© 2022 - All rights reserved
PI IT09759321210
terms and conditions
Privacy Policy
Privacy Notice pursuant to Article 13 of the EU Regulation
2016/679 A. Why are we providing you with this document?
CITM (hereinafter the "Company") owner of the
the “CITM” brand considers the protection of data to be of fundamental importance
personal data of its own and/or potential clients and users, ensuring that the
processing of personal data, carried out by any means, whether
automated or manual, takes place in full compliance with the protections and
rights recognized by Regulation (EU) 2016/679 of the European Parliament and of the
Council, of 27 April 2016, concerning the protection of natural persons
with regard to the processing of personal data, as well as the free movement
of such data (hereinafter the "Regulation") and by the further applicable regulations
regarding the protection of personal data. The term "personal data" refers to
definition contained in Article 4, point 1) of the Regulation, that is
“any information relating to an identified or
identifiable; a natural person is considered identifiable who can be
identified, directly or indirectly, with particular reference to a
identifier such as name, an identification number, related data
to the location, an online identifier or to one or more characteristic elements
of his/her physical, physiological, genetic, psychic, economic identity,
cultural or social” (hereinafter the “Personal Data”).
The Regulation provides that, before proceeding with the
processing of Personal Data – with this term meaning, according to
the relevant definition contained in Article 4, point 2) of the Regulation,
“any operation or set of operations, carried out with or without the aid
of automated processes and applied to personal data or sets of data
personal, such as collection, recording, organization,
structuring, preservation, adaptation or modification, extraction,
consultation, use, communication by transmission, dissemination or
any other form of making available, comparison or
the interconnection, limitation, erasure or destruction” (of
hereinafter the “Processing”) – it is necessary that the person to whom such Data
Personal data belong to and are informed about the reasons for which such data are
requested and how they will be used.
To this end, this document aims to
to provide you, in a simple and intuitive way, all the useful information and
necessary so that you can provide your Personal Data in a way
aware and informed and, at any time, request and obtain
clarifications and/or corrections.
This information notice, therefore, has been drafted on the basis
of the principle of transparency and of all the elements required by the article
13 of the Regulation and is divided into individual sections (hereinafter "Sections" and
individually “Section”) each of which deals with a specific topic in
so as to make your reading faster, easier, and easier to understand (of
hereinafter the “Information Notice”).
If necessary, this Notice may be
accompanied by a specific form for granting consent as provided
from Article 7 of the Regulation, structured according to the further type of
use we intend to make of your Personal Data.
B. Who will process your Personal Data?
• CITM with registered office in Via G. Verga, 11, 80019 Qualiano NA, registered in the Naples Business Register, Tax Code
09759321210
(hereinafter the “Data Controller”)
will process your Personal Data for the main purpose of
referred to in Section D of this Notice and who, therefore, will play the role
as data controller according to the relevant definition contained
in Article 4, point 7) of the Regulation, "the natural or legal person,
the public authority, the service or other body which, individually or together
to others, determines the purposes and means of the processing of personal data.”
C. Who can you contact?
In order to facilitate relations between you, as a subject
data subject, that is, the “identified or identifiable natural person” to whom
refer to Personal Data pursuant to Article 4, point 1) of the
Regulation (hereinafter the "Data Subject") and the Data Controller, the
The regulation has provided, in some specific cases, for the appointment of a figure of
control and support that, among the various assigned tasks, also acts as a point
of contact with the Data Subject.
The Company has adopted this role of "person responsible for
data protection”, so-called “Data Protection Officer”, identifying and appointing,
pursuant to Article 37 of the Regulation, Mr. Giancarlo Romano Mascia (of
hereinafter the “DPO”).
The DPO, pursuant to and for the purposes of Article 39
of the Regulation, is called upon to carry out, inter alia, the following activities:
• inform and provide advice to the Data Controller
Processing, to the data controller as well as to the employees who carry out
the Processing regarding the obligations arising from the Regulation as well as from
other provisions of the Union or of the Member States relating to protection
of Personal Data;
• monitor and supervise compliance with the Regulation, of the
applicable regulations regarding the protection of Personal Data as well as
policies and procedures adopted by the Data Controller;
• provide support in responding to the Data Subject;
• cooperate with the Data Protection Authority
Competent Personal Data.
