• Home

Information on the Protection of Personal Data

(Pursuant to Article 13 of European Regulation No. 679/2016)

Rete Ferroviaria Italiana S.p.A. (hereinafter RFI), before acquiring your personal data in order to provide the assistance service at the station to passengers with disabilities or reduced mobility, invites you to read carefully the information regarding the protection of personal data.

I. Data controller and DPO

In this section we indicate what are our references


  • RFI, Data controller, represented by the CEO pro tempore, can be contacted at the email address titolaretrattamento@rfi.it, with registered office in Piazza della Croce Rossa n. 1, Rome.
  • The Data Protection Officer can be contacted at the email address  protezionedati@rfi.it.
  • The Joint Data controller of the personal data, in the case of requesting the joint train/air assistance service at the Fiumicino Airport station, is ADR Assistance S.r.L to whom the essential content of the Data Protection agreement can be requested, signed with the Owner.

II. Types of personal data

In this section we indicate the types of data we ask for

The personal data being processed fall within the following categories:
Personal data acquired directly by the interested party:

  • Common: personal data (name, surname, address), contact details (e-mail, telephone contacts).
  • Special: data suitable for detecting the state of health, behavioral/psychological data, data suitable for detecting lifestyle habits (such as for example reasons of train use, such as work, tourism, etc.) or belonging to protected categories.

The aforementioned data will be processed using computer and paper supports in order to guarantee suitable security and privacy measures.

III. Purpose of the Treatment

In this section we indicate because we ask for your data

The personal data being processed fall within the following categories:
Personal data acquired directly by the interested party:

  1. The data we ask you to provide in person or by telephone, e-mail, fax or via the Sala Blu online web application available on the www.rfi.it site, or via the "Sala Blu +" smartphone app, are collected for the purpose of providing the assistance service at the station, based on a legal obligation of RFI (EU Regulation No. 2007/1371 and subsequent obligations).
    The provision of data necessary for the pursuit of the aforementioned purposes has "obligatory" nature and its possible refusal could make it impossible for Rete Ferroviaria Italiana SpA to provide the service.
  2. Furthermore, RFI may use your personal data for fraud prevention activities. This purpose, whose legal basis is the legitimate interest of RFI, implies the possibility of action by the competent structures of Rete Ferroviaria Italiana S.p.A. and other companies of the FS Italiane Group (legal, business protection, etc.), in order to combat any frauds.
    These purposes are "obligatory" and their possible refusal could make it impossible for Rete Ferroviaria Italiana SpA to provide the service.
  3. Finally, with your consent to be issued with the specific methods relevant to the channel through which the assistance service is requested, RFI may ask you to use your data for purposes of participation in market surveys on the quality of the service.
    The provision of data necessary for the pursuit of these last purposes is "optional", therefore the missed confirmation will involve only the impossibility to be contacted to express your opinion about to the assistance service used, without prejudice to the purposes for which the provision of your data is "obligatory".

The consent given may be freely revoked at any time, without prejudice to the lawfulness of the processing carried out before the revocation. The withdrawal of consent may be communicated by sending an email to the address privacy-dci@rfi.it.


IV. The recipients of the data

In this section we show you who will process your data and to whom they will be communicated

For the pursuit of the aforementioned purposes, the personal data provided will be processed by the following subjects:

Scope attributable to RFI

Your personal data will be made accessible only to those who, within the company, need it for the job performed or for the hierarchical position held. These subjects will be appropriately trained in order to avoid loss, access to data by unauthorized parties or to carry out unauthorized processing of the data.
In addition, the data may be used by the following categories of subjects who perform instrumental activities on behalf of RFI:

  • FS Italiane Group company which RFI belongs to.
  • IT services company: Almaviva S.p.A.
  • Companies that carry out the accompanying service to trains: Consorzio Nazionale Cooperative Pluriservizi - Società cooperativa.

These companies act as Processors on behalf of RFI and have signed a specific contract that expressely regulates the processes entrusted to them and the data protection obligations.

Scope not attributable to RFI

Your personal data may also be transmitted to other autonomous data controllers, according to law or regulation (eg Public Authorities, Social Security Authorities, Judicial Authorities, Public Safety Authorities, etc.) or on the basis of consent expressely provided by you, which will process your data as indicated in their Privacy Policy, which we invite you to read.
In addition, your data may be transmitted to other Railway Undertakings, even foreign (NTV, Trenord, FFS, OBB, SNCF, etc.) and to foreign Infrastructure Managers, in case of requests for assistance to be carried out abroad.
The updated list of recipients of the data is available by requesting it at the e-mail address privacy-dci@rfi.it.


V. Data disclosure

In this section we guarantee that your data will not be disclosed

Your personal data will never be published, exposed or made available/accessible by undetermined subjects.

VI. Data retention

In this section we indicate to you how long we will keep your data

Purpose whose provision is obligatory:

  • the personal data provided to us in order to provide the assistance service at the station will be retained for the period necessary for the management of the service, and in any case no later than 5 years from the provision of the service, and then transferred anonymously to a specific backup database
  • the personal data you have provided to us for fraud prevention activities will be retained for a period not exceeding 5 years from the provision of the service

Purpose whose provision is optional:

  • the personal data provided for the purpose of participation in market surveys on the quality of the service will be retained for the period necessary for carrying out the market survey, and in any case no later than 5 years from the date of provision.

VII. Rights of Interested Persons

In this section we indicate to you which rights we guarantee

The EU Regulation 2016/679 (articles 15 to 23) gives the interested parties the exercise of specific rights. In particular, in relation to the processing of your personal data, you have the right to ask RFI for access, rectification, cancellation, limitation, opposition and portability; furthermore, you may file a complaint against the Supervisory Authority, which in Italy is the Italian Data Protection Authority.

At any time you may request to exercise your rights to RFI, which can be contacted at privacy-dci@rfi.it or by contacting the Data Protection Officer at protezionedati@rfi.it.

At any time you can revoke the consent for optional treatments, without prejudice to the lawfulness of the processing based on the consent given before the revocation.