Information on the processing of personal data

Costa Crociere S.p.A. (hereinafter also referred to as ''Costa Crociere"), in its capacity as data controller, pursuant to Articles 13 and 14 of the European General Data Protection Regulation 679/2016 (hereinafter the "GDPR") and in compliance with applicable local legislation, provides the following information regarding the processing of personal data concerning you collected by Costa Crociere and provided by the travel agency where you purchased your cruise or that you, as data subject, have given us:

for the reservation and/or purchase of a tourist package;
as part of the cruise (e.g. purchases you made);
for registering on the Costa Crociere website and/or app or for filling in forms on the Costa Crociere website.

Data controller.

The data controller is Costa Crociere S.p.A. with registered office in Piazza Piccapietra 48, Genoa, Italy.

Data Protection Officer.

The Data Protection Officer (DPO) can be contacted at the following addresses: privacy@costa.it and/or at Costa Crociere S.p.A., Piazza Piccapietra 48, Genoa, Italy.

Purpose and legal basis of processing

a) Purposes relating to the booking/purchase of the tourist package and/or the fulfilment of your requests. Your personal data will be processed for the purpose of fulfilling the obligations arising from the contract relating to the booking and/or purchase of the tourist package and/or the fulfilment of your requests, also through digital channels, in order to allow Costa Crociere to provide the service in an optimal way, and specifically:

to conclude, manage and execute pre-contractual and contractual relations between you and Costa Crociere;
to respond to your requests;
to communicate service notices related to the booked and/or purchased tourist package (e.g. changes to contractual terms, booking information, etc.).

In addition, the data you provide may also include some personal data classified by the GDPR as 'special' (e.g. data relating to your health, the collection of which is necessary to provide you with a service tailored to your particular needs). These data will only be processed for purposes related to the tourist package and only with your prior consent, as the legal basis for processing, which you may give when completing the appropriate form that will be sent to you by e-mail if you have informed us that you have special needs when finalising the purchase of the tourist package.

b) Sending informational and promotional communications relating to the tourist package by e-mail. The legal basis for the processing is Costa Crociere's legitimate interest in ensuring that you receive communications related to similar services and products offered by Costa Crociere.

You may request to stop receiving these communications at any time by clicking on the appropriate link included in any of the e-mails sent to you by Costa Crociere.

The request in question will not affect the sending of any communication for marketing purposes referred to in point e) below, if you have expressly consented to it.

c) Legal, health and safety purposes. Your personal data, including data relating to your health where necessary, will also be processed to:

execute obligations in accordance with the law, regulations, national and EU legislation and provisions issued by authorities empowered to do so by law;
ascertain, exercise and/or defend a legal right of Costa Crociere;
provide you with the necessary medical assistance and/or safety during the cruise.

d) Statistical purposes. Your personal data will also be processed to generate, where possible in an anonymous form, aggregate statistics related to the activities carried out by Costa Crociere in connection with the sale of tourist packages. After booking and/or purchasing a tourist package, or during your travel experience, Costa Crociere may send you e-mail questionnaires to assess customer satisfaction. Completing these questionnaires is entirely voluntary, and, where possible, the information will be anonymised and not used for other purposes. The legal basis for this processing is the legitimate interest of the Company.

e) Direct and indirect marketing purposes of Costa Crociere, which include promotional activities by Costa Crociere concerning its products and/or services (so-called direct marketing), as well as the products of third-party commercial partners of Costa belonging to different product categories (e.g. tourism, airlines/transport services, travel agencies, insurance companies, electricity and gas suppliers, entertainment, etc.) or other companies in the Carnival Group to which Costa Crociere belongs (so-called indirect marketing). Marketing may be carried out both by automated means (e.g. e-mail, text messages, advertisements conveyed through social media networks, etc.) and by non-automated means (e.g. by ordinary mail, telephone with operator, etc.).

The Carnival Group companies are: Carnival Corporation (CCL), Carnival PLC (P&O, Cunard, Princess Asia), Costa Crociere S.p.A. (AIDA and Costa), Holland America Line N.V., general partner of Cruiseport Curacao C.V. (Holland America Line and Seabourn) Princess Cruise Lines, Ltd (Princess, Alaska, P & O Australia and Cunard), SeaVacations Limited (CCL business in UK).