As provided for by Article 38 of the Regulation, you may
freely contact the DPO for any matters relating to the Processing
of your Personal Data and/or in case you wish to exercise your rights as
provided for in Section I of this Notice, by sending a communication
writing to the email address noleggio@romanobus.com or writing to the Data Protection Officer of CITM with registered office in Via G. Verga, 11, 80019 Qualiano NA, registered with the Naples Company Register, Tax Code
09759321210.
At any time you can consult the Privacy section
of the Website where you will find all the information
concerning the use and processing of your Personal Data, the references
detailed information about the Company, updated information regarding contacts and
communication channels made available to all Interested Parties by the
Data Controller.
D. For what main purpose will your data be processed
Personal Data?
The Data Controller, in order to allow your
registration on its own website www.romanobus.com (hereinafter the “Website”), if provided
the possibility to register, and/or the sending of information requests
by using the contact forms and/or subscribing to the newsletter service, you have
need to collect some of your Personal Data, as requested
within the registration form on the Website. The website of the
Data Controller for whom this Information Notice is issued
is www.romanobus.com
The processing of your Personal Data will be carried out by the
Data Controller in order to allow you, therefore, to access your profile,
participate in the initiatives promoted through the Website, receive
any newsletters, send information requests, request
inclusion in the Company's workforce through the submission of a curriculum vitae
life, as well as make use of all the other services, from time to time, offered
from the Website you registered on and/or within which you are
browsing; the Processing of your Personal Data will be legally based on
contractual relationship that will be established between you and the Data Controller
following your acceptance of the terms of participation on the Site
Internet.
To allow the Data Controller to carry out the
processing activities for the purposes mentioned above will require the
provision of Personal Data marked with the symbol * (asterisk) or
by the word "mandatory". In the absence of even one of the marked data,
it will not be possible to proceed with the Processing of your Personal Data and,
as a consequence, you will not be allowed to complete your registration on the Site
Internet and/or benefit from the services provided by it for which it is
a provision of Personal Data is required.
The Personal Data that will be requested from you for the
the pursuit of the above purposes will be those indicated in the form
of registration and/or contact, that is, by way of example and not
exhaustive: first name, last name, email address, telephone number of
fixed and/or mobile line.
E. Additional purposes
The Data Controller, with your prior express consent,
free and unequivocal pursuant to Article 6, paragraph 1, point a) of the
Regulation, may require you, in addition to the data mentioned above, further
Personal data such as, by way of example and not limited to, data relating to
tastes, preferences, habits, needs and consumption choices, for the following
purpose:
a. Direct marketing purposes: this term means
the Data Controller's intention to carry out activities towards you
promotional and/or marketing. All activities fall into this category
carried out to promote products, services, sold and/or provided by the Data Controller
Processing based on your legitimate interest in pursuing your own
corporate purpose.
b. Indirect marketing purposes: with this term
means the intention of the Data Controller to carry out, with respect to you
promotional and/or marketing activities on behalf of third parties. Included
in this category all activities carried out to promote products,
services, sold and/or provided by third parties with whom the Data Controller
Processing maintains legal relationships without there being, in this case
data communication.
c. Profiling purposes: this term refers to the
the Data Controller's intention to profile you, that is, to assess your preferences,
preferences and consumption habits also related to market surveys and
statistical analysis. Any form of
Automated processing of Personal Data to assess certain aspects
personal data such as, by way of example and not limited to,
professional performance, economic situation, personal preferences,
the interests, reliability, behavior, location or
movements.
The Processing of your Personal Data for the purposes of
for which points (b) and (c) cannot be carried out without obtaining your consent
which must necessarily comply with the conditions set out in Article 7 of the
Regulation, thus determining the lawfulness of the Processing of your
Personal Data.
