PRIVACY POLICY “TRAMWAY RESTAURANT “ATMOSFERA”PURSUANT TO ARTS. 13 AND 14 OF EU REGULATION NO. 679/2016 (GDPR)DATA CONTROLLER AND CONTACTS
The Data Controller is Azienda Trasporti Milanesi S.p.A. (ATM), with registered office in Foro Buonaparte 61, 20121, Milan (Italy). The Data Protection Officer can be contacted at the following email address:
rpd@atm.itPURPOSE OF THE PROCESSING AND LEGAL BASIS
A. The purpose of the processing is the provision of catering service on dedicated vehicles. The legal basis is the performance of a contract to which the data subject is a party, or the execution of pre-contractual measures taken at the data subject’s request, pursuant to art. 6, paragraph 1, letter b) of EU Regulation No. 679/2016.
B. (Not mandatory) Marketing purpose. Participation in satisfaction surveys through web platforms to improve the service. For this purpose, a specific and explicit consent is required - pursuant to art. 6, paragraph 1, letter a) of EU Regulation No. 679/2016 - which is optional and may be withdrawn at any time. The questionnaires will be processed in an aggregate and anonymous form.
C. (Not mandatory) Sending newsletters. Sending newsletters via e mail containing updates about the service, initiatives, and any promotions. For this purpose, a specific and explicit consent is required - pursuant to art. 6, paragraph 1, letter a) of EU Regulation No. 679/2016 - which is optional and may be withdrawn at any time.
CATEGORIES OF DATA PROCESSED
Data processed are ordinary personal data: first name, last name, telephone number, e mail address, tax code and it may also be necessary to process special data regarding dietary habits, medical conditions and/or intolerances.
Personal data are processed by personnel authorized pursuant to Article 29 of the GDPR and Article 2 quaterdecies of the Italian Data Protection Code, by the data controller and may be communicated to companies that provide goods and/or services related to the processing. An example of these would be catering companies.
METHODS OF PROCESSING
The processing of personal data may also be carried out through automated and computerized procedures, by means of the operations of collection, recording, organization, storage, consultation, processing, alteration, selection, retrieval, comparison, use, interconnection, restriction, disclosure, erasure and destruction of the data. Furthermore, the data are processed solely for the purposes indicated above, in accordance with the principles of lawfulness, fairness, transparency, accuracy, integrity and confidentiality established by the applicable legislation. To manage the operations relating to online payment transactions, the data will be transmitted through a dedicated IT platform owned by third-party companies, which will process them autonomously as data controllers and in compliance with the applicable regulations.
DATA TRANSFER
No transfer of the personal data collected for the purposes set out above to third countries outside the European Economic Area or to international organizations is currently envisaged. Should such transfer become necessary, it will be carried out based on an adequacy decision pursuant to Article 45 of the GDPR, or, in the absence thereof, in compliance with the appropriate safeguards provided for under Article 46 of the GDPR.
DATA RETENTION PERIOD
The data will be kept with reference to the purpose referred to in point:
- A) for 5 years;
- B) and C) up to revocation of consent by the interested party.
PROVISION OF DATA
The provision of personal data is mandatory for purpose A), and any refusal to provide such data may result in the inability to use the service.
The provision of personal data is optional for purpose B), and any refusal to provide such data would make it impossible to receive marketing communications.
The provision of personal data is optional for purpose C), and any refusal to provide such data make it impossible to receive communications via e mail containing updates about the service, initiatives, and any promotions.
DATA SUBJECT RIGHTS
All the rights of the data subject are guaranteed in accordance with the provisions of Articles 15, 16, 17, 18, 20, 21, 22 and 77 of the GDPR:
• right of access to your personal data and all information on the processing carried out;
• right to rectification of inaccurate personal data and integration of incomplete data;
• right to erasure (‘right to be forgotten’);
• right to limit the processing of your personal data;
• right to data portability;
• right to object to the processing of your personal data;
• right not to be subject to a decision based solely on automated processing;
• right to lodge a complaint with the Italian Data Protection Authority in case a violation is thought to have been carried out.
In the cases mentioned above, where necessary, the Data Controller shall inform third parties to whom your personal data has been disclosed of any exercise of rights, except in specific circumstances (e.g., where such notification proves impossible or would require the use of means manifestly disproportionate to the protected right). Should the data subject believe that their rights have been infringed, they are entitled to lodge a complaint.
For further information, we invite you to consult the website of the Italian Data Protection Authority –
www.garanteprivacy.it – where a dedicated section on these rights is available.
METHODS FOR EXERCISING RIGHTS
You may exercise your rights at any time by:
- sending a registered letter with return receipt to the address of Data Controller;
- sending an email to: protezionedatipersonali@atm.it
