1. DATA CONTROLLER
The Data Controller for the processing of your personal data carried out as part of the loyalty program called "Volare" (the "Program") is:
Italia Trasporti Aereo S.p.A., in the person of its legal representative, domiciled at its registered office in via XX September, No. 97, in Rome (RM), 00187, C.F. and P.I. 15907661001 (hereinafter “ITA” or “Data Controller”).
2. WHAT PERSONAL DATA WE PROCESS
ITA collects the following categories of personal data concerning you (with the term "Personal Data" meaning all the categories listed below, considered jointly):
Personal and contact data - information relating to the name, surname, date of birth, gender, postal address, telephone number, mobile number, email address.
Transaction data – information regarding your transactions (transaction history) relating to the flight, the services purchased, the activities carried out and transactions concluded with the Program Partners.
Interests and data voluntarily provided by you – information you provide us about your travel preferences or other interests, the name of your company, your professional situation, how you prefer to be contacted, your participation in other airline loyalty programs or other data Personal.
3. HOW WE COLLECT YOUR PERSONAL DATA
ITA collects and processes your Personal Data in the following circumstances:
against your enrollment in the Program, using the form online, by accessing the section VOLARE of the website www.itaspa.com; or
against your registration to the mobile app of the Program, named ITA Airways, which also automatically entails your enrollment in the Program.
If you provide Personal Data on behalf of someone else – who has consented to it – you must ensure, in advance, that the interested parties have read this Privacy Notice.
Please help us keep your Personal Data updated, informing us of any changes to the contacts referred to in paragraph 12 of this Privacy Notice.
4. FOR WHAT PURPOSES YOUR PERSONAL DATA MAY BE USED
Your Personal Data are processed by ITA for one or more of the following purposes, on the basis of the legal basis indicated from time to time.
a) Operational management of your membership in the Program and purposes strictly connected to it.
ITA collects and processes your personal and contact data, data relating to transactions and your interests and the data you provide voluntarily in order to: (i) follow up and manage your application for registration to the Program; (ii) send you service communications functional to your status as a Member of the Program and relating to possible deadlines and/or benefits inherent to the Program itself; (iii) to fulfill any contractual obligations and to process your requests relating to the Program (including, for example, in relation to the request for rewards or information).
Legal basis for the processing of data: execution of a contract of which you are a party or execution of pre-contractual measures adopted at your request, pursuant to art. 6, par. 1, letter b) of the GDPR
b) Marketing to respond to your needs and to provide you with promotional offers also in line with your preferences.
Subject to your express and specific consent, ITA will process your personal and contact data as well as data relating to transactions for the purpose of marketing and advertising communication, aimed at informing you about promotional sales initiatives or for market research and statistical surveys by ITA. ITA will also process the aforementioned data to direct you to the promotional sales initiatives of the Program Partners, who act as independent data controllers. In this regard, ITA reserves the right to make available, on a dedicated page of its website, the updated list of Program Partners, currently being defined.
The sending of communications by marketing can take place either through automated contact methods (email, sms, instant messaging, social networks, push notifications and other mass messaging tools), and traditional methods of contact (for example, telephone call with operator). In this regard, you may at any time oppose the receipt of promotional communications made through one or more of the contact methods mentioned above.
Legal basis for the processing of data: your express and specific consent, pursuant to art 6, par. 1, letter a), of the GDPR; failure to provide such consent does not preclude or entail consequences for your membership in the Program.
You may at any time revoke your consent, with effect for subsequent processing, for the receipt of messages by email or other means:
• by clicking on the appropriate option at the bottom of each email received;
• by making a request to the contacts referred to in paragraph 12 of this Privacy Notice.
c) Profiling and enrichment of data.
Subject to your express and specific consent, ITA will process your personal and contact data, data relating to transactions and your interests, as well as the data you voluntarily provided and navigation data for profiling purposes, through a statistical processing of the aforementioned data. Personal based on the analysis of your interests, habits and purchasing choices or related to the use of the Site, in order to create your individual profile, also through information acquired from public sources or from Program Partners in order to develop, promote and provide ITA services and/or products in line with your needs and preferences to develop targeted digital campaigns.
Legal basis for the processing of datayour express and specific consent, pursuant to art. 6, par. 1, letter a) of the GDPR; failure to provide it does not preclude or imply consequences on your enrollment in the Program.
You may at any time revoke your consent with effect for subsequent processing, by making a request to the contacts referred to in paragraph 12 of this Privacy Notice.
d) Purposes related to the obligations established by laws, regulations or European legislation, by provisions/requests of Authorities legitimated by the law and/or by supervisory and control bodies
ITA may process your Personal Data to fulfill legal obligations which ITA itself is required to comply with.
