Pursuant to and for the purposes of Article 13 of Regulation (EU) No. 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, also referred to as the General Data Protection Regulation (hereinafter, the "GDPR"), we inform you that the personal data you voluntarily provide to Itabus S.p.A. (hereinafter also referred to as the "Company", "Itabus" or the "Data Controller") during navigation of the website www.itabus.it (hereinafter, the "Website") or within the App (hereinafter, the "Itabus App") will be subject to processing in compliance with the current legislation on the protection of personal data, by which is meant the GDPR, the Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 (hereinafter, the "Privacy Code") as well as the provisions issued from time to time by the Italian Data Protection Authority (hereinafter, the "Privacy Authority"), and, in any event, in compliance with the principles of confidentiality that inspire the Company's activity.
1. Categories of personal data processed
Itabus will process the following categories of personal data provided by you:
- - browsing data, such as, for example, information relating to the device used to browse the Itabus Website/App and/or to make purchases, IP address, cookies, etc. When navigating on the Website, with particular reference to the use of cookies, Itabus informs you that, in accordance with the Provision of the Privacy Authority of 10 June 2021, at the following link you can consult the Website's Cookie Policy containing all the information needed to understand, identify, use or delete the cookies used on the Website;
- - personal data, such as, but not limited to, the name and surname of the purchaser and any additional passengers, tax code, VAT number, etc.
- - contact data, such as, but not limited to, customer number, e-mail address and telephone number;
- - bank and/or payment data.
- - data relating to the state of health, only where this is necessary for the pursuit of the specific purpose set out in paragraph 2(c) below;
- - location data
2. Purpose and legal basis of processing
Personal data made available to Itabus through the Itabus Website/App may be used for the following purposes:
a) compliance related to the use of the Website/App Itabus, such as, by way of example, the activation through registration, and subsequent management and technical security maintenance, of accounts to manage access to the Website/App Itabus and/or the services made available therein, as well as passwords or similar authentication credentials, the management and processing of your requests for information forwarded by filling in forms and/or forms on the Website/App Itabus, etc;
b) compliance to legal obligations to which the Company is subject, including administrative and/or accounting fulfilments;
c) with reference to the personal data of users who intend to use the services offered by Itabus to passengers with reduced mobility, fulfilments related to the legal obligations to which the Company is subject regarding assistance to people with disabilities or persons with reduced mobility as per Regulation (EU) No 181/2011 of the European Parliament and of the Council of 16 February 2011;
d) fulfilments connected to the execution of a contract, pre-contractual measures and/or the provision of services, such as, for example, the establishment and execution of the contractual relationship with Itabus relating to the transport service you have requested, assistance activities relating to the services and/or products you have purchased through the Itabus Website/App (socalled "customer service"), etc;
e) obligations connected with the need to establish, exercise or defend a right in judicial or administrative proceedings or in arbitration or conciliation proceedings;
f) direct sale activities of services similar to those you purchased, pursuant to the provisions of Article 130, paragraph 4, of the Privacy Code (so-called "soft spam"). It will be possible for the Company to use the e-mail address you provided in the context of your ticket purchase. However, you can object to this processing at any time (initially or during subsequent communications) also by sending a specific request to the Data Controller, formulated as provided for in the following paragraph 8 of this notice;
g) Carrying out promotional activities (so-called "marketing") and sending informative and promotional communications - by Itabus - relating to products and services of Itabus and commercial partners of Itabus, and/or the lowering of the price of your searches, via mail, internet, telephone, e-mail - including newsletters and direct e-mail marketing - MMS, SMS, also for market research purposes (so-called "customer satisfaction");
h) with reference to the personal data of the users registered on the reserved area of the Itabus Website/App, the performance of profiling activities carried out in order to allow the analysis of tastes, preferences, habits, needs and consumption choices in order to receive personalized offers based on purchasing preferences;
i) provide information to users on the nearest bus stations and services that can be used in the geographical area of connection.
The processing of data for the purposes sub b) and c) does not require your consent, as it is necessary to fulfil the legal obligations to which the Company is subject, pursuant to Article 6, c. 1, lett. c) of the GDPR.