Processing for marketing purposes (direct and indirect by Costa Crociere), carried out in the manner indicated, may only take place with your free, specific and express consent, which represents the legal basis of the relevant processing and which you may revoke at any time. Therefore, the processing of your data for the above-mentioned purpose is entirely optional.

f) Profiling purposes, involving the computerised analysis of your travel preferences and consumption habits, as well as market research, including through the use of questionnaires.

Specifically, the purpose of profiling is to create and/or develop predictive models of Costa Crociere customers, allowing for better targeting of commercial initiatives that align with customer interests, and/or enable the sending of personalised communications and/or commercial offers, thereby enhancing the customer experience with Costa Crociere.

Profiling activities are carried out based on one or more of the following criteria (referred to as 'profiling logic'): analysis of the purchasing experience (e.g. amount of money spent, time of year of purchase, types of products purchased) from the time the cruise is booked until its completion, including on-board spending and purchased packages (e.g. beverage packages), excursions, etc.; analysis of customer feedback on the overall experience through the e-Comment Form (a questionnaire sent at the end of the cruise); the composition and age group of those in the purchased tour package (solo traveller, couple, young couple, silver couple), as well as the booking market.

The result of the above profiling activities is that the data subject will receive personalised communications and/or promotional offers.

Processing for profiling purposes may only take place with your specific and express consent, which is the legal basis for the relevant processing and which you may revoke at any time. Therefore, the inclusion of data in the profiling database is entirely optional.

g) Purposes relating to access to the My Costa portal and the purchase of the products and services available therein, which include access on the website and/or through the mobile App called ‘Costa App’ to the My Costa portal, in order to allow you to access and use the services provided on the portal and reserved to users with an option and/or active cruise booking (e.g. for the purchase of wellness packages, drinks packages, excursions, wi-fi packages, wellness treatments, photos and gifts with the Costa logo, parties, etc.). The legal basis for processing is to fulfil your request to access My Costa, subject to the My Costa Regulations, as well as to conclude, manage, and fulfil pre-contractual and contractual relations between you and Costa Crociere through the portal.

h) Video and photographic recordings for purposes instrumental to the cruise: during the course of the cruise, photographs and/or video recordings may be taken by the photographers on our ships, who contribute to making your travel experience unforgettable. We would like to inform you that if you do not wish to participate in filming or photography, or if you do not wish for your photos to be displayed on the Photoshop boards, you may visit the Photoshops, where your preferences will be noted on a case-by-case basis. The removal of the photo portraying you can only be carried out after you have requested it. The legal basis for the processing is the legitimate interest of the company.

i) Ensuring safety on board and during the cruise: we have implemented a system that allows us to keep track of the persons on board and during the cruise at all times for security purposes and to ensure, should the need arise, more effective management of potential search and rescue operations and to safeguard the vital interests of passengers, in compliance with EC Directive 41/1998 (as amended by Directive (EU) 2109/2017) and Italian Legislative Decree No. 38 of 11 May 2020. In this context, we inform you that we will take a photo of you upon embarkation so that we can identify you during your stay on board the ship. The legal bases of this processing activity are Article 6(1)(c) and (d) of the GDPR.

For security reasons, we also use a video surveillance system on board our ships. Further information on this system and the relevant privacy policy can be found on the ship.

Nature of data provision and consequences of refusal.

The provision of the personal data requested during the purchase of the tourist package is necessary and any refusal to provide such data, in whole or in part, may make it impossible for Costa Crociere to allow you to finalise your purchase.

The provision of personal data for access to the My Costa portal is necessary and any refusal to provide the personal data requested, in whole or in part, may make it impossible for Costa Crociere to provide the services you have requested, including the possibility of making the online booking or concluding the purchases requested on the portal.

Finally, you have the right to freely express your consent, which is specific and revocable at any time, respectively for the additional marketing and profiling purposes mentioned above. Failure to provide consent or subsequent withdrawal of consent will in no way affect the achievement of the further purposes set out above.

Categories of recipients of personal data.

