Privacy Notice Pursuant to Article 13 of EU Regulation 2016/679 (GDPR)
Data Controller
Pursuant to Article 13 of EU Regulation 2016/679 (GDPR), Unitransports S.p.A., Via Zurigo 28/2, 20147 Milan, Italy, is the Data Controller of your personal data. The Data Controller informs you that the data provided by you in relation to existing legal and commercial relationships (user/data subject) will be processed in compliance with the above-mentioned regulation. Such processing will be carried out lawfully and in accordance with the principles set out in Article 5 of EU Regulation 2016/679.
Further information may be provided at a later stage, including verbally.
A Data Protection Officer (DPO) has not been appointed.
The updated list of Data Processors and persons authorized to process data is kept at the registered office of the Company.
Data Subject to Processing
Article 4 of EU Regulation 2016/679 defines “personal data” as any information relating to an identified or identifiable natural person (“data subject”). An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.
“Processing of personal data” means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure, or destruction.
The data processed specifically includes information voluntarily provided by you for the performance of legal and commercial relationships with the Data Controller, such as:
Data relating to individuals
- First and last name;
- Contact details including residential address, postal code, city, province/state;
- Telephone number;
- E-mail address.
Data relating to professionals, companies, and business entities
- Business and commercial activity data;
- Name/company name;
- Tax domicile;
- Registered office address;
- Operational office address;
- Telephone, fax, and e-mail details;
- Tax code or VAT number.
In addition, website navigation data may be collected. The IT systems and software procedures used to operate this website may acquire personal data during their normal operation, the transmission of which is inherent in the use of Internet communication protocols.
This data may include:
- IP addresses;
- Domain names of users’ computers;
- URI addresses of requested resources;
- Time of request;
- Method used to submit the request to the server;
- File size returned;
- Server response status code;
- Other parameters relating to the user’s operating system and IT environment.
Such data is used solely to obtain anonymous statistical information regarding website usage and to ensure its proper functioning. It is deleted immediately after processing unless required by authorities or in relation to alleged cybercrime offences.
Purposes of Processing
Subject to your specific consent, your personal data may be processed for the following purposes:
- Management of existing and/or future business and legal relationships;
- Fulfilment of obligations arising from such relationships;
- Organizational management of any existing or prospective contractual relationship;
- Compliance with legal, accounting, and tax obligations;
- Protection of contractual rights;
- Statistical analysis purposes;
- Marketing and commercial communication activities via e-mail or telephone regarding services provided by the Data Controller, including through business partners.
Data Retention Period
Personal data processed for purposes 1 to 6 will be retained for the period necessary to provide the services offered by the Data Controller and, in any case, for a maximum period of 10 years. After this period, the data will be deleted.
Personal data processed for administrative and accounting purposes will also be retained for a period not exceeding 10 years, in compliance with legal obligations.
Data processed for marketing purposes (purpose 7) will be retained for a maximum period of 2 years. For existing customers, this period may be extended only following contract renewal.
Consent may be withdrawn at any time.
Nature of Data Provision
The provision of personal data and consent to processing for purposes 1 to 6 is mandatory as it is necessary to comply with legal obligations and contractual requirements. Failure to provide such data will prevent the Data Controller from delivering the requested services.
Communications related to purpose 7 may be sent electronically or in paper form.
The provision of data and consent for marketing purposes is entirely optional.
Failure to provide data for marketing purposes will make it impossible to carry out activities such as sending newsletters and promotional communications regarding institutional activities.
Processing Methods
Data will be processed and stored exclusively for the above purposes through both paper-based and electronic systems.
Data will be included in relevant databases and processed through tools suitable for ensuring data integrity, security, and confidentiality in accordance with EU Regulation 2016/679.
Appropriate technical and organizational measures will be adopted to ensure a level of protection compliant with GDPR requirements.
Access will be restricted to persons specifically authorized in writing.
Data may also be collected from and/or disclosed to third parties where necessary for the performance of contractual obligations or legal requirements. Such parties will be formally appointed as Data Processors.
Social Media Platforms
The website may provide access to social networking services and platforms.
Unitransports advises users to exercise caution when sharing personal information through comments or public posts on such platforms.
The terms of use and privacy policies published by the relevant social media providers govern the information shared through those channels.
Unitransports does not control the use of personal data disclosed in public forums, comment areas, or message boards. Users remain solely responsible for any information they disclose publicly.
Cookies
In accordance with the Italian Data Protection Authority’s Provision of 8 May 2014, No. 229, cookies are divided into two main categories:
Technical Cookies
Technical cookies are used exclusively to transmit communications over an electronic communications network or to provide services explicitly requested by the user.
These include:
- Navigation or session cookies;
- Analytics cookies used in aggregated form;
- Functionality cookies allowing users to customize their browsing experience.
The installation of such cookies does not require prior user consent, although the information obligations under Article 13 GDPR remain applicable.
Profiling Cookies
Profiling cookies are used to create user profiles and send advertising messages consistent with browsing preferences.
Due to their potentially intrusive nature, users must be adequately informed and provide valid consent before such cookies are installed.
Cookies may also store user preferences, authentication information, and browsing behavior for marketing and personalization purposes.
Restricting or deleting cookies may affect the functionality and availability of website services.
Disclosure of Data to Third Parties
For the purposes described above, personal data may be disclosed to external parties where necessary to:
- Fulfil legal obligations;
- Perform contractual obligations;
- Meet requests made by the data subject before entering into a contract.
Recipients may include:
- Supervisory authorities, judicial authorities, public administrations, professionals, and organizations involved in fulfilling legal, accounting, administrative, or management obligations;
- Banks, financial institutions, consultants, professional firms, and service providers whose involvement is required for the Data Controller’s business activities and contractual obligations.
Collected data will not be publicly disclosed.
International Data Transfers
Personal data will be transferred exclusively within Italy and the European Union.
Rights Under EU Regulation 2016/679
The data subject may exercise at any time the rights provided by Articles 15 and following of the GDPR, including:
- Right of access to personal data;
- Right to rectification;
- Right to erasure (“right to be forgotten”);
- Right to restriction of processing;
- Right to object to processing;
- Right to data portability;
- Right to withdraw consent at any time, where applicable;
- Right to lodge a complaint with the competent supervisory authority (Italian Data Protection Authority – Garante Privacy).
Contact Details of the Data Controller
To exercise the above rights, the data subject may submit a request to the Data Controller by e-mail to:
Unitransports S.p.A.
Via Zurigo, 28/2
20147 Milan
Italy
The updated list of external Data Processors is available upon specific request.
The data subject acknowledges having been informed of the rights provided by GDPR Articles 15 and following. Additional information regarding the processing of personal data may also be provided verbally at the time of data collection.