In particular, the processing of data for the purpose sub c) is necessary to fulfil the legal obligations relating to assistance to persons with disabilities or reduced mobility referred to in Regulation (EU) No 181/2011, pursuant to Art. 6, c. 1, lett. c) and Art. 9, c. 2, lett. b) of the GDPR.
The processing of data for the purpose sub d) does not require your consent insofar as it is necessary for the fulfilment of contractual and/or pre-contractual obligations, pursuant to Art. 6, c. 1, letter b) of the GDPR. The processing of data for the purposes under a), e) and f) does not require your consent as it is necessary for the pursuit of a legitimate interest of the Company, pursuant to Article 6, c. 1, lett. f) of the GDPR and/or Article 130, c. 4 of the Privacy Code.
The processing of data for the purposes under g), h) and i) requires your consent pursuant to Art. 6, c. 1, letter a) of the GDPR.
3. Methods of processing
Personal data will be processed by means of suitable paper, electronic and/or telematic tools, with logic strictly related to the above purposes and, in any case, in such a way as to guarantee the security and confidentiality of the data
4. Provision of data and consequences of refusal
The provision of personal data for the purposes sub b), c) and d) of paragraph 2 above is necessary for the fulfilment of legal and/or contractual obligations. Any refusal and/or provision of inaccurate and/or incomplete information may have possible consequences:
i) the impossibility for the Company to comply with all the requirements imposed by the laws in force that are instrumental and/or in any case related to the establishment and/or execution of the contractual relationship to which it is subject;
ii) the impossibility of entering into the contract of carriage and/or guaranteeing the regular and timely execution of the relative contractual relationship, including assistance activities relating to the services and/or products purchased by you through the Website/App Itabus (so-called "customer service").
The provision of personal data for the purposes sub a), e) and f) of paragraph 2 above is necessary for the pursuit of the legitimate interests of the Company as set out above. Any refusal and/or the provision of inaccurate and/or incomplete information could have the following possible consequences:
i) the impossibility for the Company to carry out the fulfilments related to the use of the Website/App Itabus, including the management and processing of your requests for information forwarded by filling in forms and/or forms on the Website/App Itabus;
ii) the impossibility for the Company to establish, exercise or defend a right in judicial or administrative proceedings or in arbitration or conciliation procedures; i
iii) the impossibility for the Company to carry out direct sales activities of services similar to those purchased by you, pursuant to the provisions of Section 130(4) of the Privacy Code.
The provision of personal data for the purposes under g), h) and i) of paragraph 2 above is optional; however, a refusal to provide such data and/or the provision of inaccurate and/or incomplete information may have possible consequences:
i) the impossibility for the Company to contact you and/or send you informative and commercial communications, also of a promotional nature, advertising material and/or offers of goods and services of Itabus as well as to carry out market surveys;
ii) the impossibility for the Company to analyse preferences, habits, needs and consumption choices and to send personalized offers based on purchasing preferences;
iii) the inability of the Company to provide information regarding the nearest bus stations and services that can be used in the geographical area of connection.
5. Recipients or categories of recipients of personal data
Your personal data may be disclosed to the shareholders, the members of the board of directors or other administrative body and, in any event, to the Data Protection Officer, the External Data Processors, the Data Processors and/or the Data Processors designated by the Company in the exercise of their functions. Your personal data may be communicated to any subjects that provide the Company with services or facilities instrumental to the purposes indicated in paragraph 2 above, such as, purely by way of example, subjects, entities and/or companies that manage and/or participate in the management and/or maintenance of the websites and electronic and/or telematic tools used by us. Your personal data may also be communicated to suppliers, contractors, sub-contractors, banking and/or insurance institutions, consultants who assist Itabus in various ways with particular reference to legal, tax, social security, accounting and organizational aspects; to the Police or the Judicial Authorities within the scope of investigations or judicial police enquiries for the prevention, verification or repression of crimes; any other subject to whom the data must be communicated on the basis of an express provision of law.
6. Transfer of data to third countries
Your personal data may possibly be communicated and/or transferred abroad, in accordance with current legislation, including to countries outside the European Union. In all such cases, the transfer is made on the basis of an adequacy decision of the Commission (Article 45 of the GDPR) or in accordance with the standard contractual clauses or other appropriate safeguards pursuant to Articles 46 or 49 of the GDPR
I Suoi dati personali saranno trattati solo per il tempo necessario al raggiungimento delle finalità per le quali essi sono trattati.
