INFORMATION ON THE PROCESSING OF PERSONAL DATA IN THE CONTEXT OF MEMBERSHIP TO EXCLUSIVE ITA AIRWAYS CLUBS pursuant to Article 13 of Regulation (EU) 2016/679 ("Privacy Policy")
1. DATA CONTROLLER
The Data Controller for the processing of your personal data carried out as part of your membership in the Exclusive Clubs of ITA Airways (hereinafter, also only "EXCLUSIVE CLUBS") is:
Italia Trasporti Aereo S.p.A. (ITA Airways S.p.A. in abbreviated form), in the person of its legal representative, domiciled at its registered office in via XX Settembre, No. 97, in Rome (RM), 00187, C.F. and P.I. 15907661001 (hereinafter “ITA Airways” or “Data Controller”).
2. WHAT PERSONAL DATA WE PROCESS
ITA Airways collects the following categories of personal data concerning you (with the term "Personal Data"meaning all the categories listed below, considered jointly):
Personal data, contact data and data related to identity – information relating to your name, surname and email address, as well as the information resulting from the copy of your identity card provided by you when joining the Exclusive Clubs.
Data relating to your enrollment in frequent flyer programs – information regarding your membership in a frequent flyer programs of one of the airlines listed for the purpose of joining the ITA Airways Exclusive Clubs, including in particular information about your status and the information resulting from the copy of the card of the frequent flyer programs of origin provided by you when joining the Exclusive Clubs.
3. HOW WE COLLECT YOUR PERSONAL DATA
ITA Airways collects and processes your Personal Data in response to the request to join the Exclusive Clubs you made by completing the online form in your personal area dedicated to the ITA Airways frequent flyer program called "Volare".
If you provide Personal Data on behalf of someone else – who has consented to it – you must ensure, in advance, that the interested parties have read this Privacy Notice.
Please help us keep your Personal Data updated, informing us of any changes to the contacts referred to in paragraph 12 of this Privacy Notice
4. FOR WHAT PURPOSES YOUR PERSONAL DATA MAY BE USED
Your Personal Data are processed by ITA Airways for one or more of the following purposes, on the basis of the legal basis indicated from time to time.
a) Operational management of your membership in the Exclusive Clubs and purposes strictly connected to this.
ITA Airways collects and processes your personal and contact data, as well as data relating to your enrollment in frequent flyer programs in order to: (i) follow up and manage your request to join the Exclusive Clubs (including, for example, in relation to the evaluation and management of any requests for maintenance of the status attributed in the program of origin); (ii) send you service communications functional to your status as a Member of the Exclusive Clubs and relating to the possible deadlines and/or benefits inherent to such membership; (iii) fulfill any contractual obligation and fulfill any requests relating to the Exclusive Clubs (including, for example, in relation to the request for information).
Legal basis for the processing of data: execution of a contract of which you are a party or execution of pre-contractual measures adopted at your request, pursuant to art. 6, par. 1, letter b) of the GDPR
b) Verification of your identity and the conditions for maintaining your status attributed in the program frequent flyer programs of origin.
ITA Airways collects and processes your identity data, as well as data relating to your enrollment in frequent flyer programs in order to verify that the personal data shown on the identity document provided by you with the application for registration to the Exclusive Clubs correspond to those on the membership program card. frequent flyer programs of origin provided by you with the application for registration to the Exclusive Clubs.
Legal basis for the processing of data: pursuit of a legitimate interest of the Data Controller in the prevention of fraud, pursuant to art. 6, par. 1, letter f) of the GDPR
c) Purposes related to the obligations established by laws, regulations or European legislation, by provisions/requests of Authorities legitimated by the law and/or by supervisory and control bodies
ITA Airways may process your Personal Data to fulfill legal obligations which ITA Airways itself is required to comply with.
Legal basis for the processing of data: fulfillment of legal obligations to which the Data Controller is subject, pursuant to art. 6, par. 1, letter c) of the GDPR
d) Defense of rights in the course of judicial, administrative or extrajudicial proceedings, and in the context of disputes arising in relation to its membership of the Exclusive Clubs and services related to such membership.
ITA Airways may process your Personal Data to defend your rights or act or even make claims against you or third parties.
