1. Introduction
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 on the “protection of natural persons with regard to the processing of personal data” (hereinafter also “GDPR”), this document provides Users of the Services with the information required regarding the processing of their personal data (“Data”) carried out by Autostradale SRL.
2. Identity and Contact Details of the Data Controller
The Data Controller is Autostradale Viaggi SRL, with registered office in Milan at Piazza Castello No. 1 and operational office in Pero at Via Gramsci.
3. Data Protection Officer (D.P.O.)
Autostradale SRL has appointed a Data Protection Officer (D.P.O.), who can be contacted at the following email address: privacy@autostradaleviaggi.com
4. Categories of Personal Data
The Data processed by Autostradale consists of personal identification data and contact details provided by users (email address and phone number).
5. Purpose and Legal Basis of the Processing
The Data provided by users may be processed for the following purposes:
issuance of travel tickets/subscriptions through the traditional ticket office and the Data Controller’s e-commerce systems;
purposes directly connected and instrumental to the provision and management of the services on the Website (e.g., purchase of tickets online, verification of previous routes, retrieval of tickets not received, etc.);
responding to information requests submitted by users;
management of data processing from video surveillance for the protection of property and personal safety;
upon your specific consent, commercial information, marketing and market research, sending advertising material relating to Autostradale products and services, by automated and non-automated contact methods;
upon your specific consent, measurement of service quality and user satisfaction, carried out directly or with the collaboration of specialized companies.
The legal basis for the processing is:
For the purposes under points a), b), c), and d), the execution of the contract of which the user is a party (purchase of the service) or the execution of pre-contractual measures (e.g., provision of credentials);
For the purposes under points e) and f), the consent given by the user.
Providing the Data is not mandatory, but refusal to provide Data will result in the inability to fulfill the user’s requests.
Conversely, your refusal to give consent for the processing for the purposes under points e) and f) will prevent Autostradale Viaggi SRL from pursuing those specific purposes.
6. Methods of Processing
The processing of personal data is carried out by manual, computer and telematic tools with logics strictly related to the purposes and, in any case, in a manner that ensures the security and confidentiality of the data in accordance with current regulations.
7. Data Retention Period
Autostradale SRL will process the Data for the time strictly necessary to achieve the purposes mentioned above, subject to any retention periods required by law or regulations.
8. Categories of Recipients of the Data
Some user Data may be communicated, for all the purposes indicated in point 5, to other group companies or third parties appointed to carry out activities directly connected and instrumental to the provision of services offered on the Website (such as centralized IT services at group level), as well as, subject to user consent, to third-party companies with which Autostradale Viaggi has commercial or partnership agreements aimed at promoting the services or offering new services.
The subjects belonging to the categories to whom the data may be communicated will process the data as Data Processors expressly appointed by the Data Controller under the law or, alternatively, as independent Data Controllers.
The list of designated Data Processors is continuously updated and available at the headquarters of Autostradale Viaggi SRL.
9. Transfer of Personal Data Outside the EU
Personal data may be transferred to countries outside the EU, particularly in the case of services located outside the European Union territory (e.g., cloud storage). In such cases, the Data Controller ensures that the data transfer outside the EU will be carried out in accordance with applicable legal provisions, such as by entering into the standard contractual clauses adopted by the European Union.
10. Rights of the Data Subject
As a data subject, the user has the right to:
Request access to Data, deletion, correction of inaccurate Data, completion of incomplete Data, and restriction of processing in the cases provided by Article 18 of the GDPR;
Object, at any time, in whole or in part, to the processing of Data necessary for the legitimate interests of the Data Controller;
Where applicable, exercise the right to data portability under Article 20 of the GDPR, receiving the Data provided to the Data Controller in a structured, commonly used, machine-readable format and, if technically feasible, transmit it to another Data Controller without hindrance;
Withdraw consent at any time;
Lodge a complaint with the competent Supervisory Authority.
These rights can be exercised by sending a registered letter addressed to Autostradale Viaggi SRL, Via Gramsci 2, 20016 PERO, or by email to privacy@autostradaleviaggi.com.