Privacy Notice

Alilauro Gru.So.N. S.p.A. processes the personal data of its customers and passengers in compliance with Regulation (EU) 2016/679 (GDPR), Italian Legislative Decree No. 196 of 30 June 2003, as subsequently amended, and the confidentiality principles governing the company’s activities. Pursuant to Articles 13 and 14 of the GDPR and Article 13 of the Italian Privacy Code, Alilauro Gru.So.N. S.p.A. provides the following information on the use of personal data.

Data Controller

The Data Controller is Alilauro Gru.So.N. S.p.A., with registered office at Via Luigi de Maio 45, 80067 Sorrento (NA), Italy.

Personal Data Processor

Alilauro Gru.So.N. S.p.A. has appointed the following entity as Data Processor:

• Lauro Holding S.r.l. with registered office at Via del Governo Vecchio 3, Rome (RM), Lazio, Italy, for automated data processing and profiling activities for commercial and marketing purposes.

The complete and continuously updated list of entities to which data may be disclosed in their capacity as Data Processors may be requested through any of the communication channels made available by the company for exercising data-subject rights, as indicated below.

Purposes and legal basis of processing

During ticket booking and sales, boarding operations and the journey, Alilauro Gru.So.N. S.p.A. collects and processes data relating both to the customer (the ticket purchaser who enters into the transport contract) and to the passenger (each natural person named on the ticket and travelling on board).

The personal data collected is processed for the following purposes and on the corresponding legal bases:

• Management of pre-contractual activities: conducting business activities and managing relationships with data subjects. This processing is necessary to enter into and perform the contract to which the data subject is a party.
• Compliance with legal obligations: including obligations imposed by laws, regulations, European Union legislation and competent authorities, particularly in relation to safety and counter-terrorism. The legal basis is compliance with a legal obligation.

Alilauro Gru.So.N. S.p.A. also collects customer personal data to:

• Conduct market research.
• Purposes of marketing and commercial communications, by offering services and promotions tailored to customer preferences. In this case, the data subject’s explicit consent will be requested.

Categories of data collected and processing methods

Personal data processed for ticket booking, purchase and passenger boarding is collected directly from the data subject and/or from third parties (the customer). It belongs to the following categories:

• Identification data: first name, last name, sex, age or date of birth and nationality.
• Contact details: telephone number, email address and similar information.
• Health-related data of the passenger (falling within the special categories of personal data under Article 9 of the GDPR).

Nature of the provision of data

• Mandatory data: identification data and passenger nationality. This data is required to provide the service and to book and purchase a ticket. Refusal to provide it makes it impossible to provide the service.
• Optional data: passenger health-related data, such as disability information. Providing this data is optional, but withholding consent may affect service quality.
• Optional data for promotional purposes: contact details collected for marketing and market-research purposes. Providing this data is optional and does not affect the service supplied by Alilauro Gru.So.N. S.p.A.

Processing based on the data subject’s consent

For certain processing activities, Alilauro Gru.So.N. S.p.A. requests the data subject’s explicit consent:

• Processing of special-category data (for example, health-related data).
• Processing for promotional and commercial purposes: the customer may consent to processing for marketing and personalised offers. Consent may be withdrawn at any time as easily as it was given.

Disclosure and communication of personal data

Alilauro Gru.So.N. S.p.A. does not disseminate or disclose passenger personal data to third parties unless required to comply with legal obligations, administrative requirements or orders from public authorities.

Personal data may be accessed by Alilauro Gru.So.N. S.p.A. staff assigned to operational and commercial functions and by appointed external Data Processors.

Retention of personal data

• Data collected to provide the service: this data will be processed for the duration of the contract and stored in compliance with applicable legislation.
• Data collected for marketing and commercial purposes: data processed for direct marketing purposes, such as newsletters, will be processed for 24 months or until consent is withdrawn.

Transfer of personal data abroad

Alilauro Gru.So.N. S.p.A. does not transfer passenger data outside the European Union.

Data subject rights

Under Articles 15 to 20 of the GDPR, data subjects have the right to obtain:

• Confirmation as to whether their personal data is being processed.
• Access to their personal data.
• Rectification or erasure of their personal data.
• Withdrawal of consent.
• The right to lodge a complaint with the supervisory authority.

Right to lodge a complaint with the supervisory authority

In the event of a breach of the GDPR, the data subject has the right to lodge a complaint with the competent supervisory authority.