Legal basis for the processing of data: pursuit of a legitimate interest of the Data Controller in the protection of their rights, pursuant to art. 6, par. 1, letter f) of the GDPR
5. COMPULSORY OR OPTIONAL NATURE OF DATA CONFERENCE AND CONSEQUENCES OF ANY REFUSAL TO PROVIDE DATA
The provision of your personal and contact data is mandatory as these data are necessary for your membership in the Exclusive Clubs; failure to provide such data will make it impossible to conclude the membership itself.
The provision of your identity data (as contained in your identity card) and data relating to your registration in frequent flyer programs, is mandatory for ITA Airways to follow up on your eventual request to maintain the status attributed in the program frequent flyer programs of origin.
6. HOW WE KEEP YOUR PERSONAL DATA SECURE
ITA Airways adopts appropriate security measures for the protection and maintenance of the security, integrity and accessibility of your Personal Data.
All your Personal Data are stored on secure servers (or secure hard copies) of ITA Airways or ITA Airways suppliers located in the territory of the European Union, and are accessible and usable according to our standards and security policies (or equivalent standards for our suppliers).
Where ITA Airways has provided (or you have chosen) a password that allows you to access your personal area of our Website, the applications or services we provide, you will be responsible for the secrecy of this password and for compliance with any other security procedure that we should indicate to you.
7. HOW LONG WE KEEP YOUR PERSONAL DATA
ITA Airways retains your Personal Data only for the time necessary to achieve the purposes for which it was collected or for any other legitimate related purpose. Therefore, if the Personal Data are processed for two different purposes, we will keep such Personal Data until the purpose with the longer term ceases, but we will no longer process the Personal Data for the purpose whose retention period has expired.
We limit access to your Personal Data only to those who need to process them for purposes relevant to your membership of the Exclusive Clubs.
Your Personal Data that are no longer necessary, or for which there is no longer a legal prerequisite for its conservation, are irreversibly anonymised (and thus can be stored) or destroyed in a secure manner.
Below are the storage times in relation to the different purposes listed above:
- personal and contact data, as well as data relating to your enrollment in frequent flyer programs which are processed for registration and the operational management of your membership in the Exclusive Clubs: ITA Airways will keep such personal data for the entire duration of your membership in the Exclusive Clubs and in any case no later than 10 years from the cancellation of your membership in the Exclusive Clubs in fulfillment of civil, accounting and tax obligations as required by applicable law.
- identity data (as resulting from the identity card you provided), as well as data relating to your registration in frequent flyer programs (as resulting from the card of frequent flyer programs of origin provided by you) that are processedto verify your identity and the conditions for maintaining your status attributed in the program frequent flyer programs of origin: ITA Airways will proceed to the immediate elimination of such personal data as soon as the verification of the foregoing is completed when evaluating your request for maintenance of the status and in any case no later than 48 hours after the verification.
With particular reference to the protection of ITA Airways' rights in court or in the event of requests from an authority, the Personal Data processed will be kept by ITA Airways for the time necessary to process the request or to pursue the protection of your rights.
8. WITH WHOM WE CAN SHARE YOUR PERSONAL DATA
Your Personal Data may be accessed by duly authorized ITA Airways employees, as well as ITA Airways' external suppliers who provide support for the provision of services related to your membership of the Exclusive Clubs, appointed, if necessary, data processors, or who act as independent data controllers.
The following persons or entities may also become aware of your Personal Data, for the purposes specified above:
subjects who can access Personal Data by virtue of the provisions of the law provided for by the law of the European Union or that of the Member State to which ITA Airways is subject;
banks and payment companies;
third parties such as law firms and public authorities to whom we contact in order to comply with the conditions for joining the Exclusive Clubs or to safeguard all our other legitimate interests;
third parties such as police and public authorities to protect our rights, or following a request validly made by them;
companies that offer IT infrastructures and IT assistance and consultancy services as well as the design and implementation of software and internet sites;
companies that offer useful services to customize and optimize our services, including those to provide and manage customer service.
