INFORMATION NOTICE – PASSENGERS WITH REDUCED MOBILITY (PRM)
Pursuant to and for the effects of article 13 Regulation (EU) 2016/679 of the European Parliament and of the Counsil of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation” or simply “Regulation” or “GDPR”), we inform you that ITALO - Nuovo Trasporto Viaggiatori S.p.A. (ITALO) collects and processes Your personal data in compliance with data protection law in force and, in any case, in accordance with the principles of confidentiality that our Company is inspired by.
1. Categories of personal data processed
Italo will process the following categories of personal data provided by You:
- Personal data, such as, for example, name, surname, phone number, e-mail, customer loyalty code;
- Bank and/or payment details;
- In case of invoice request, VAT number, surname, business name, address, e-mail;
- Special category of personal data, such as data concerning health, related to his status of passenger with disabilities or reduced mobility (below “PRM”).
2. Purposes of the processing activities
Your Personal Data will be processed by ITALO for:
a) purposes related to the fulfillment of contractual obligations, including administrative and accounting purposes relating to the execution of the transport service requested by you, including the execution of the activities envisaged by Regulation (EU) no. 2007/1371 of the European Parliament and of the Council of 23 October 2007 concerning the rights and obligations of passengers in railway transport;
b) purposes related to the fulfillment of provisions of law and regulations currently in force;
c) purposes related to the provision of the assistance service related to getting on/off the train, whose legal basis is the legal obligation;
d) fraud prevention activities. This purpose, whose legal basis is the legitimate interest of ITALO, involves the possibility of action in order to counteract any fraud event;
e) the Personal Data you have made available to ITALO will also be processed for purposes related to direct sales of services similar to those purchased by you, pursuant to the provisions of art. 130, paragraph 4 of Legislative Decree n. 196/2003. It will be possible for the Company to use the email addresses provided by you in the context of the purchase of the transport service. However, you may, at any time (initially or on the occasion of subsequent communications) object to such processing also by means of a specific request to the Data Controller, formulated in accordance with the provisions of article 6 of this information notice.
We inform You that, with reference to the purposes specified in points a), b) c) and d), the provision of Your Personal Data is mandatory.
Your refusal and/or the provision of inaccurate and/or incomplete information would determine:
the impossibility to stipulate the transport contract and/or to guarantee the regular and timely execution of the contractual relationship;
the mismatch of the results of the processing of Personal Data with the obligations imposed by current legislation, including tax law;
the impossibility on the part of ITALO to carry out the activities envisaged by Regulation (EU) no. 2007/1371 of the European Parliament and of the Council of 23 October 2007 on the rights and obligations of passengers in railway transport.
3. Methods of the processing activities
In relation to the purposes indicated, Your personal data will be processed by suitable paper-based, electronic and/or Web-based instruments with logic strictly related to the aforesaid purposes and, in any case, such as to ensure data security and confidentiality.
4. Recipients or categories of recipients of the personal data
Members of the Board of Directors, the Data Protection Officer and, in any case, all persons acting under the authority of the Data Controller, authorized to processing activities may be aware of Your personal data during the execution of their duties.
Your Personal Data may be communicated to any third party that provides ITALO services or instrumental services necessary to the purposes indicated in paragraph 2 above such as, but not limited to, parent companies, subsidiaries and/or affiliates; subjects, organizations and/or companies that manage and/or participate in the management and/or maintenance of the websites and the electronic and/or telematic tools used by ITALO.
Your Personal Data may also be communicated to suppliers, contractors, subcontractors, banking and/or insurance companies, consultants who assist ITALO with particular reference to legal, tax, administrative, accounting, organizational issues; any other party to which the data must be communicated based on an express provision of law.
Your Personal Data may be transferred abroad, in accordance with the provisions of current legislation, even in countries outside the European Union where the Company pursues its own interests. The transfer to no-EU countries, in addition to the cases in which this is guaranteed by the Commission's Adequacy Decisions, is carried out in such a way as to provide appropriate and guarantees in compliance with articles 46 or 47 or 49 of the GDPR.
5. Duration and criteria used to determine the period for which the personal data will be stored
For the purposes a), b), c) and d) referred to in paragraph 2 "Purposes of Processing activities" of this information notice, your Personal Data will be processed only for the time strictly necessary to achieve the same purposes for which they are collected.
5.2 Retention period
Your Personal Data will be stored in accordance with the following criteria:
- the Data processed for purposes related to the fulfillment of contractual and legal obligations with reference to letters a), b) and c) of paragraph 2 "Purposes of Processing activities" of this information notice, will be kept for a period of 10 years following upon purchase, unless the need for further conservation arises, to allow ITALO to defend its rights;
- the Data processed for purposes of direct sales activities of services similar to those purchased by you as per letter d) of paragraph 2 "Purpose of the Processing activities" of this information notice, will be kept for a maximum period of 24 months;
6. Data subject’s rights
We would like to inform You that at every time You could exercise Your rights according to Article 7 and Articles 15-22 of GDPR 2016/679.
To exercise Your rights, You can contact the Data Controller at firstname.lastname@example.org. To Your request, the Company will give You a feedback in accordance with the timing defined by the law
You have the right to:
- revoke the consent previously given, without prejudice to the lawfulness of the processing based on consent before the revocation;
- request from the Data Controller access to or rectification or erasure of personal data (“right to be forgotten”) or the restriction of processing concerning You or to object to processing;
- obtain data portability;
- lodge a complaint with the competent supervisory authority.
7. Data Controller and Data Processor for processing activities
The Data Controller is ITALO – Nuovo Trasporto Viaggiatori S.p.A., with registered office in Viale del Policlinico, no. 149/B, Rome, Italy, in the person of Legal Representative. Any request relating to the personal data processed by ITALO - Nuovo Trasporto Viaggiatori S.p.A. may be sent to the company’s registered office or to its email email@example.com.
The updated list of Data Processors is made available by the Company and may be obtained upon a specific request submitted as detailed above.
The Data Protection Officer’s contacts is firstname.lastname@example.org
This privacy information notice could be updated. Italo invites You to periodically visit this page in order to know how does Italo process Your Data.
ITALO – Nuovo Trasporto Viaggiatori S.p.A.
This is an English courtesy translation of the original documentation prepared in Italian language. Please consider that only the original version in italian language has legal value.