In this section we indicate our points of contact
 

• The Data Protection Officer can be contacted at protezionedati@rfi.it

In this section we indicate what type of data we request

The personal data processed fall into the following categories:
 

Personal data of the claimant-reporter/user:

• Common data of those who submit the claim/report: personal data (name, surname, address), contact details (e-mail).
• Common data of the user (if different from the person submitting the claim-report) and of any other passengers: personal data (name and surname), copy of the identity document.
• Optional Data: telephone contacts.

• Special Category Data: based on the nature of the subject of the claim/report submitted by you, RFI may become aware of data belonging to so-called "special" categories (for example data relating to health). In consideration of the fact that such data have been made available to RFI manifestly and freely, you are not required to give explicit consent for case management. RFI assures you that such data will be processed exclusively for purposes strictly connected and instrumental to the management of the case itself. 

In this section we indicate why we ask for your data
 

The data we ask you to provide through the RFI Responds portal are collected solely for managing your claim or report.

More specifically, your data are processed for the following purposes:

• a. Claim case management (Legal basis: Contractual)
• b. Report case management (Legal basis: Legitimate Interest)
• c. Transmission of the claim also containing any special category data to the pertinent entities who enters into specific Protocols with RFI (Legal basis: legal - Resolution ART. 28/2021 measure 5.2 and art. 9 par. 2 lett. g) GDPR)
• d. Transmission of the report also containing any special category data to the pertinent entities who enters into specific Protocols with RFI (Legal basis: consent)
• e. Improvement in claim/report management in the event of communication difficulties and/or speeding up response times through the telephone contact details provided by the data subject (Legal basis: Consent)

The provision of data for the pursuit of the purposes referred to in points a), b) and c) is of a "mandatory" nature, therefore its refusal will make it impossible for RFI SpA to manage the application. 

The provision of the data necessary for the pursuit of the purpose referred to in point d) is "optional", therefore failure to provide it will make it impossible for RFI SpA to transmit the report. 

The provision of the data necessary for the pursuit of the purpose referred to in point e) is "optional", therefore failure to provide it will only make it impossible for RFI S.p.A. to improve the management of the application in the event of communication difficulties and/or to speed up response times.

Any consent given may be revoked at any time, without prejudice to the lawfulness of the processing carried out before revocation. Revocation of consent may be communicated by sending an e-mail to: privacy-rfirisponde@rfi.it. 

In this section we indicate who will process your data and to whom they will be disclosed
 

To achieve the above purposes, the personal data provided will be processed by the following:

> Processed by Rete Ferroviaria Italiana S.p.A. 

• FS Technology S.p.A. (for computer services)

Your data will be processed solely by parties expressly authorised by Rete Ferroviaria Italiana S.p.A. or by companies acting as Data Processors, on behalf of Rete Ferroviaria Italiana S.p.A., and which have signed an appropriate contract clearly governing the processing assigned to them and their data protection obligations.

Your personal data will be made accessible only to those persons within the company who need them because of their duties or their hierarchical position. Such persons will be suitably trained in order to prevent loss, access to the data by unauthorised persons or unauthorised processing of the data.

> Not processed by Rete Ferroviaria Italiana S.p.A.

Your personal data may also be transmitted to other autonomous entities who are data controllers or joint controllers as far as they are concerned (e.g.: Station service managers, railway undertakings, public authorities, judicial and public safety authorities, etc.).

An updated list of data recipients is available by e-mail from privacy-rfirisponde@rfi.it. 

In this section we assure you that your data will not be disseminated
 

Your personal data will never be published, displayed or made available to/consulted by unspecified persons.

In this section we indicate what your rights are
 

The EU Regulation 2016/679 (Articles 15 to 23) confers specific rights on data subjects. In particular, in relation to the processing of your personal data, you have the right to request from Rete Ferroviaria Italiana S.p.A. relating to access, rectification, erasure, restriction, objection and portability. You may also lodge a complaint against the Control Authority, which in Italy is the Italian Data Protection Authority.

At any time, you may contact Rete Ferroviaria Italiana S.p.A. to exercise your rights at privacy-rfirisponde@rfi.it or by emailing the Data Protection Officer at protezionedati@rfi.it.