(Pursuant to art. 13 of European Regulation no. 679/2016) 

Before acquiring your personal data for providing in-station assistance services to passengers with disabilities or reduced mobility, Rete Ferroviaria Italiana S.p.A. (hereinafter RFI) invites you to carefully read the information on personal data protection.

I. Data controller and DPO

In this section we indicate our points of contact

RFI, the Data Controller, represented by the pro-tempore Chief Executive Officer, can be contacted at titolaretrattamento@rfi.it, with registered office at Piazza della Croce Rossa 1, Rome.

  • The Data Protection Officer can be contacted at the email address protezionedati@rfi.it.
  • If joint rail/air assistance services are required at Fiumicino Airport, the Joint Data Controller, is ADR Assistance S.r.L., from which the main content of the Data Protection Agreement signed with the Data Controller can be requested.

 

II. Types of personal data

In this section we indicate what type of data we request

The personal data processed fall within the following categories:
Personal data acquired directly from the data subject:

  • Common: personal data (name, surname, address), contact details (e-mail, telephone contacts).
  • Special: data that can reveal state of health, behavioural/psychological data, data that can reveal life habits (e.g. reasons for using the train, such as work, tourism, etc.) or persons belonging to protected categories. 

The aforementioned data will be processed by computer and on paper in such a way as to guarantee appropriate security and confidentiality measures..

 

III. Purposes of the Processing

In this section we indicate why we ask for your data 

  1. The data, which we ask you to provide in person or by telephone, email, fax or via the Sala Blu on line web application available on the website www.rfi.it or by mobile app "Sala Blu +", are collected for the purpose of providing the in-station assistance service, in accordance with a legal obligation of RFI (EU Regulation no. 2007/1371, as amended).
    The provision of the data necessary to achieved the aforementioned purposes is "compulsory" and any refusal to do so may make it impossible for Rete Ferroviaria Italiana S.p.A. to provide the service.
  1. Furthermore, RFI may use your personal data in case you file reports or complaints regarding the assistance service in station, solely in order to manage your report or complaint; the legal basis is contractual. The provision of data necessary for the pursuit of the aforementioned purpose has "obligatory" nature and its possible refusal could make it impossible for Rete Ferroviaria Italiana SpA to manage your report or complaint.
  1. RFI may also use your personal data for fraud prevention activities. This purpose, whose legal basis is a legitimate interest of RFI, implies the possibility of action by the competent structures of Rete Ferroviaria Italiana S.p.A. and of the other Companies of the Italian FS Group (legal, corporate protection, etc.), in order to contrast possible fraud phenomena. 
    These purposes are "obligatory" and your refusal to provide the aforementioned data may make it impossible for Rete Ferroviaria Italiana S.p.A. to provide the service.

  2. Finally, with your consent - to be given in the specific manner relevant to the channel through which the service is requested - RFI may ask to use your data for the purpose of participating in market surveys on the quality of the service.
    The provision of data necessary for the pursuit of these last purposes is "optional", therefore the missed confirmation will involve only the impossibility to be contacted to express your opinion about to the assistance service used, without prejudice to the purposes for which the provision of your data is "mandatory".

Any consent given may be revoked at any time, without prejudice to the lawfulness of the processing carried out before revocation. Revocation of consent may be communicated by sending an email to privacy-dci@rfi.it.

 

IV. Data recipients

In this section we indicate who will process your data and to whom they will be disclosed

To achieve the above purposes, the personal data provided will be processed by the following:

Processed by RFI


Your personal data will be made accessible only to those persons within the company who need them because of their duties or their hierarchical position. Such persons will be suitably trained in order to prevent loss, access to the data by unauthorised persons or unauthorised processing of the data. Furthermore, the data may be used by the following categories of subjects who carry out ancillary activities on behalf of RFI:

  • Companies in the FS Italiane Group to which RFI belongs.
  • IT service companies: Almaviva S.p.A.
  • Companies providing escort services to trains: Consorzio Nazionale Cooperative Pluriservizi - Cooperative company.

These companies act as Data Processors on behalf of RFI and have signed a specific contract governing the processing operations entrusted to them and their data protection obligations.

Not processed by RFI

Your personal data may also be transmitted to other independent data controllers, on the basis of laws or regulations (e.g. Public Authorities, Social Security Institutions, Judicial Authorities, Public Safety Authorities, etc.) or on the basis of the specific consent you have provided, which will process your data as indicated in their privacy notices, which we invite you to read.
Furthermore, if assistance is required abroad, your data may also be transmitted to other railway companies, including foreign ones (NTV, Trenord, FFS, OBB, SNCF, etc.), and to foreign Station Managers. An updated list of data recipients is available by email from privacy-dci@rfi.it..

 

V. Data dissemination

In this section we assure you that your data will not be disseminated

Your personal data will never be published, displayed or made available to/consulted by unspecified persons..

 

VI. Data retention

In this section we indicate how long we will store your data 

Mandatory purpose:

  • The personal data you have provided us with for the purpose of providing the in-station assistance service will be kept for the period necessary to operate the service, which in no case will be no longer than 5 years from the date on which the service was provided, and will be subsequently transferred in anonymous form to a special backup database.
  • The personal data provided to us in case of reports or complaints about the assistance service in station will be retained for the period necessary for the management of the report or complaint, and in any case no later than 10 years from the filing of the report or complaint, without prejudice to further retention for archiving purposes in the public interest, scientific or historical research, statistical purposes or technical reasons (e.g. business continuity)
  • The personal data that you have provided us with for fraud prevention purposes will be kept for a period not exceeding 5 years from the date on which the service was provided.
     

Optional purpose:

  • The personal data provided for the purpose of participating in market surveys on the quality of the service will be kept for the period necessary to carry out the market survey, which shall in no case be longer than 5 years from the date on which they were provided..

 

VII. Rights of Data Subjects

In this section we indicate what your rights are

The EU Regulation 2016/679 (Articles 15 to 23) confers specific rights on data subjects. In particular, in relation to the processing of your personal data, you have the right to request from Rete Ferroviaria Italiana S.p.A. relating to access, rectification, erasure, restriction, objection and portability. You may also lodge a complaint against the Control Authority, which in Italy is the Italian Data Protection Authority.
At any time, you may ask to exercise your rights with Rete Ferroviaria Italiana S.p.A., which can be contacted at privacy-dci@rfi.it or by contacting the Data Protection Officer at protezionedati@rfi.it