Regarding the purpose of direct marketing referred to in
point (a), it should be specified that, by virtue of article 6, paragraph 1, point
f) of the Regulation, the Data Controller may carry out such activity
based on its legitimate interest, regardless of your consent and
in any case until your objection to such Processing as further specified
in Recital 47 of the Regulation in which it is "considered legitimate
interest in processing personal data for direct marketing purposes.” This will be
also possible following the evaluations carried out regarding any
and possible prevalence of your interests, rights and fundamental freedoms that
they require the protection of Personal Data on their legitimate interest in
send direct marketing communications.
The contact methods aimed at the activities of
direct, indirect and profiling marketing as in the previous points a, b and
c, they may be either automated (email, sms, fax, phone calls without
operator) is both traditional (operator phone calls, postal mailings).
In any case, and as further specified below in Section H, you may
revoke your consent, even partially, for example by consenting to
only traditional contact methods.
Regarding the contact methods that provide for
the use of your telephone contacts, we remind you that the activities of
direct marketing by the Data Controller will be carried out
subject to verification of your possible registration in the Opt-Out Register
as established pursuant to and for the purposes of Presidential Decree 7 September 2010, no.
178 and subsequent amendments.
F. To which entities your Data may be communicated
Personal?
Your Personal Data may be communicated to specific
subjects considered recipients of such Personal Data. In fact, Article 4
in point 9) of the Regulation, defines as the recipient of a Personal Data
“the natural or legal person, public authority, service or another
entity that receives communication of personal data, whether or not
third parties” (hereinafter the “Recipients”).
In this perspective, in order to correctly carry out all the
processing activities necessary to pursue the purposes referred to in the
present Information Notice, the following Recipients may find themselves in the situation
to process your Personal Data:
• third parties who carry out part of the activities of
Processing and/or activities connected and instrumental to the same on behalf of the
Data Controller. These subjects have been appointed as data processors
processing, meaning individually by this term, pursuant to
of article 4 at point 8) of the Regulation, “the natural or legal person,
the public authority, service or other body that processes Personal Data
on behalf of the Data Controller” (hereinafter the “Processor
Processing”);
• individual persons, employees and/or collaborators of the
Data Controller, to whom specific and/or multiple activities have been entrusted
of Processing of your Personal Data. These individuals have been instructed
specific instructions regarding security and proper use of Data
Personal and are defined, pursuant to Article 4, point 10) of the
Regulation, "persons authorized to process Personal Data under
the direct authority of the Data Controller or the Data Processor” (hereinafter
the “Authorized Persons”);
• where required by law or to prevent or suppress the
commission of a crime your Personal Data may be disclosed to
public entities or to the judicial authority without these being defined as
Recipients. In fact, pursuant to Article 4, point 9), of the Regulation, “the
public authorities that may receive communication of Personal Data
within the scope of a specific investigation in accordance with Union law or
of the Member States are not considered Recipients.”
The complete and always updated list of the Managers of the
however, the processing is available at the CITM headquarters located at Via G. Verga, 11, 80019 Qualiano NA, registered with the Naples Business Register, Tax Code
09759321210
G. How long will your Personal Data be processed?
One of the principles applicable to the Processing of your Personal Data
concerns the limitation of the retention period, governed by Article
5, paragraph 1, point e) of the Regulation which states “Personal Data are
stored in a form that allows the identification of the Data Subjects for a
time frame not exceeding the achievement of the purposes for which they are
processed; Personal Data may be retained for longer periods
provided that they are processed exclusively for archiving purposes in the
public interest, scientific or historical research or for statistical purposes,
in accordance with Article 89, paragraph 1, without prejudice to the implementation of measures
adequate technical and organizational measures required by this regulation for protection
of the rights and freedoms of the Data Subject.”
In light of this principle, your Personal Data will be
processed by the Data Controller only to the extent necessary for the
pursuit of the purpose referred to in Section D of this Notice.
In particular, your Personal Data will be processed for a period of time
equal to the minimum necessary, as indicated by Recital 39 of the Regulation,
that is, until the termination of the contractual relationships in place between you and the
Data Controller without prejudice to a further retention period that
may be imposed by legal provisions as also provided for by Recital 65
of the Regulation.
