Dear passenger,

Autoservizi Salemi srl, represented by its legal representative at Via Salemi, 97 – 91025 Marsala (TP) VAT number 00058250812, as the Data Controller, wishes to inform you that Regulation (EU) 2016/679 "General Data Protection Regulation" – GDPR is a set of provisions harmonizing the protection of personal data across all EU member states. In accordance with Article 13 of Regulation (EU) 2016/679, we hereby provide you with this information which will allow you to understand all our policies regarding the processing of your personal data within the scope of the service offered to you by our company. 

1. Data Controller – Data Protection Officer (DPO) and Contact.
The Data Controller is Autoservizi Salemi S.r.l., VAT number 00058250812, headquartered at via Salemi n. 97, Marsala TP CAP 91025, telephone 0923981120, email privacy@autoservizisalemi.it, PEC g.marino@pec.autoservizisalemi.it. Data Protection Officer (DPO): Lawyer Angela Costa, email: acosta@ergon.palermo.it PEC: ergon.serviziodpo@pec.it. 

2. Purpose, methods of processing, and data retention period.
The data we request from you are: name, surname, contact telephone numbers/postal/email, purchased ticket, travel itineraries, data related to economic transactions, ID photo (only for subscription). Autoservizi Salemi S.r.l. only tracks data related to bank transactions that occur with users, excluding therefore the identification number and security code (CVV) of your debit/credit cards. Your data may be collected: - by phone; via email; through our website; through travel ticket sales platforms, which operate as independent Data Controllers for the pursuit of distinct purposes (see Opinion 1/2010 on the concepts of "Data Controller" and "Data Processor" Wp29); by our staff at our ticket offices, and will be used exclusively:

A. In order to allow you to receive and use our travel documents (ticket/subscription),
B. subsequently, to fulfill contractual obligations, execute the contract, and provide you with service information (schedule and itinerary changes);
C. for accounting and administrative purposes and to comply with tax and regulatory requirements;
D. to manage any complaints and disputes. 

The processing of your personal data for the purposes indicated in points A and B, being essential for the conclusion and execution of the contract, is a necessary requirement for the conclusion of the contract. Without it, we will not be able to establish and execute the contractual relationship. Therefore, the conclusion and execution of the transport contract constitute the legal basis for the processing of your data (Art. 6, para. 1, letter b, GDPR). Processing for the purposes indicated in points C and D is also essential and meets a legal obligation to retain data (Art. 6, para. 1, letter c, GDPR), as well as a legitimate interest of the Data Controller (Art. 6, para. 1, letter f, GDPR). After you have accepted the contract, your data will be stored in the controller's database.

Your personal data may be processed in paper, electronic, and telematic form and will be retained for the duration of the transport contract and, subsequently, for the time necessary to meet accounting, tax, and administrative requirements, as well as for a period considered reasonable to exercise the right of defense in the event of disputes and to comply with legal obligations, for a maximum period of ten years from the expiry of the contract (see in this regard Articles 2220, 2946 of the Civil Code). 

Your ID photos, after 2 years from the expiration of the subscription, no longer renewed, will be destroyed, both in electronic and paper format. 

3. Scope of communication and data dissemination.
Your personal data will be processed solely by the Data Controller and will be made known only to authorized personnel within the organization of the undersigned and their respective data processors. Among these are providers of telematic services, external consultants such as legal advisors, accountants, labor consultants, and other professionals. Autoservizi Salemi srl may also transmit your personal data in response to a subpoena, a search warrant, a court order, or in the event of other legal proceedings or requests from a supervisory authority, or in compliance with obligations provided for by law or regulatory provisions. In such cases, the legitimate interest in defense and legal obligations would represent the legal basis for data processing. Autoservizi Salemi srl does not intend to transfer your personal data to a third country, and our service providers are based within the European Economic Area (EEA). If this is not the case, we ensure that, according to the provisions of the GDPR, appropriate contractual, technical, and organizational measures are adopted, such as the standard contractual clauses approved by the EU Commission or in compliance with adequacy decisions taking into account the so-called "Schrems II Judgment of the Court of Justice of the European Union regarding the data transfer regime between the European Union and the United States, which invalidated the adequacy decision of the "Privacy Shield", adopted in 2016 by the European Commission following the expiry of the "Safe Harbor" agreement. 

4. Free transportation for law enforcement personnel.
In order to allow members of the law enforcement to benefit from our services and obtain the free "Ticket," as regulated by Decree No. 36/2020, it will be necessary to collect the following data: Department of affiliation - Identification Card Number - Route taken. These data are necessary to deliver the appropriate travel document and subsequently enable us to proceed with the bureaucratic process for reimbursements, therefore they will be communicated to the Regional Department for Infrastructure and Mobility. 

5. Data Subject Rights.
At any time, you have the right to exercise your rights against the Data Controller, Autoservizi Salemi Srl, through the designated email address privacy@autoservizisalemi.it (Right to request access to and rectification or erasure of personal data from the controller or restriction of processing concerning the controller or to object to their processing, right to data portability) specifically provided for in Chapter III of EU Regulation 2016/679. If you believe that the processing of your personal data violates current legislation, you have the right to lodge a complaint with the Italian Data Protection Authoritywww.garanteprivacy.itpursuant to art. 77 GDPR.