7. Duration of processing and retention period
Your personal data will only be processed for as long as it is necessary to achieve the purposes for which they are processed.
Data will be stored according to the following criteria:
- - the data processed for purposes related to the fulfillment of legal obligations and contractual and/or pre-contractual obligations referred to in letters b), c), and d) of paragraph 2 "Purpose and legal basis of the processing" of this information notice, will be retained for a period of 10 years, unless the need for further retention arises, in order to allow Itabus to defend its rights;
- - the data processed for the purpose of direct sales activities of services similar to those purchased by you, as referred to in letter f) of paragraph 2 “Purposes and legal basis of the processing” of this notice, will be kept for a maximum of 24 months;
- - the data processed for the marketing purposes referred to in point (g) of paragraph 2 “Purpose and legal basis of the processing” of this notice will be kept for a maximum of 24 months;
- - the data processed for the purpose of profiling, as referred to in point (h) of paragraph 2 “Purpose and legal basis of the processing” of this notice, will be kept for a maximum of 12 months;
- - the data processed for the pursuit of the legitimate interests referred to in points (a) and (e) of paragraph 2 "Purpose and legal basis of the processing" of this notice, shall be retained for a maximum period of time equal to the period of prescription of the rights enforceable by the Controller, as applicable from time to time;
- - data processed for the pursuit of the purpose of localisation referred to in point (i) of paragraph 2 “Purpose and legal basis of the processing” of this notice will not be retained.
8. Rights of the data subject
We inform you that at any time in relation to your data, you may exercise your rights within the limits and under the conditions laid down in Articles 7 and 15-22 of the GDPR.
In order to exercise these rights, which are described below, please contact the Data Controller at the email address privacy@itabus.it; this request will be answered without delay and, in any case, within one month of receipt of the request. In detail, you, as a data subject, have the right to:
- - obtain confirmation as to whether or not personal data concerning you are being processed;
- - if a processing operation is in progress, obtain access to personal data and information concerning the processing and request a copy of the personal data;
- - obtain the rectification of inaccurate personal data and the integration of incomplete personal data;
- - obtain, if one of the conditions set out in Article 17 of the GDPR applies, the deletion of personal data concerning you;
- - obtain, in the cases provided for in Article 18 of the GDPR, the restriction of processing;
- - receive the personal data concerning you in a structured, commonly used and machine-readable format and request their transmission to another data controller, if technically feasible.
8.1. Right of objection
Each data subject has the right to object at any time to the processing of their data carried out for the pursuit of a legitimate interest of the Owner. In case of opposition, your data will no longer be processed, provided that there are no legitimate reasons to proceed with the processing that prevail over the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of a right in court.
8.2 Right to object and withdraw consent in relation to processing for marketing, profiling and tracking purposes
With reference to the processing of data for the purposes sub g), h) and i) of paragraph 2 "Purpose and legal basis of the processing" of this information notice, each data subject may at any time revoke any consent given or object to their processing by sending an email to privacy@itabus.it. Withdrawal of your consent will not affect the lawfulness of the processing based on the consent given before the withdrawal. Opposition to processing exercised by these means also extends to the sending of commercial communications by postal service or telephone calls with an operator, without prejudice to the possibility of exercising this right in part, by opposing, for example, only processing by automated communication systems.
8.3 Right to lodge a complaint with the Privacy Authority
Finally, pursuant to Article 77 of the GDPR, we remind you that you have the right to lodge a complaint with the Privacy Authority, if you consider that your rights under the GDPR have been violated, in the manner indicated on the website of the Privacy Authority accessible at www.garanteprivacy.it.
9. Data Controller, Data Processors and Data Protection Officer
The Data Controller is Itabus S.p.A., in the person of its Legal Representative pro tempore, with registered office in Rome, via Casilina, no. 1 - 00182. The updated list of Data Processors is available at the Data Controller's head office and can be requested by sending a
communication to the e-mail address privacy@itabus.it. The Data Protection Officer can be contacted at the e-mail address dpo@itabus.it.
LAST UPDATE: June 2023