PRIVACY POLICY “Navigo Per Te” PROGRAMME
Policy pursuant to and for the purposes of Regulation (EU) 2016/679 (GDPR)
Dear Sir/Madam
The following is some information on the processing of your personal data, which will be collected by us during the registration and use of the “Navigo Per Te” (Surfing for you) loyalty plan.
The data controller is Caronte & Tourist S.p.A., which can be contacted at:
- e-mail address: privacy.gruppo@carontetourist.it
- telephone number: 090/9038201
The company has appointed a Data Protection Officer, in accordance with Article 39 of Regulation (EU) 2016/679, who can be contacted at the data controller's head office or by e-mail at dpo@carontetourist.it.
Type of data processed
When requesting enrolment in the loyalty programme, the Data Controller collects the following information pursuant to Article 4(1) GDPR:
Data acquired directly from the data subject:
- personal and identification data (name and surname, date of birth, tax code/VAT number);
- contact details (telephone number, e-mail address);
- licence plate of vehicle/s;
- photo identification;
- municipality of residence;
- full address of residence/domicile;
- valid ISEE certification;
- certificate of residence;
- copy of identity document;
Data acquired directly from the data subject, in case of consent to profiling:
- Reasons for travel, usual destinations, vehicles owned, gender, marital status, profession, education, children, behavioural preferences and interests;
Automatically acquired data:
- data relating to trips made (e.g. frequency of travel) and any ancillary services purchased;
- data on benefits provided under the programme (e.g. bonuses and benefits enjoyed).
Purpose and legal basis of processing
Your data are processed for the following purposes:
|
|
Purpose |
Legal basis for processing |
|
a) |
Issuing of the loyalty card, participation in the loyalty programme, provision of related services and sending of related communications. |
Processing necessary for the performance of a contract to which the data subject is party or for the performance of pre-contractual measures (Art. 6(1)(b) GDPR). |
|
b) |
Photographic verification of the identity of programme members (e.g. when purchasing tickets at the ticket office, when making trips, or when requesting or using bonuses and benefits). |
Processing based on a legitimate interest of the Data controller (Art. 6(1)(f) GDPR). |
|
c) |
Sending advertising and promotional communications regarding the services offered by the companies of the Caronte & Tourist group, so-called direct marketing (e.g. newsletters, SMS, telephone calls, etc.) and carrying out surveys on customer satisfaction, not connected to the provision of the service (market surveys). |
Data subject consent-based processing (Art. 6(1)(a) GDPR). |
|
d) |
Sending of advertising and promotional communications (e.g. newsletters, SMS, telephone calls, etc.), on the basis of the data provided by you and the purchases you have made, regarding the services offered by the companies of the Caronte & Tourist group, so-called profiled marketing. |
Data subject consent-based processing (Art. 6(1)(a) GDPR). |
|
e) |
Sending of advertising and promotional communications by third parties (Navigo Per Te Partners), so-called third-party marketing. |
Data subject consent-based processing (Art. 6(1)(a) GDPR). |
Necessity or Optional Nature of Processing
The processing of personal data for the purposes set out in letter a) is necessary for the establishment of the relationship with the Company/data controller; therefore, any refusal to provide such data in whole or in part may result in the impossibility of participating in the loyalty programme.
Providing the licence plate number of your vehicle/s is necessary in order to take advantage of certain benefits under the loyalty scheme (e.g. priority boarding); failure to do so will result in these benefits not being granted.
The provision of the VAT number or tax code is necessary for the issuance of the invoice, if requested, when purchasing tickets; failure to do so will result in the need to communicate said data at a later date.
Providing a complete mailing address is required for delivery of the physical fidelity card (Platinum level), if requested; failure to do so will prevent C&T from proceeding with delivery.
The provision of the ISEE certification, the certificate of residence and the copy of identity document is optional; failure to provide it will result in the inability of the additional benefits provided by the "ISEE formula".
The processing of personal data for the purposes set out in letter b) is necessary for the establishment of the relationship with the Company/data controller; therefore, any refusal to provide such data in whole or in part may result in the impossibility of participating in the loyalty programme.
The processing of data for the purposes set out in letters c), d) and e) above is optional; non-conferment will prevent the company, respectively, from implementing direct marketing initiatives, from implementing profiling and profiled marketing initiatives, communicating contact data to third parties for the implementation of direct marketing initiatives.
