1. Premise
Pursuant to articles 13 and 14 of Regulation (EU) 2016/679 on the “protection of natural persons with regard to the processing of personal data” (hereinafter also “GDPR”), Users of the Services are hereby provided with the information requested on the processing of personal data concerning them (“Data”) carried out by Autostradale SRL.
2. Identity and contact details of the Data Controller
The Data Controller is Autostradale SRL, with registered office in Milan in Piazza Castello n. 1 and operational headquarters in Pero in Via Gramsci.
3. Data Protection Officer (DPO)
Autostradale SRL has appointed a Data Protection Officer (DPO), who can be contacted at the following email address: mail privacy@autostradale.com
4. Categories of personal data
The Data that Autostradale processes are personal data and contact data provided by users (e-mail address and telephone number).
5. Purpose of processing and legal basis
The data provided by users may be processed for the following purposes:
- issuing of travel tickets/season tickets via traditional ticket offices and the Owner's e-commerce systems;
- purposes directly connected and instrumental to the provision and management of the services on the Site (e.g. purchasing tickets online, checking previous routes, recovering tickets not received, ...)
- response to requests for information sent by users;
- Management of data processing from video surveillance for the protection of assets and personal safety.
- Subject to your specific consent, commercial information, marketing and market research, sending of advertising material relating to Autostradale products and services, with automated and non-automated contact methods
- Subject to your specific consent, detection of the quality of services and the degree of satisfaction of Users, carried out either directly or in collaboration with specialized companies;
The legal basis for the processing is constituted by:
- For the purposes referred to in sub a), b), c) and d), from the execution of the contract to which the user is a party (purchase of the service) or from the execution of pre-contractual measures (e.g. provision of credentials);
- For the purposes referred to in sub e) and f), from the consent given by the user.
Providing the Data is not mandatory, but any refusal to provide the Data will result in the objective impossibility of following up on the user's requests.
On the contrary, it is understood that your refusal to give consent to the processing for the purposes referred to in sub d) and e) will not allow Autostradale SRL to pursue only the purposes indicated therein.
6. Processing methods
The processing of personal data is carried out using manual, computerised and telematic tools with logics strictly related to the purposes and, in any case, in a way that guarantees the security and confidentiality of the data in compliance with current regulations.
7. Data retention period
Autostradale SRL will process the Data for the time strictly necessary to pursue the purposes set out above, without prejudice to any retention periods established by law or regulations.
8. Categories of subjects to whom the Data may be communicated
Some User Data may be communicated, for all the purposes indicated in point 4, to other companies of the group or to third parties, charged with carrying out activities directly connected and instrumental to the provision of the services offered on the Site (such as, for example, the centralized provision of IT activities at group level) as well as, with the prior consent of the User, to third-party companies with which Autostradale has stipulated commercial or partnership agreements aimed at promoting the dissemination of services or the offer of new services.
The subjects belonging to the categories to which the data may be communicated will process the data and will use them, depending on the case, as Data Processors expressly appointed by the Data Controller pursuant to the law, or rather as independent Data Controllers.
The list of designated Data Controllers is constantly updated and available at the headquarters of Autostradale SRL.
9. Transfer of personal data outside the EU
Personal data may be transferred to non-EU countries, in particular in the case of services located outside the European Union (e.g. cloud storage). In this case, the Data Controller hereby ensures that the transfer of data outside the EU will take place in accordance with the applicable legal provisions, for example after stipulating the standard contractual clauses adopted by the European Union.
10. Rights of the interested party
In your capacity as data subject, you have the right to:
- Ask the Data Controller for access to the Data, their deletion, the rectification of inaccurate Data, the integration of incomplete Data, as well as the limitation of processing in the cases provided for by art. 18 of the GDPR;
- Oppose, at any time, in whole or in part, the processing of Data necessary for the legitimate pursuit of the interest of the Owner;
- In the event that the conditions for exercising the right to portability pursuant to art. 20 of the GDPR are present, receive the Data provided to the Data Controller in a structured, commonly used and machine-readable format, as well as, if technically feasible, transmit them to another Data Controller without impediments;
- Revoke the consent given at any time;
- Lodge a complaint with the competent supervisory authority.
These rights may be exercised by registered mail, addressed to Autostradale SRL, Via Gramsci 2, 20016 PERO, or by e-mail to privacy@autostradale.com
