition of personal data contained in the message,So as to respond to any communications sent.
Collaborations3.1 The optional and voluntary compilation of the form “apply now as an emotion guide” entails the acquisition of mandatory personal data (name, surname, e-mail address, telephone, languages known, years of experience and area of ​​interest) and optional data (interest in cycling).3.2 The optional and voluntary compilation of the form “do you want to be a partner” entails the acquisition of the following personal data (name, surname, e-mail address).
Navigation dataThe computer systems and software procedures used to operate the site, during their normal functioning, acquire some personal data whose transmission is implicit in the use ofInternet communication protocols.This category of data includes the IP addresses or domain names of the computers used by the users who connect to the site, the addresses in URI (Uniform Resource Identifier) ​​notation of the resources requested, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters related to the operating system and the computer environment of the user. These data are used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning. The data could be used to ascertain responsibility in case of hypothetical computer crimes against the site or the Data Processor only at the request of the supervisory bodies in charge.
2. PURPOSES OF THE PROCESSING
The data processing will be carried out for the following purposes:. as for points 1.1, 1.2, 1.3, lett. B, for:a. the fulfillment and execution of the contract; b. managing the reservation and monitor its status; c. managing the activities connected to the contractual relationship and to any possible pathological or contentious phase related to the same.
The provision of the above data is mandatory. Failure to provide them results in the automatic inability to execute contractual obligations by theHolder.. regarding points 2.1 and 2.2, lett. B, to respond to user requests;. as for point 3.1, lett. B, for the selection of the guides;. as for point 3.2, lett. B, for the selection of partners.The data referred to in points 1.1.1.3, 2.1, 2.2 may, with the consent of the interested party, be allowed by ticking the box “I want to be updated via e-mail on the initiatives and the promotions by Kheper21″, to send communications relating to the initiatives and promotions of theHolder of the treatment. Consent is freely revocable at any time by writing an e-mail to: info@kheper21.com
1.
LEGAL BASIS OF THE TREATMENT

The legal basis for the processing of the personal data indicated above is:. as for point 1.1, 1.2,1.3, lett. B, the need to execute the contract by the party of the Data Processor.Therefore, the provision of data is mandatory and any failure to provide it could lead to non-execution of the contract..  regarding points 2.1 and 2.2, lett. B, the need to respond to user requests;.  regarding points 3.1 and 3.2 lett. B, the consent of the interested party;.  regarding the sending of communications relating to the initiatives and promotions of the Data Processor, the consent of the interested party.This consent can be revoked at any time by writing an e-mail to: info@kheper21.com
2.
METHOD OF TREATMENT
Personal data are processed with automated and non-automated tools, for the purposes for which they were collected. Specific security measures are observed to prevent data loss, illegal useor incorrect and unauthorized access. The collected data may be used on behalf of theData Processor, by the administrators in charge of carrying out processing andcorrect performance of site activities. The data use connected to the web services of this sitecan also take place through a web service provider. The data will be saved on a serverlocated within the European Union. The data treatment will be carried out by the owner and the appointees expressly authorized by the owner.
3.
DURATION OF THE RETENTION OF DATA

Personal data will be kept:- As for the data necessary for booking and organizing the tour, until performing the same. It is specified that the data provided through the request for reservation, which has been refused by the Owner or not finalized by the User, will be cancelled on the negative outcome of the same.- As for the tax data contained in the invoice, they will be kept for 10 years from the conclusion of the contract. A longer period of data retention may possibly be determined by requests made by the Public Administration or other judicial body, governmental or regulatory, or by the participation of the Data Processor in judicial procedures which imply the processing of personal data.- As for the data provided by filling in the form “for any other information contact us “, or by sending electronic communications to the e-mail address on the site, for as long as necessary to respond to requests.- As for the data provided by filling in the form “apply now as an emotion guide” and of the “do you want to be a partner” form, for the time necessary to carry out the selection and evaluation activities.- As for the data processed for sending communications relating to the initiatives and promotions of the Data Processor, until explicitly withdrawing consent from the interested party.- As for navigation data, for the technical time necessary to perform the functions for which they were collected and in any case for a maximum period of 6 months.The Data Processor will keep the data of the interested party until the expiry of the term of conservation or revocation of consent by them, with the notice that, in any case, such data will be automatically deleted or anonymized permanently and irreversibly.
4.
ADDRESSEES E CATEGORIES OF RECIPIENTS

The personal data provided will not be disseminated and will not be disclosed to indeterminate subjects.The data may instead be communicated to well-defined subjects only by the Data Processor processing for the purposes indicated, in particular:a) Software house; b) Data processors and agents.c) Providers of the e-bike rental and professional guides, in the case of point 10.4 of the General Booking ConditionsThe list of subjects appointed as external data processors is available by contacting info@kheper21.com
5.
RIGHTS INTERESTED

The interested party has the right: – upon access, rectification, cancellation, limitation and opposition to the processing of data; – to obtain the data in a structured use format without hindrance from the data processor common and readable by automatic device to transmit them to another data processor; – to withdraw consent to the data processing, without prejudice to the lawfulness of the treatment based on the consent acquired before revocation.
In this regard, we inform you that the deadline for replying to the interested party is, for all rights of one month from receipt of the request, extendable up to three months in cases of particular complexity. The exercise of the right premises can be exercised by means of written communication to be sent to by e-mail to the address: info@kheper21.com or by registered letter international address: AmbraRoute KFT, current in 9700 Szombathely, via Kiskar utca 1. 2.
6.
GUARANTOR AUTHORITY CLAIM

The interested party has the right to lodge a complaint with the Data Protection Authority.The complaint is the tool that allows the interested party to contact the Guarantor to make a complaint about a violation of the regulation of the protection of personal data pursuant to art. 77 of the GDPRand to request a verification from the Authority.The complaint can be put forward by the interested party or the supervisory authority of the place where they reside, in the place where they work or where the alleged violation occurred.The interested party also has the right to bring a judicial appeal before the ordinary court if it is believed that the rights you enjoy have been violated during the processing of the data.
7.
OVERSEAS DATA TRANSFER 
There is no transfer of data outside the European Union.