(pursuant to Articles 13-14 of EU Regulation 2016/679 – GDPR and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018)
The Data Controller is SEFIR srl, with registered office in Via de' Cattani 123, 50145 Florence.
The Data Controller is Mr. Alessandro Cammilli, who can be contacted at the email address alessandro.cammilli@sefir.it or by telephone at 055 3024781.
The processing of personal data is carried out in compliance with:
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (so-called GDPR);
Directive 2002/58/EC (ePrivacy Directive), as regards electronic communications services and commercial communications;
Legislative Decree 30 June 2003, n. 196 – “Personal Data Protection Code”, as amended by Legislative Decree 10 August 2018, n. 101, containing provisions for the adaptation of national legislation to the GDPR;
Provisions and guidelines of theItalian Data Protection Authority.
As part of its passenger transport business by car and bus, SEFIR srl may collect and process:
personal and contact details (name, surname, telephone number, email address, address);
payment and billing data;
data relating to reservations and service provision;
any special data (Article 9 GDPR), such as reduced mobility needs, provided voluntarily by the data subject.
Personal data is processed for the following purposes:
management of information requests and reservations;
provision of passenger transport service;
fulfillment of legal, tax and accounting obligations;
management of any disputes and protection of the Data Controller's rights;
sending commercial and promotional communications (subject to consent).
Pursuant to Article 6 of the GDPR, data processing is based on:
performance of a contract or pre-contractual measures requested by the data subject (Article 6, paragraph 1, letter b GDPR);
fulfillment of legal obligations (Article 6, paragraph 1, letter c GDPR);
legitimate interest of the Data Controller (art. 6, par. 1, letter f GDPR);
consent of the interested party for specific purposes (Article 6, paragraph 1, letter a GDPR).
Processing is carried out lawfully, fairly, and transparently, in compliance with the principles set forth in Article 5 of the GDPR, using both electronic and paper-based means, adopting appropriate security measures pursuant to Articles 32 et seq. of the GDPR.
Personal data may be communicated to:
personnel and collaborators of the Data Controller authorised to process data;
accounting, tax and legal consultants;
providers of IT, management and administrative services;
public authorities and supervisory bodies, within the limits established by law.
Data transfer outside the European Union is not foreseen.
The data is retained for a period no longer than necessary to achieve the purposes for which it was collected, in accordance with Art. 5, paragraph 1, letter e) of the GDPR and Italian regulatory obligations.
In particular:
administrative and tax data: up to 10 years, as required by Italian law;
Data collected for marketing purposes: until consent is revoked.
Pursuant to Articles 15-22 of the GDPR, the data subject has the right to:
access your personal data;
obtain rectification, updating or deletion;
request limitation of processing or object to it;
obtain data portability;
withdraw consent at any time (without affecting the lawfulness of the processing carried out before the withdrawal);
lodge a complaint with theItalian Data Protection Authority (www.garanteprivacy.it).
To exercise their rights, the interested party may contact the Data Controller, Mr. Alessandro Cammilli, at the contact details indicated above.