Regarding the processing carried out for the achievement
for the purposes referred to in Section E of this Notice, the Data Controller
the Controller may lawfully process your Personal Data until
you will not communicate, in any of the ways provided for in this Information Notice, the
your wish to withdraw consent for one or all of the purposes for which you
has been requested. Any withdrawal of consent will, in fact, require the Data Controller
of the Processing to cease the Processing activities of your Personal Data
for such purposes.
H. Is it possible to withdraw the consent given and how?
As provided by the Regulation, if you have given your
your consent to the Processing of your Personal Data for one or more purposes for
for which you have been asked, you may revoke it at any time
totally and/or partially without affecting the lawfulness of the Processing
based on the consent given before the withdrawal.
The methods for withdrawing consent are very simple and
intuitive, you just need to contact the Data Controller or the DPO
using the contact channels listed within this document
Information notice and respectively in sections C and I.
In addition to the above and for simplicity, should you
you find yourself in the situation of receiving email messages
advertising by the Data Controller that are no longer of your
if you are no longer interested, simply click on the “unsubscribe” button or
“unsubscribe me” or “unsubscribe” placed at the bottom of the same in order not to
no longer receive any communication even through additional channels of
contact for which your consent had been obtained (SMS, paper mail,
fax, phone calls).
I. What are your rights?
As provided for by Article 15 of the Regulation, you may
access your Personal Data, request its rectification and updating, if
incomplete or incorrect, request their deletion if the collection is
occurred in violation of a law or regulation, as well as object to the
Processing for legitimate and specific reasons.
In particular, we list below all your
rights that you may exercise, at any time, towards the Data Controller
of the Data Controller and/or Joint Controllers:
• Right of access: you will have the right, pursuant to
of Article 15, paragraph 1 of the Regulation, to obtain from the Data Controller
Processing the confirmation whether or not your Data is being processed
Personal and in that case, to obtain access to such Personal Data and to
the following information: a) the purposes of the Processing; b) the categories of Data
Personal data in question; c) the Recipients or categories of Recipients to whom the
your Personal Data has been or will be communicated, in particular if
Recipients from third countries or international organizations; d) when
if possible, the retention period of the Personal Data provided or, if
it is not possible, the criteria used to determine this period; and)
the existence of the Data Subject's right to request from the Controller
Processing the rectification or deletion of Personal Data or the limitation
of the Processing of Personal Data concerning him or to object to their
Processing; f) the right to lodge a complaint with a supervisory authority; g)
if the Personal Data are not collected from the Data Subject, all the
information available on their origin; h) the existence of a process
automated decision-making, including profiling referred to in Article 22,
paragraphs 1 and 4, of the Regulation and, at least in such cases, significant information
on the logic used, as well as the importance and expected consequences of such
Processing for the Data Subject. You can find all this information
within this Policy which will always be available to you
within the Privacy section of the Website.
• Right of rectification: you may obtain, in accordance
of Article 16 of the Regulation, the rectification of your Personal Data which
prove to be inaccurate. Taking into account the purposes of the Processing, moreover,
you may obtain the integration of your Personal Data that proves to be
incomplete, even by providing an additional statement.
• Right to erasure: you may obtain, in accordance
of Article 17, paragraph 1 of the Regulation, the deletion of your Data
Personal data without undue delay and the Data Controller will have
the obligation to delete your Personal Data, if even only one exists
for the following reasons: a) the Personal Data are no longer necessary in relation to the
purposes for which they were collected or otherwise processed; b) you have
proceeded to revoke the consent on which the Processing of your Data is based
Personal and there is no other legal basis for their Processing; c)
you have objected to the Processing pursuant to Article 21, paragraph 1 or 2 of the
Regulation and there is no longer any overriding legitimate reason to proceed
to the Processing of your Personal Data; d) your Personal Data has been
processed unlawfully; e) it is necessary to delete your Personal Data
to fulfill a legal obligation provided for by a community regulation or
domestic law. In some cases, as provided for by Article 17, paragraph 3 of the
Regulation, the Data Controller is entitled not to provide for the
deletion of your Personal Data if their Processing is
necessary, for example, for the exercise of the right to freedom of expression
and of information, for the fulfillment of a legal obligation, for reasons of interest
public, for purposes of archiving in the public interest, of research
scientific or historical or for statistical purposes, for the establishment, exercise or
defense of a right in court.