Any consent given in respect of purposes c), d) and e) is freely revocable at any time, without prejudice to the lawfulness of processing carried out prior to revocation. You may revoke your consent by accessing your reserved Area at www.carontetourist.it or by contacting the controller through the channels indicated in this policy.
Recipients of personal data
Personal data may be communicated, strictly in relation to the above-mentioned purposes, to the following subjects or categories of subjects:
- professionals or service companies for company administration and management who work on behalf of the company/data controller for its internal purposes (e.g. consultants);
- professionals or IT service companies and other technology partners of the Company/controller;
- professionals or social and community management service companies;
- professionals or printing companies to print the physical loyalty card;
- Navigo Per Te Partners;
- subjects in relation to which current legislation (e.g. tax and accounting) provides for mandatory reporting, including public bodies;
- Judicial and law enforcement authorities;
- Ticket offices, terminals and other retailers authorised to sell tickets;
- Law firms, in case any disputes arise;
- Insurance companies both when booking tickets and when making claims;
- Experts during complaint procedures;
- Companies providing other services that are essential to the provision of the shipping service or the performance of travel ticket sales and marketing activities, also subject to your express consent, such as the hosting of websites and web systems, e-mail services, and other promotions, auditing services, data analysis, conducting market research and approval surveys.
Processing methods
Personal data are collected by computer. The processing is carried out using IT or paper tools in compliance with the provisions on the protection of personal data and, in particular, with the appropriate technical and organisational measures referred to in Article 32.1 of the Regulation, and with the observance of all precautionary measures to ensure the integrity, confidentiality and availability of the data.
Personal data stored on computer databases are only accessible to identified persons, by means of personal access keys.
Data retention period
The data processed for the purposes referred to in letter a) will be kept until 31 December of the second year following the date of termination of the loyalty programme, unless the programme is extended, or upon termination of the programme membership status of the data subject for whatever reason (withdrawal, exclusion, etc.).
The data processed for the purposes referred to in letter b) will be kept until the date of termination of the loyalty programme, unless the programme is extended, or upon termination of the programme membership status of the data subject for whatever reason (withdrawal, exclusion, etc.).
Purchase data will be processed for the purposes set out in letters c) and e) until the consent given by the data subject is revoked and in any case for a period not exceeding 24 months from acquisition thereof, subject to possible anonymisation thereof.
Purchase data will be processed for the purposes set out in letter d) until the consent given by the data subject is revoked and in any case for a period not exceeding 12 months from acquisition thereof, subject to possible anonymisation thereof.
In the event that a dispute arises between the Company/data controller and the data subject, the retention terms will be extended for the duration of that dispute and for 10 years following its final settlement (e.g. settlement agreement or final judgment).
Rights of the data subject under Articles 15-22 of the EU Regulation - GDPR 2016/679
Pursuant to the relevant legislation, your rights and how to exercise them are listed below.
- Right of access - The data subject may ask at any time what kind of data is held by the data controller; the origin, purposes, categories of data; the recipients; the existence of a profiling process; the retention period.
- Right of rectification - The data subject may at any time request the rectification and/or supplementation of their data, and it shall be the duty of the data controller to communicate such changes to third parties to whom the data may have been transmitted.
- Right to be forgotten - The data subject may at any time request the deletion of the data if: the purpose of the processing has been fulfilled; consent has been withdrawn; an objection to the processing has been made; the data has been processed in breach of the law. It will be the obligation of the holder to communicate such changes to third parties to whom the data may have been transmitted.
- Right of restriction of processing - The data subject may at any time request that processing be restricted: in the case of inaccurate data until rectification; in the case of a dispute until clarification; upon request, as an alternative to erasure.
- Right to object - The data subject has the right to object to the use of personal data for automated processing.
- Right to portability - The data subject may exercise this right only with regard to data processed for contractual purposes and by automated means, and unless it infringes the rights and freedoms of others.
Methods of the data subject's request
The data subject may exercise the above rights at any time by sending an e-mail to: privacy.gruppo@carontetourist.it.
The data subject is entitled to lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority) on the basis of the indications given at https://www.garanteprivacy.it/garante/doc.jsp?ID=4535524 or to any other supervisory authority.
Caronte & Tourist S.p.A.