Processing methods

In relation to the aforementioned purposes, the information collected through the installation and use of cookies will be processed by using suitable electronic tools that can ensure the confidentiality of such information.
* * *
Privacy Policy pursuant to Art. 13 of Regulation (EU) 2016/679 (as well as pursuant to Art. 5.3 of Directive 2002/58/EC and Art. 122 Legislative Decree No 196 of 30 June 2003).

Identity and contact details of the Data Controller and of the Data Protection Officer

The Data Controller is FERROVIENORD S.p.A., with registered office at Piazzale Luigi Cadorna 14 - 20123 Milan (MI) (hereinafter also referred to as the 'Controller' or the 'Company'). The Data Protection Officer may be contacted by mail at the following address: P.le Cadorna 14/16, 20123 Milan, or by email: dpo@ferrovienord.it. Any request concerning personal data processed by the Company may be sent to its registered office or by writing to the following email address: dpo@ferrovienord.it.

Data processing purposes Legal basis of data processing

Purposes for which the data subject's consent is required (Article 6(1)(a) Regulation (EU) 2016/679). Exemption from consent pursuant to Article 95 of Regulation (EU) 2016/679, Article 5.3 of Directive 2002/58/EC and Article 122 Legislative Decree No 196 of 30 June 2003.
Data will be processed only for the purpose of transmitting communication over an electronic communications network, or to the extent strictly necessary to provide a service explicitly requested by the user.
Pursuant to Article 95 of Regulation (EU) 2016/679, Article 5.3 of Directive 2002/58/EC and Article 122 of Legislative Decree 30 June 2003, no. 196, consent is not required in relation to processing for the above-mentioned purposes.

Possible data recipients or possible categories of data recipients

In pursuance of the purposes set out in the previous paragraph, personal data may be accessed by the following recipients:
(a) persons authorised to process personal data under the direct authority of the Controller;
(b) the Data Processor indicated below: FNM S.p.A. as an IT service provider.

Transfer of data to a third country or an international organisation

Within the scope of the purposes identified above, the Controller may transfer the personal data of data subjects to an International Organisation or to countries belonging to the European Union and/or belonging to the European Economic Area, and/or to third countries outside the EU in order to fulfil the processing purposes indicated above. Such transfer will take place exclusively on the basis of and in accordance with Chapter V, Arts. 44 et seq. of the GDPR, which is deemed to be fully incorporated herein. The Controller will only authorise the processing of personal data outside the EU when data transfer is based on an adequacy decision of the Commission (Art. 45 GDPR). In the absence of a specific adequacy decision, Personal Data may only be transferred if appropriate safeguards have been provided, as set out in Article 46 of the GDPR, or in the cases expressly provided for in Article 49 of the Regulation.

Period of personal data storage

The data storage period is indicated at the link: .

Rights of data subjects

Right of access, rectification, erasure and restriction of processing

You have the right to request:
- access to your data (the right to obtain from the Controller confirmation as to whether or not personal data are being processed and, if so, to obtain access to the personal data and information concerning you, and, where personal data are transferred to a third country or international organisation, to be informed of the existence of appropriate safeguards in accordance with the legislation in force);
- rectification of data (the right to obtain from the Controller the rectification of inaccurate personal data concerning you, as well as, taking into account the purposes of the processing, to have incomplete personal data completed, including by means of providing a supplementary statement);
- erasure of data (the right to obtain from the Controller the erasure of personal data concerning you in the cases provided for by current legislation);
- restriction of processing (the right to obtain restriction of processing in the cases provided for by the applicable legislation; where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State).

Right to data portability

Where the processing is based on consent or on a contract and is carried out by automated means, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format and to transmit those data to another data controller.
In exercising your right to data portability, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
The exercise of the right to portability shall be without prejudice to the right to obtain the erasure of data.
This right does not apply to data processing that is necessary to carry out a task in the public interest or connected to the exercise of public powers vested in the Data Controller.

Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you in the event of processing necessary for the performance of a task carried out for reasons of public interest or in the exercise of official authority vested in the controller or processing necessary for the purposes of the legitimate interests of the controller or a third party, including profiling on the basis of such provisions.    Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such purposes, which includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes. In addition, where personal data are processed for scientific or historical research purposes or for statistical purposes, you have the right, on grounds relating to your particular situation, to object to processing of personal data concerning you, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

How to exercise your rights

Any request related to the exercise of the above-mentioned rights may be sent to the Data Controller at the contact details and addresses indicated above.

Right to withdraw consent

If the processing of your personal data or special categories of personal data is based on consent, you have the right to withdraw your consent at any time. In that case, any processing operations carried out before such withdrawal shall remain unaffected. Consent may be withdrawn by making a request to the Controller at the contact details and addresses indicated above.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the applicable legislation.

Nature of data provision and obligation to provide personal data and possible consequences of a refusal

The provision of data is not required. If you refuse the installation and use of cookies, the Website may have problems functioning; some operations might not be carried out or might be more complex and it will not be possible to achieve the purposes indicated above with reference to the individual cookies installed.