Any communication of Personal Data will take place in full compliance with the provisions of the GDPR and the applicable legislation on the protection of personal data. Please contact us at the contacts referred to in paragraph 12 of this Privacy Notice if you wish to ask to view the list of data processors and other subjects to whom we communicate your Personal Data.
Your Personal Data will not be disclosed to third parties.
9. TRANSFER OF PERSONAL DATA TO THIRD-PARTY COUNTRIES
For the performance of some of the processing activities of your personal data, ITA Airways will communicate the same to external parties located in countries that do not belong to the European Union (EU) or the European Economic Area (EEA) (hereinafter, the "Third Party Countries") and which could guarantee a lower level of protection of your Personal Data than that guaranteed within the European Union.
The transfer, by ITA Airways, of your Personal Data to subjects located in Third Countries will in any case take place in compliance with the provisions of the applicable legislation on the protection of personal data and on the basis of one of the adequate guarantees provided for by art. 46 and following of the GDPR.
Depending on the role they play in relation to the processing, these subjects will process your Personal Data as independent data controllers, or as data processors duly designated by ITA Airways in accordance with art. 28 of the GDPR.
You can write to ITA Airways at any time, using the contact details referred to in paragraph 12 of this Privacy Notice, asking who are the subjects to whom the Personal Data is disclosed, as well as to receive a copy of the guarantees adopted for the transfer.
10. ANY AUTOMATED DECISION-MAKING PROCESSES
ITA Airways will not carry out treatments through automated decision-making processes, including profiling, in relation to your membership in the Exclusive Clubs.
11. YOUR RIGHTS IN THE FIELD OF DATA PROTECTION AND YOUR RIGHT TO MAKE COMPLAINTS BEFORE THE SUPERVISORY AUTHORITY
Under the conditions provided for by the GDPR, you have the right to ask ITA Airways at any time:
access to your Personal Data, as required by art. 15 of the GDPR,
the correction and integration of your Personal Data held by ITA Airways that you consider inaccurate, as required by art. 16 of the GDPR,
the cancellation of your Personal Data for which there is no longer any legal prerequisite for their processing, as required by art. 17 of the GDPR,
the limitation of the way in which we process your Personal Data if one of the hypotheses provided for in art. 18 of the GDPR,
the copy of your Personal Data that you have provided us, in a structured format, commonly used and readable by an automatic device for processing based on the contractual relationship (so-called portability), as required by art. 20 of the GDPR,
not to be subjected to decisions based solely on automated processing including profiling, which produce legal effects that affect you, if you have not given your prior consent, as required by art. 22 of the GDPR,
the withdrawal of your consent at any time, in the event that the processing is based on consent. It should be noted that any withdrawal of consent will take effect only with reference to subsequent processing, without prejudice to the lawfulness of the processing carried out prior to such withdrawal.
Right to object: in addition to the rights listed above, you always have the right to object at any time, for reasons related to your particular situation, to the processing of your Personal Data carried out for the pursuit of the legitimate interest of ITA Airways.
To exercise the aforementioned rights towards ITA Airways, you can direct your communication to the contacts referred to in paragraph 12 of this Privacy Policy, specifying: (i) your name and surname, (ii) your email address indicated when applying for membership of the Exclusive Clubs, and (iii) the details of the request.
The exercise of these rights is subject to some exceptions aimed at safeguarding the public interest (for example the prevention or identification of crimes) and our interests (for example the maintenance of professional secrecy). In the event that you exercise any of the aforementioned rights, it will be our responsibility to verify that you are entitled to exercise it and we will reply, as a rule, within one month.
If you believe that the processing of your Personal Data is in violation of the provisions of the GDPR and of the legislation on the protection of personal data, you have the right to lodge a complaint with the Guarantor for the protection of personal data, using the references available. on the website www.garanteprivacy.it or to take appropriate judicial offices.
12. CONTACTS OF ITA AIRWAYS AND THE DATA PROTECTION OFFICER ("RPD" or "DPO")
You may at any time contact ITA Airways or the Personal Data Protection Officer appointed by ITA Airways at the following addresses:
for ITA Airways – by sending a communication to the address listed in Article 1 of this Privacy Notice.
for the Personal Data Protection Officer appointed by ITA Airways – by sending an email to the email address: dpo@ita-airways.com.
