Protection of personal data
I. Data Controller and contact information.
The Data Controller is Ferrovie del Gargano S.r.l., with registered office in Bari, Italy, at Via Luigi Zuppetta 7/D – Tel. +39 080 5207311 – Fax 080 5207331, Certified Email (PEC): dg.fergargano@legalmail.it, VAT No. 04383720721.
Data Protection Officer – The Data Protection Officer is Dr. Luigi Pirro. Data subjects may contact the DPO for any questions regarding the processing of their data by sending a request to the following email address: responsabile.protezione.dati@fergargano.it
II. Treatment Methods
The Data Controller processes the personal data provided and/or collected from users using analog, computerized, and/or electronic means, adopting appropriate security measures to prevent unauthorized access to the systems and, consequently, their unauthorized disclosure, modification, or destruction.
Personal data is also processed in aggregate form, using organizational methods and procedures strictly suited to the purposes indicated in this policy. On some occasions, the data may be viewed by categories of persons authorized by the Data Controller, also known as data processors and involved in organizing the provision of services related to the website (such as, for example, administrative or sales staff, the marketing department, the legal department, or system administrators), or by external parties (third-party technical service providers, couriers, hosting providers) who will be appointed, if the Data Controller deems it necessary, as Data Processors. The updated list of Data Processors and persons in charge of processing may be requested by the data subject at any time and is available at the Data Controller’s registered office.
Please refer to the specific information provided during data collection for details on each processing operation, including, but not limited to (all the following documents are in Italian):
- AZ06 (Travel ticket sales). This refers to the marketing of travel tickets through POS or directly through FdG's direct channels.
- AZ16 (Issuing identification cards). This refers to the issuance of user identification documents and involves the creation, printing, and delivery of identification cards, whether paper or electronic (e.g., mycard). This includes any outsourcing of this activity to specialized third-party providers (e.g., Tecbus).
- SP16 (Traveller Control). Refers to the inspection activities of inspectors on board your vehicles to verify possession of travel tickets.
- GE03_W (Supplier Management). This refers to the processing of supplier data, which, once qualified, will be added to the Supplier Register.
- GE02 (Customer administrative management). This refers to the contractual management of customer relationships, such as customer registration, customer database management, management and/or archiving of invoices issued to customers and verification of related collections; and management of customer communications via available contact channels (ordinary correspondence, email, telephone).
- GE04_W (Accounting). Refers to accounting management with reference to the active and passive cycle. With reference to customers and suppliers, it refers to managing the timing of payments to suppliers and collections from customers;
- AZ15_W (Digital preservation). This refers to the compliant preservation of natively digital documents such as electronic contracts, electronic invoices, and certified emails.
- AZ11_W (Onboard WiFi Service). Refers to the provision of WiFi service on board the train.
- AZ12 (Ferrovie del Gargano App). This refers to the FDG app for selling travel tickets.
- EL09 (Tenders and Procurement). Management of tenders and contracts.
- EL12 (Management of e-procurement tender processes). Management of tenders using the e-procurement method required by law.
- GE09_W (Whistleblowing). Management of the internal reporting channel.
- SP02 (Customer Service and Complaint Management). Customer service activities and management of complaints submitted by users.
- SP10_W (Video Surveillance). Extended information on video surveillance at FdG offices.
- SP13 (Claims Management). Management of claims arising from the operation
III. Types of Data collected and purposes
a) Contact details
These data are requested from the User when completing the information request form on the Site and include: Name, Surname, Town/City, Nationality, City, Mobile Phone Number, Date of Birth and personal email and website and may be processed by the Data Controller for the following purposes:
- fulfill the User’s specific requests;
- implement the travel regulations, available on the staging.ferroviedelgargano.com website, and issue travel tickets electronically;
- with the User’s prior consent, provide commercial information on the products and services offered by the Data Controller;
- with the User’s prior consent, establish and manage commercial relationships, with particular reference to the purposes of commercial promotion, advertising communication, market research, surveys, statistical processing and marketing in the broad sense relating to products and services provided by the Data Controller, using both Automated Contact Methods pursuant to Article 130 of the Privacy Code (email, SMS, MMS, WhatsApp, fax, etc.) and Traditional Contact Methods (paper mail or calls with an operator);
- with the User’s prior consent, to detect their level of satisfaction and consent on the products and/or services offered, in relation to the analysis of purchasing habits and choices, as well as to the carrying out of market research choices carried out directly by the Data Controller.
The purposes referred to in the previous points 4) and 5) may also be achieved by the Data Controller through the use of cookies, as specified in point V of this information notice, prepared pursuant to the Provision of the Privacy Guarantor of 08.05.2014 “Identification of simplified procedures for the information and the acquisition of consent for the use of cookies“.
b) Navigation Data
The computer systems and software procedures used to operate the Site acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified individuals, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.
This category of data includes the IP addresses or domain names of the computers used by users connecting to the Site, the URI (Uniform Resource Identifier) ??addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (successful, error, etc.), and other parameters relating to the User’s operating system and IT environment.
This data is used solely to obtain anonymous statistical information on the use of the site and to verify its proper functioning. It is deleted immediately after processing. The data may be used to ascertain liability in the event of hypothetical computer crimes against the site. Except for this eventuality, the data is retained for the periods defined in Section IV of this policy.
c) Data provision
The provision of Contact Data, as per section III a) of this notice, is mandatory and failure to provide them, even partially, will make it impossible for the Data Controller to provide the requested services, as detailed in purposes III a.1 and III a.2.