• Right to restriction of processing: you may obtain the
restriction of Processing, pursuant to Article 18 of the Regulation, in the event
in which one of the following situations occurs: a) you have contested the accuracy of the
your Personal Data (the restriction will last for the period necessary for the
Data Controller to verify the accuracy of such Personal Data); b)
the Processing is unlawful but you have objected to the deletion of your Data
Personally requesting, instead, that its use be limited; c) although the
Data Controller no longer needs it for Processing purposes, the
your Personal Data is used for the establishment, exercise or defense of a
right in court; d) you have objected to the Processing pursuant to
of Article 21, paragraph 1, of the Regulation and you are awaiting verification in
regarding the possible prevalence of the legitimate reasons of the Data Controller
Processing with respect to yours. In case of restriction of Processing, your
Personal Data will be processed, except for storage, only with
your consent or for the establishment, exercise, or defense of a right in
judicial office or to protect the rights of another natural person or
legal or for reasons of significant public interest. We will inform you, in any
case, before such limitation is revoked.
• Right to data portability: you may, at any time
moment, request and receive, pursuant to Article 20, paragraph 1 of the
Regulation, all your Personal Data processed by the Data Controller
and/or by the Joint Controllers in a structured, commonly used and
readable or request its transmission to another data controller
without impediments. In this case, it will be your responsibility to provide us with all the details
exact details of the new data controller to whom you intend to transfer your Data
Personal by providing us with written authorization.
• Right to object: pursuant to Article 21, paragraph 2
of the Regulation and as also reiterated by Recital 70, you may object, in
at any time, to the Processing of your Personal Data if these
are processed for direct marketing purposes, including profiling
to the extent that it is connected to such direct marketing.
• Right to lodge a complaint with the supervisory authority:
without prejudice to your right to appeal to any other administrative body or
jurisdictional, should you believe that the Processing of your Personal Data
conducted by the Data Controller and/or the Joint Data Controllers
occurs in violation of the Regulation and/or applicable law you may submit
complaint to the competent Data Protection Authority.
To exercise all your rights as identified above,
you just need to contact the Data Controller in the following ways
provided for in Section C of this Notice:
by writing to CITM with registered office in Via G. Verga, 11, 80019 Qualiano NA, registered with the Naples Business Register, Tax Code
09759321210 .;
• by sending an e-mail to the e-mail address
consorziostabilecitm@pec.it to the kind attention of the DPO.
L. Where will your Personal Data be processed?
Your Personal Data will be processed by the Data Controller
Processing within the territory of the European Union.
Should technical and/or operational issues arise
it becomes necessary to make use of entities located outside the European Union,
we hereby inform you that these subjects will be appointed as Data Processors
Processing pursuant to and for the purposes of Article 28 of the Regulation
and the transfer of your Personal Data to such subjects, limited to the
performance of specific Processing activities will be regulated in accordance
as provided for in Chapter V of the Regulation. Therefore, all
necessary precautions in order to guarantee the utmost protection of your Data
Personal data by basing such transfer: (a) on adequacy decisions of the countries
third recipients expressed by the European Commission; (b) on adequate safeguards
expressed by the third-party recipient pursuant to Article 46 of the
Regulation; (c) on the adoption of binding corporate rules, so-called corporate
binding rules.
In any case, you can request more details from the Data Controller
of the Processing if your Personal Data has been processed outside
of the European Union by requesting evidence of the specific safeguards adopted.
M. Changes and updates
The Company may modify or simply update, in
in whole or in part, the Privacy Policy of the site, also taking into account the
amendment of the laws or regulations governing this matter
and protect your rights. Changes and updates will be
notified to users on the Home Page of the website www.romanobus.com as soon as
adopted and will be binding as soon as they are published on the website. We invite you,
therefore, regularly access this section to check the
publication of the most recent and updated Privacy Policy.
To know your rights and always stay updated
on the regulations regarding the protection of individuals with regard to the processing of
personal data, you can visit the website of the Data Protection Authority
personal data at the address http://www.garanteprivacy.it
* * * * *
Last updated: 20/05/2021