Privacy Policy

INFORMATION ON THE PROCESSING OF PERSONAL DATA
This communication is made available to you - pursuant to art. 13 and 14 of the European Regulation 2016/679 regarding the protection of personal data ("Regulation" or "GDPR") - and is aimed at all interested parties in the processing of personal data carried out by CAVOURESE S.p.A.
The information is provided:

• to Visitors/users of the website www. girobus.it (“website or site”), acquired - independently or through third parties - via the site itself;
• to other interested parties, through specific information, based on the processing activities carried out by CAVOURESE S.p.A.

All data are processed in a lawful, correct and transparent manner towards the interested party, in compliance with the general principles established by EU Regulation no. 2016/679 and current legislation on the protection of personal data.

1. DATA CONTROLLER

The data controller, to whom you can contact to assert the rights referred to in the art. 8 subsequently referred to, is CAVOURESE S.p.A., Tax Code and Turin Company Register no. 00519860019, REA Turin n. 187789, VAT number 00519860019, tel. +390113970000, email privacy@cavourese.it. The Data Controller has designated a Data Protection Officer (DPO) who can be contacted at the email address privacy@cavourese.it.

2. SPECIFIC INFORMATION

CAVOURESE S.p.A has prepared and makes available on its website specific information for the different processing purposes:

• Customer information;
• Customer Rental Information;
• Customer Information BIP Card;
• Video surveillance information;
• Information about candidates for job positions;
• Supplier information.

3   PROCESSING OF PERSONAL DATA OF VISITORS AND USERS OF THE WEBSITE

3.1 TYPES OF DATA COLLECTED
The website offers informative and sometimes interactive content. While browsing the Site, you will be able to acquire information about the visitor in the following ways:

Browsing data
The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified interested parties, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users who connect to the site, the addresses in URI (Uniform Resource Identifier) ​​notation of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the user's IT environment. These data are used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning and are deleted immediately after processing. The data could be used to ascertain responsibility in case of hypothetical computer crimes against the site.

Data Provided Voluntarily by the User
We do not collect or use personal information about visitors to the website. The only exception concerns the personally identifiable information necessary to process the user's contact requests and comply with the contractual obligations to provide services to the user.
The optional, explicit and voluntary sending of emails to the addresses indicated on this site involves the subsequent acquisition of the sender's email address, as well as any other personal data entered, necessary to respond to requests.
The forms on the site collect identification and contact data, provided voluntarily by the user. . Failure to provide them may make it impossible to obtain what is requested. The Owner will use this information only to respond to user requests and to provide the requested services.

3.2 PURPOSE AND LEGAL BASIS OF THE PROCESSING

The processing of Users' personal data is carried out for the following purposes:

a) guarantee access to the Site, navigation, use of the online services made available in connection with the Site itself;
b) subject to the User's consent, for the purposes of information and commercial promotion of the Owner's services. o Group companies;
c) assessment of responsibility in case of hypothetical computer crimes against the site.

The legal basis of the processing consists of:

• for the purposes referred to in points a), the processing of the interested party's requests or the execution of pre-contractual measures;
• for the purposes referred to in point b), by the consent freely expressed by the interested party;
• for the purposes referred to in point c), by the legitimate interest of the Data Controller.

3.3    METHOD, PLACE AND DURATION OF PROCESSING

Personal data is processed using IT and/or telematic tools. The processing is carried out using organizational methods and with logic strictly related to the purposes indicated.
The Data Controller has implemented technical and organizational measures to provide an adequate level of security and confidentiality to personal data. These measures take into consideration the state of the art of the technology, the costs of its implementation, the nature of the data and the risks associated with its processing. The purpose is to protect data from accidental or unlawful destruction or alteration, accidental loss, unauthorized disclosure or access, and from other unlawful forms of processing.
The data is processed at the operational offices according to which the Company is organized, and at companies appointed and duly appointed as Data Processors.
The data processing is carried out for the time strictly necessary to pursue the aforementioned purposes, without prejudice to any retention terms provided for by law or regulations.

3.4    CATEGORIES OF SUBJECTS TO WHOM THE DATA MAY BE COMMUNICATED

The data collected by the Data Controller will be shared only for the above purposes; we will not share or transfer your personal data to third parties other than those indicated in this Policy. In the course of our activities and exclusively for the same purposes as those listed in this Policy, your personal data may be transferred to the following categories of recipients:

• hosting providers, IT companies, communication agencies, third party technical services;
• people, companies or professional firms that provide assistance and consultancy to the Data Controller in accounting, administrative, legal, tax and financial matters;
• subjects whose right to access the data is recognized by legal provisions or orders from the authorities.

These subjects are also appointed, if necessary, as Data Processors by the Data Controller. The updated list of Managers can always be requested from the Data Controller.

3.5    USERS' RIGHTS WITH REGARD TO THEIR PERSONAL DATA

The interested party, i.e. the natural person to whom the personal data refers, has the right to ask the Data Controller to access their personal data, to rectify or delete them, as well as to request the limitation or oppose their processing . The interested party is also the holder of the right to data portability. To exercise these rights you can refer to the contacts indicated in this information.
All requests received will be processed and verified in accordance with what is specifically provided for by the applicable rules, also with reference to the actual existence of the conditions for their acceptance. In the absence of such existence, the Data Controller may not follow up on the requests. The Data Controller makes every effort to respond to legitimate and well-founded requests within one month of their receipt. Depending on the complexity and number of requests, as well as what is indicated above, this deadline may be extended by two months. Upon the final outcome of the management of the request and against the same, the interested party has the possibility to lodge a complaint with the supervisory authority www.garanteprivacy.it and to lodge a judicial appeal.

Policy Policy: Rev. 01/16/2024