Legal basis for the processing of data: fulfillment of legal obligations to which the Data Controller is subject, pursuant to art. 6, par. 1, letter c) of the GDPR
e) Defense of rights in the course of judicial, administrative or extrajudicial proceedings, and in the context of disputes arising in relation to the Program and related services.
ITA may process your Personal Data to defend your rights or act or even make claims against you or third parties.
Legal basis for the processing of data: pursuit of a legitimate interest of the Data Controller in the protection of their rights, pursuant to art. 6, par. 1, letter f) of the GDPR
5. COMPULSORY OR OPTIONAL NATURE OF DATA CONFERENCE AND CONSEQUENCES OF ANY REFUSAL TO PROVIDE DATA
The provision of the Personal Data requested in the Program registration form, marked with an asterisk (*), is mandatory since such Personal Data is necessary for your registration to the Program; failure to provide such Personal Data will make it impossible to complete the registration itself. The provision of further Personal Data, not marked with an asterisk (*), is optional and failure to provide it will not have consequences for your registration to the Program.
The provision of Personal Data for the purposes referred to in the previous one paragraph 4, letter a) of this Privacy Notice is mandatory as it is necessary for the execution of the contract; failing that, it will not be possible to allow you to enroll in the Program.
The granting of consent for the purposes referred to in paragraph 4, letters b) and c) of this Privacy Notice is optional and failure to provide it does not preclude or imply consequences regarding your membership in the Program, but would not allow us to promptly inform you of all the benefits reserved for Program members through commercial communications.
For the purposes referred to in paragraph 4, letters d) and e) of this Privacy Notice you are not required to provide a new and specific contribution, since ITA will pursue these additional purposes, where necessary, by processing the Personal Data collected for the purposes mentioned above, deemed compatible with this (also due to the context in which the Personal Data have been collected, the relationship between you and ITA, the nature of the Personal Data themselves and the adequate guarantees for their processing).
6. HOW WE KEEP YOUR PERSONAL DATA SECURE
ITA adopts appropriate security measures for the protection and maintenance of the security, integrity and accessibility of your Personal Data.
All your Personal Data are stored on secure servers (or secure hard copies) of ITA or ITA suppliers located in the territory of the European Union, and are accessible and usable according to our standards and security policies (or equivalent standards for our suppliers).
Where ITA has provided (or you have chosen) a password that allows you to access your personal area of our Website, the applications or services we provide, you will be responsible for the secrecy of this password and for compliance with any other security procedure that we should indicate to you.
7. HOW LONG WE KEEP YOUR PERSONAL DATA
ITA retains your Personal Data only for the time necessary to achieve the purposes for which it was collected or for any other legitimate related purpose. Therefore, if the Personal Data are processed for two different purposes, we will keep such Personal Data until the purpose with the longer term ceases, but we will no longer process the Personal Data for the purpose whose retention period has expired.
We limit access to your Personal Data only to those who need to process them for purposes relevant to the Program.
Your Personal Data that are no longer necessary, or for which there is no longer a legal prerequisite for its conservation, are irreversibly anonymised (and thus can be stored) or destroyed in a secure manner.
Below are the storage times in relation to the different purposes listed above:
- Personal and contact data, transaction data, data relating to your interests and data provided by you voluntarily that are processed for registration and operational management of the Program: ITA will keep such personal data for the entire duration of your enrollment in the Program and in any case no later than 10 years after the cancellation of the Program in fulfillment of civil, accounting and tax obligations as required by applicable law.
- Data relating to your interests, data provided by you voluntarily and data relating to transactions that are processed for profiling purposes: if you have given your consent to the processing of these personal data for profiling purposes, these data will be kept for 12 months from collection; however, ITA will periodically refresh your consent for this purpose in order to respect your choices
- Personal and contact data and data relating to transactions that are processed for the purpose of marketing: in case of processing of your Personal Data for purposes of marketing, which provides for the use of personal and contact data only, these will be kept for 24 months from collection within the database marketing however, ITA will periodically refresh your consent for this purpose in order to respect your choices.
- Navigation data: such Personal Data will be kept for as long as your “Volare” profile is active. The storage times of the various cookies possibly used can be consulted in the appropriate information cookies present at the following link.
With particular reference to the protection of ITA's rights in court or in the event of requests from an authority, the Personal Data processed will be kept by ITA for the time necessary to process the request or to pursue the protection of your rights.
8. WITH WHOM WE CAN SHARE YOUR PERSONAL DATA
Your Personal Data may be accessed by duly authorized ITA employees, as well as ITA's external suppliers who provide support for the provision of services connected to the Program, appointed, if necessary, data processors, or who act as independent data controllers.
