INFORMATION ON THE PROCESSING OF PERSONAL DATA FOR THE ISSUE OF THE SECOND HOME OWNER CARD

The company BN DI NAVIGAZIONE S.P.A. with registered office at CALATA ITALIA 24/A – 57037 – PORTOFERRAIO (LI) – VAT: 01968710994 PEC: [email protected]

The Data Controller may process, in summary but not exhaustively, the following types of your personal data:

– personal and contact details;
– front and back copy of your identity document;
– passport photo;
– data attesting to the requirements to benefit from the requested facilitation.

The personal data mentioned above will be processed, also by means of computer systems, for the following purposes:
a) for verifying the existence of the contractually required requirements to benefit from the requested facilitation;
b) for issuing the discounted ticket/subscription and/or the Card associated with it, necessary to proceed with the booking of trips at discounted rates at the Company’s ticket offices or through the online ticketing system;
c) for service communications relating to the subscription and/or the Card and the journey;
d) the copy of your passport photo in paper format will be acquired by scanning / digitization and uploaded into the Controller’s booking system and then the paper copy will be destroyed, it will be viewable, via tablet, by ground staff during boarding, in order to verify that you are indeed the passenger presenting boarding with the discounted ticket associated with your subscription and/or Card, other documents may be viewed at boarding by the personnel in charge as provided for in the respective general contract conditions;
e) for reporting any abuse in the use of the facilitation;
f) for the application of the penalties provided for by the contract in case of improper use of the facilitations;
g) for purposes related to obligations provided by law;
h) for sending commercial communications relating to the facilitations and additional services connected to the subscription and/or the Card; l) for the protection of the rights of the Controller.

The processing of your personal data for the purposes referred to in letters a), b), and c) of the previous point, has as its legal basis the execution of the contract. The processing of your personal data for the purposes referred to in letters d), e), and f) of the previous point, has as its legal basis the legitimate interest of the data controller to prevent unlawful use of the granted facilitations, a result prevailing over the subsequent compression of your right to privacy resulting from such processing. The processing of your personal data for the purpose referred to in letter g) has as its legal basis the legal obligations to which the Controller is subject. The processing of your personal data for the purpose referred to in letter h), in case of communications sent through the e-mail used by you to proceed with the request for facilitations, has as its legal basis art. 130 Legislative Decree 196/2003 (so-called soft spam). If the aforementioned communications are sent through other contact details, the legal basis justifying such processing is the legitimate interest of the Controller balanced with your interest in receiving communications relating to the granted facilitations. The processing of your personal data for the purpose referred to in letter i) has as its legal basis the legitimate interest of the Controller to protect its own rights. Such processing is not current but potential, so the Controller will proceed to carry out the relevant balancing when the need to carry out such processing actually arises, but before doing so.

Your personal data will be retained for the entire duration of the validity of the subscription and/or the Card linked to the granted facilitation and their deletion is foreseen at the end of this duration, unless other legal (e.g. tax) and non-legal (e.g. defense in court of a right of the Controller or third parties) obligations require longer retention periods.

The personal data you provide for the purposes described may be made known to or communicated to the following subjects:
(i) employees and/or collaborators of the Data Controller, as well as professionals and/or professional firms in charge of the administrative and accounting management of the contractual relationship;
(ii) public or private entities pursuing tax purposes, etc. (e.g. Revenue Agency, etc.);
(iii) public or private entities which, by virtue of legal provisions and/or an administrative or judicial measure, have the right to access them;
(iv) private subjects used by the Data Controller to pursue one or more of the purposes indicated in paragraph 3. In particular, copies of your identity document may be accessed via a tablet provided by the Company by the employees of the port company performing check-in operations at boarding;
(v) data processors used by the Data Controller for the execution of activities related to the execution of the service or companies used by the Data Controller for hosting and development of booking / administration services (SITRAP – SISTEMI TRASPORTO PERSONE SRL).

The Data Controller does not transfer personal data to third countries or international organizations. The list of “data processors” pursuant to art. 28 of the GDPR, if appointed, will be available at the Data Controller’s headquarters or can be requested by sending a written request to: [email protected]

The Data Controller has appointed a Data Protection Officer (“DPO”), whom you may contact to exercise your rights, as well as to receive any information regarding them and/or this Privacy Policy, by writing to: [email protected] or, by ordinary mail, by writing to the attention of the data protection officer at the legal headquarters of the Company, or by sending a certified email to the address PEC: [email protected]

Pursuant to Article 77 of the GDPR, if the data subject considers that the processing of their personal data violates EU Regulation 2016/679, they have the right to lodge a complaint with the supervisory authority, which in Italy is the Garante per la protezione dei dati personali (Italian Data Protection Authority), Piazza Venezia n. 11 – Scala B, 00187, Rome (RM) – www.garanteprivacy.it, or to bring the matter before the appropriate judicial authorities as provided for in Article 79 GDPR.