Providing Registration data for all the purposes referred to in points III a.3, III a.4, and III a.5 is optional, and there are therefore no consequences if you refuse to provide it, other than the inability to inform you about promotional activities or verify your level of satisfaction.
The User assumes responsibility for the Personal Data of third parties communicated or shared through the website http://www.staging.ferroviedelgargano.com and guarantees that he or she has the right to communicate or disseminate them, freeing the Data Controller from any liability towards third parties.
Personal Data may be entered voluntarily by the User, or collected automatically while browsing the website https://www.staging.ferroviedelgargano.com.
IV. Place and duration of processing of the collected data
a) Place
The Data is processed at the operational headquarters of the Data Controller and the Data Processors, as well as any other places where the parties involved in the processing are located.
If personal data is transferred to a third country or to an international organization, the data subject will be informed of the existence of appropriate safeguards pursuant to Article 46 of the “Regulation” relating to the transfer.
For further information, please contact the Data Controller.
b) Duration of treatment and storage
The Data is processed for the time necessary to perform the service requested by the User, or required by the purposes described in this document, and the User can always request the interruption of the Processing or the deletion, updating and modification of the Data.
Data will not be retained for more than 24 months, limited to personal data and for marketing purposes only, in accordance with the relevant provisions of the Italian Data Protection Authority. For the exercise of the right of defense, however, the duration of processing will be equal to the expiration of the limitation period for the exercise of ordinary legal action.
V. Cookie Policy
This website does not use cookies, other than technical ones, and therefore the Data Controller is not required to provide appropriate information on their use.
a) Cookie Information
A cookie (literally “biscuit”) is a small, lightweight text file generated by web services to store user preferences, activities, and tastes. The cookie created by a service can be read and modified by the service itself to better personalize its user experience and, above all, to recognize the user when they return to the site.
Therefore, different information can be stored in the cookie for different purposes, but only if the user has enabled the installation of cookies in their browser preferences.
It should be noted that cookies are not and cannot be dangerous in the usual sense of the term: in fact, they cannot carry viruses or other types of malware. However, they can be used to track user behavior on websites that offer certain services.
Generally, cookies can be completely disabled in your browser settings at any time. For more information, we recommend reading the relevant help and support pages provided by their developers.
VI. Rights of the interested parties
The subjects to whom the Personal Data refers, in their capacity as Data Subjects, may exercise the rights pursuant to Articles 13, 14, 16, 17, 18, 19, 20, and 21 of the “Regulation” and, therefore, may, in summary:
- ask the Data Controller for access to personal data and to rectify or erase them or limit their processing or to object to their processing, in addition to the right to data portability;
- obtain from the Data Controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; e) the existence of the right to request from the Data Controller rectification or erasure of personal data or restriction of processing of personal data concerning him or her, or to object to such processing; f) the right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to their source; h) the existence of automated decision-making, including profiling, referred to in Article 22, paragraphs 1 and 4 of the Regulation and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject;
- Obtain from the Data Controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by providing a supplementary statement;
- Obtain from the Data Controller the erasure of personal data concerning him or her without undue delay. The Data Controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; 4.5.2016 L 119/43 Official Journal of the European Union EN, b) the data subject withdraws consent on which the processing is based according to Article 6(1)(a), or Article 9(2)(a) of the Regulation, and where there is no other legal ground for the processing; c) the data subject objects to the processing pursuant to Article 21(1) of the Regulation and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the Regulation; d) the personal data have been unlawfully processed; e) the personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; f) the personal data have been collected in relation to the offer of information society services referred to in Article 8, paragraph 1 of the Regulation;
- obtain from the Data Controller the restriction of processing when one of the hypotheses set out in Article 18 of the “Regulation” applies;
- receive the personal data concerning him or her, which he or she has provided to a Data Controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another Data Controller without hindrance, where: a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) of the “Regulation” or on a contract pursuant to Article 6(1)(b) of the “Regulation”; and b) the processing is carried out by automated means;
- Object at any time, on grounds relating to their particular situation, to processing of personal data concerning them pursuant to Article 6, paragraph 1, letters e) or f) of the Regulation, including profiling based on those provisions. The Data Controller will no longer process the personal data unless the Controller demonstrates compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims;
- Request the complete deletion of your data, exercising your right to be forgotten. The Data Controller reserves the right to retain only the necessary data in another database, separate from the one used for processing, in order to exercise your right to defense.
VII. Right of opposition
- Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
- If the data subject objects to processing for direct marketing purposes, the personal data can no longer be processed for such purposes.
VIII. Changes to this privacy policy
The Data Controller reserves the right to make any changes to this extended information by publishing them on this page.
In fondo alla presente sarà apposta la data di ultima modifica per consentire il tracciamento delle modificazioni stesse. Una copia di ogni versione della presente informativa è a disposizione degli Interessati presso la sede legale del Titolare.
If you do not accept the changes made, you may ask the Data Controller to remove your personal data. Unless otherwise specified, the previous privacy and cookie policy will continue to apply to personal data collected up to that point.
If you do not accept the changes made to this privacy policy, and without prejudice to the rights of the data subject referred to in the previous articles, you may request the Data Controller to remove your Personal Data. Unless otherwise specified, the previous privacy policy will continue to apply to Personal Data collected up to that point.
IX. Information about this privacy policy
The Data Controller is responsible for this privacy policy and the cookies stored by their services.
X. Regulatory references
Directive no. 95/46/EC, Directive 2002/58/EC, as amended by Directive 2009/136/EC, provision of the Privacy Guarantor no. 229 of 8 May 2014, Legislative Decree 196/2003, EU Regulation 2019/679.