The following persons or entities may also become aware of your Personal Data, for the purposes specified above:
subjects who can access Personal Data by virtue of the provisions of the law provided for by the law of the European Union or that of the Member State to which ITA is subject;
banks and payment companies;
third parties such as law firms and public authorities to whom we contact in order to comply with or apply the Program Regulations or to safeguard any other legitimate interest of ours;
third parties such as police and public authorities to protect our rights, or following a request validly made by them;
companies that offer IT infrastructures and IT assistance and consultancy services as well as the design and implementation of software and internet sites;
companies that offer useful services to customize and optimize our services, including those to provide and manage customer service;
companies that offer useful services for analyzing and developing data and processing and conducting market research.
Any communication of Personal Data will take place in full compliance with the provisions of the GDPR and the applicable legislation on the protection of personal data. Please contact us at the contacts referred to in paragraph 12 of this Privacy Notice if you wish to ask to view the list of data processors and other subjects to whom we communicate your Personal Data.
Your Personal Data will not be disclosed to third parties.
9. TRANSFER OF PERSONAL DATA TO THIRD-PARTY COUNTRIES
For the performance of some of the processing activities of your personal data, ITA will communicate the same to external parties located in countries that do not belong to the European Union (EU) or the European Economic Area (EEA) (hereinafter, the "Third Party Countries") and which could guarantee a lower level of protection of your Personal Data than that guaranteed within the European Union.
The transfer, by ITA, of your Personal Data to subjects located in Third Countries will in any case take place in compliance with the provisions of the applicable legislation on the protection of personal data and on the basis of one of the adequate guarantees provided for by art. 46 and following of the GDPR.
Depending on the role they play in relation to the processing, these subjects will process your Personal Data as independent data controllers, or as data processors duly designated by ITA in accordance with art. 28 of the GDPR.
You can write to ITA at any time, using the contact details referred to in paragraph 12 of this Privacy Notice, asking who are the subjects to whom the Personal Data is disclosed, as well as to receive a copy of the guarantees adopted for the transfer.
10. ANY AUTOMATED DECISION-MAKING PROCESSES
ITA does not use automated decision-making processes, including profiling, in the absence of your consent.
11. YOUR RIGHTS IN THE FIELD OF DATA PROTECTION AND YOUR RIGHT TO MAKE COMPLAINTS BEFORE THE SUPERVISORY AUTHORITY
Under the conditions provided for by the GDPR, you have the right to ask ITA at any time:
access to your Personal Data, as required by art. 15 of the GDPR,
the correction and integration of your Personal Data held by ITA that you consider inaccurate, as required by art. 16 of the GDPR,
the cancellation of your Personal Data for which there is no longer any legal prerequisite for their processing, as required by art. 17 of the GDPR,
the limitation of the way in which we process your Personal Data if one of the hypotheses provided for in art. 18 of the GDPR,
the copy of your Personal Data that you have provided us, in a structured format, commonly used and readable by an automatic device for processing based on the contractual relationship (so-called portability), as required by art. 20 of the GDPR,
not to be subjected to decisions based solely on automated processing including profiling, which produce legal effects that affect you, if you have not given your prior consent, as required by art. 22 of the GDPR,
the withdrawal of your consent at any time, in the event that the processing is based on consent. It should be noted that any withdrawal of consent will take effect only with reference to subsequent processing, without prejudice to the lawfulness of the processing carried out prior to such withdrawal.
Right to object: in addition to the rights listed above, you always have the right to object at any time, for reasons related to your particular situation, to the processing of your Personal Data carried out for the pursuit of the legitimate interest of ITA and for the processing carried out for the purpose of marketing, including profiling to the extent that it is connected to such marketing.
The exercise of these rights is subject to some exceptions aimed at safeguarding the public interest (for example the prevention or identification of crimes) and our interests (for example the maintenance of professional secrecy). In the event that you exercise any of the aforementioned rights, it will be our responsibility to verify that you are entitled to exercise it and we will reply, as a rule, within one month.
If you believe that the processing of your Personal Data is in violation of the provisions of the GDPR and of the legislation on the protection of personal data, you have the right to lodge a complaint with the Guarantor for the protection of personal data, using the references available. on the website www.garanteprivacy.it or to take appropriate judicial offices.
12. CONTACTS OF ITA AND THE DATA PROTECTION OFFICER ("RPD" or "DPO")
You may at any time contact ITA or the Personal Data Protection Officer appointed by ITA at the following addresses:
for ITA – by sending a communication to the address listed in Article 1 of this Privacy Notice.
for the Personal Data Protection Officer appointed by ITA – by sending an email to the email address: email@example.com.