Your data will not be disclosed, except in cases where disclosure is required by law or is expressly authorised by you. Your data may be disclosed, solely for the above-mentioned purposes, to the following categories of persons:

Costa Crociere’s internal staff, expressly authorised to process personal data;
companies belonging to the same corporate group as Costa Crociere, which may be located abroad;
Costa Crociere’s suppliers and/or dealers who on board the ships and ashore provide services required during the cruise (e.g. Port Agents, entertainment, etc.);
persons, companies, associations or firms that provide services or assistance and consultancy activities in favour of Costa Crociere in order to protect its own rights (for example, accountants, doctors, lawyers, tax consultants, auditors, consultants as part of auditing or due diligence operations, etc.);
persons, companies, or agencies providing marketing and analysis services or consultancy activities in favour of Costa Crociere, including social media (e.g. Facebook);
entities or companies that provide support and/or services to Costa Crociere (e.g. IT services) and/or Costa Crociere business partners (e.g. travel agencies, service providers, payment service providers);
entities whose right to access your data is recognised by provisions of law and secondary legislation or by provisions issued by authorities empowered to do so by law, including port authorities in places of disembarkation.

The persons indicated will process the data, as the case may be, as autonomous data controllers or as data processors.

The list of persons to whom the data are disclosed can be requested from the Company or the Data Protection Officer at the following addresses: privacy@costa.it or Costa Crociere S.p.A., Piazza Piccapietra 48, 16121 Genoa, Italy.

Transfer of personal data outside the European Union.

Your personal data may be transferred abroad to third parties belonging or not belonging to the European Union, always for the above-mentioned purposes.

In the event of data being transferred to countries outside the European Union, these countries will guarantee, pursuant to Art. 45 ff. GDPR, an adequate level of protection on the basis of a specific decision of the European Commission, or alternatively, the recipient will be contractually obliged to data protection with a level that is adequate and comparable to the protection under the GDPR.

In particular, your data may be transferred, by way of example, to companies of the group to which Costa Crociere belongs, including those located in countries outside the EU (e.g. the United States), countries of destination of your cruise, respective port authorities or different authorities to which the communication of personal data is required by law or by international conventions of maritime law, etc. The list of persons to whom the data is disclosed can be requested from the Company or the Data Protection Officer at the following addresses: privacy@costa.it or Costa Crociere S.p.A., Piazza Piccapietra 48, 16121 Genoa, Italy.

Retention of personal data.

Personal data will be retained for a period not exceeding that necessary to fulfil the purposes for which they were collected and subsequently processed. Personal data will be stored for the duration of the contract concluded by you and also for a period thereafter:

within the time limits set by the regulations in force;

within the time limits laid down by legislation, including secondary legislation, requiring the retention of data (e.g. tax returns);
within the period necessary to protect the rights of the data owner in the event of any disputes in connection with the provision of the service.

The photos/pictures and audio/video footage recorded during on-board events will be kept for a period of 90 days from the end of the cruise and, unless you subscribe to specific services to which you may be entitled, subsequently deleted. Personal data processed for marketing purposes on the basis of the express and specific consent you have given will be kept for five (5) years, if you do not complete the purchase of a Costa cruise within this timeframe, or for ten (10) years, if you purchase one or more cruises.

Personal data collected and processed for profiling purposes will be retained for a maximum period of ten (10) years, after which they will be automatically deleted or permanently anonymised.

Rights of the data subject.

At any time, pursuant to Articles 15 to 22 of the GDPR, you have the right, also in connection with profiling activities, to:

access your personal data;
request the correction of your personal data;
withdraw consent to the use and disclosure of your personal data at any time;
request the deletion of your personal data;
receive in a structured, commonly used and machine-readable format the personal data concerning you, as well as transmit your personal data to another data controller;
oppose the processing of your personal data, including for marketing or profiling purposes;
obtain the restriction of the processing of your personal data;
file a complaint with a supervisory authority;
receive a notice if there is a personal data breach;
request information on:
1. the purposes of the processing;
2. categories of personal data;
3. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if the data are transmitted to recipients in third countries or international organisations, and the existence of appropriate safeguards;
4. the retention period of personal data;
5. where the data are not collected from the data subject, all available information on their origin.

You may at any time stop the sending of communications related to marketing and profiling activities by clicking on ‘unsubscribe’ at the bottom of the e-mail received or by forwarding a specific request to the addresses indicated below or by accessing your reserved C|Club area from the costacrociere.it website, if you are a member of the above-mentioned Club.

You may exercise these rights and/or obtain more information on the processing of your personal data by writing to:

- via e-mail to privacy@costa.it

- by ordinary mail: Costa Crociere S.p.A. Piazza Piccapietra 48, 16121 Genoa, Italy, to the attention of the Data Protection Officer.