Information on the Protection of Personal Data (Pursuant to Article 13 and 14 of European Regulation No. 679/2016)

Rete Ferroviaria Italiana S.p.A. (hereinafter RFI), before acquiring your personal data in order to provide the assistance service at the station to passengers with disabilities or reduced mobility, invites you to read carefully the information regarding the protection of personal data.

In this section we indicate what are our references

• RFI, Data controller, represented by the Chief Executive Officer, can be contacted at the email address titolaretrattamento@rfi.it, with registered office in Piazza della Croce Rossa n. 1, Rome.
• The Data Protection Officer can be contacted at the email address protezionedati@rfi.it.

In this section we indicate the types of data we ask for

The personal data being processed fall within the following categories:

Personal data acquired directly by the interested party:

• Common: personal data (name, surname, address), contact details (e-mail, telephone contacts).
• Special: type of assistance needed by any person who has a permanent or temporary physical, mental, intellectual or sensory impairment, or whose mobility when using transport is reduced, pursuant to art. 3 (21) Regulation (EU) 2021/782. 

Such data can be acquired also through an accompanying person or other person requesting the service on behalf of the passenger with disabilities or reduced mobility.

The aforementioned data will be processed using computer and paper supports in order to guarantee suitable security and confidentiality measures.

In this section we indicate because we ask for your data

The personal data we ask you to provide in person or by telephone, e-mail or via the Sala Blu online web application available on the www.rfi.it site, or via the "Sala Blu +" smartphone app, are collected for the following purposes:

a) for the purpose of providing the assistance service at the station, based on a legal obligation of RFI, pursuant Regulation (EU) 2021/782;

b) for the purpose of managing your report or complaint in case you file reports or complaints, based on a legal obligation of RFI, pursuant Regulation (EU) 2021/782;

c) for the purpose of preventing fraudulent activities (the legal basis is the legitimate interest of RFI);

d) for the purpose of participation in statistical surveys/opinion surveys on the quality of the service (the legal basis is consent).

The provision of data necessary for the pursuit of purposes a), b) e c) is "mandatory" and its possible refusal could make it impossible for Rete Ferroviaria Italiana S.p.A. to provide the service. The provision of data necessary for the pursuit of purpose d) is "optional", therefore the missed confirmation will involve only the impossibility to be contacted to express your opinion about to the assistance service used, without prejudice to the purposes for which the provision of your data is "mandatory". The ways for the acquisition of consent may vary depending on the access channel to the services (telephone, web, e-mail, Sala Blu). The consent given may be freely revoked at any time, without prejudice to the lawfulness of the processing carried out before the revocation. The withdrawal of consent may be communicated by sending an email to the address privacy-dci@rfi.it.

In this section we show you who will process your data and to whom they will be communicated

For the pursuit of the aforementioned purposes, the personal data provided will be processed by the following subjects:

• Scope attributable to Rete Ferroviaria Italiana

Your personal data will be made accessible only to those who, within the Company, need it for the job performed or for the hierarchical position held. These subjects will be appropriately trained in order to avoid loss, access to data by unauthorized parties or to carry out unauthorized processing of the data. In addition, the data may be used by the following categories of subjects who perform instrumental activities on behalf of RFI:

• FS Italiane Group Companies which RFI belongs to for IT, administrative and accounting services;
• Contractor Companies that carry out the accompanying service to trains;
• Market surveys Companies (whereas the consent to participate to statistical surveys/opinion surveys on the quality of the service has been given).

These companies act as Processors on behalf of RFI and have signed a specific contract that expressly regulates the processes entrusted to them and the data protection obligations. 

• Scope not attributable to Rete Ferroviaria Italiana S.p.A.

Your personal data may also be transmitted to other autonomous data controllers, according to law or regulation (e.g. Public Authorities, Social Security Authorities, Judicial Authorities, Public Safety Authorities, etc.).

In addition, your data may be transmitted to other autonomous data controllers, Railway Undertakings, even foreign, and to Infrastructure Managers, even foreign (in case of transmission abroad, through a specific application provided by UIC - International union of railways, for requests for assistance to be carried out abroad).

The updated list of recipients of the data is available by requesting it at the e-mail address privacy-dci@rfi.it.

In this section we guarantee that your data will not be disclosed 

Your personal data will never be published, exposed or made available/accessible by undetermined subjects.

In this section we indicate to you how long we will keep your data

Purpose whose provision is obligatory:

• the personal data provided to us in order to provide the assistance service at the station will be retained for the period necessary for the management of the service, and in any case no later than 5 years from the provision of the service, and then made anonymous;
• the personal data you have provided to us for fraud prevention activities will be retained for a period not exceeding 5 years from the provision of the service;
• the personal data provided to us in case of reports or complaints about the assistance service in station will be retained for the period necessary for the management of the report or complaint, and in any case no later than 10 years, without prejudice to further retention in anonymous form for following purposes: archiving in the public interest, scientific or historical research, statistical purposes or technical reasons.

Purpose whose provision is optional:

• the personal data provided for the purpose of participation in statistical surveys/opinion surveys on the quality of the service will be retained for the period necessary for carrying out the statistical/opinion survey, and in any case no later than 3 years from the date of provision, without prejudice to your possible revocation of consent. Additionally, the personal data could be further retained, in anonymous form, for following purposes: archiving in the public interest, scientific or historical research, statistical purposes or technical reasons.

In this section we indicate to you which rights we guarantee

The EU Regulation 2016/679 (articles from 15 to 23) grants the data subjects the exercise of specific rights. In particular, in relation to the processing of your personal data, you have the right to request Rete Ferroviaria Italiana S.p.A.:

• The access: you can ask for confirmation whether or not there is a processing of personal data concerning you, as well as more clarification about the information referred to in this information notice.
• The rectification: you can ask to rectify or complete the data you provided us, if inaccurate or incomplete.
• The erasure: you can ask your data to be erased, if they are no longer necessary for our purposes, in case of withdrawal of consent or opposition to the processing, in case of unlawful processing, or if there is a legal obligation of erasure.
• The restriction: you can request your data to be processed only for the purpose of storage, with exclusions of other processing, for the period necessary to rectify your data, in case of unlawful processing for which you oppose the erasure, if you need to exercise your rights in court and the data we keep may be useful to you and, finally, in case of opposition to the processing and a verification is in progress whether our legitimate grounds override yours.
• The opposition: you can object at any time to the processing of your data, unless our legitimate grounds for proceeding prevail over yours, for example for our exercise or defence of legal claims.
• The portability: you can request to receive your data, or to have those data transmitted to another controller indicated by you, in a structured, commonly used and machine-readable format.

At any time you may request to exercise your rights to Rete Ferroviaria Italiana S.p.A. (Data controller), which can be contacted at privacy-dci@rfi.it, or by contacting the Data Protection Officer at protezionedati@rfi.it, or writing to the address P.zza della Croce Rossa n. 1 – 00161 Roma.

Furthermore, in case you consider that your rights have been infringed, you may file a complaint against the Supervisory Authority, which in Italy is the Italian Data Protection Authority.