PASSENGERS PRIVACY POLICY

WEB PRIVACY NOTICE – Informative document pursuant to and for the purposes of Article 13, Reg. (EU) 2016/679

In accordance with Regulation (EU) 2016/679 (hereinafter “GDPR”), this page describes how personal data is processed. This is a notice provided pursuant to Article 13 of the GDPR. This notice is not to be considered valid for other third-party websites that may be accessed through links on this website, for which no responsibility is assumed.

Processable Personal Data

Personal data: any information concerning an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person (C26, C27, C30 GDPR).

 

Browsing Data

The IT systems and software procedures used to operate this site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This category of data includes the IP addresses or domain names of the computers and terminals used by users, the URI/URL (Uniform Resource Identifier/Locator) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), and other parameters related to the user’s operating system and IT environment.

 

Data Provided Voluntarily

The optional, explicit, and voluntary sending of messages to the contact addresses indicated on this site and/or the completion of data collection forms entails the subsequent acquisition of the sender’s address, necessary to respond to requests, as well as any other personal data provided.

Information on the Processing of Personal Data Through Social Media Platforms

Regarding the processing of personal data carried out by the managers of the Social Media platforms used by the Data Controller, please refer to the information provided by them through their respective privacy policies. The Data Controller processes the personal data provided by users through the dedicated Social Media platform pages to manage interactions with users (comments, public posts, etc.) in compliance with current regulations.

Specific Notices: Specific notices may be present on the Site’s pages regarding particular services or data processing provided.

COOKIES: For Cookies and other tracking systems, please see the cookie policy provided in the footer of the site and at the following link.

DATA CONTROLLER: Pursuant to Articles 4 and 24 of Reg. EU 2016/679, the Data Controller is AVIONORD SRL A SOCIO UNICO, with legal headquarters at Viale dell’Aviazione 65, 20138 Milan (MI), represented by the Legal Representative pro tempore.

PURPOSE | LEGAL BASIS | RETENTION PERIOD | NATURE OF THE CONFERRAL

 

PURPOSE OF PROCESSING 

LEGAL BASIS

DATA RETENTION PERIOD

NATURE OF THE CONFERRAL
A) Browsing this website

Activities strictly necessary for the operation of the site and the provision of navigation services on the platform. The data necessary for accessing web services will also be processed for the purpose of: • obtaining statistical information on the use of services (most visited pages, number of visitors by time slot or daily, geographical areas of origin, etc.); • monitoring the proper functioning of the services offered.

 Legitimate interest | rights of the data subject

Article 6 letter f) and Recital 47 of the GDPR: the processing is necessary for the pursuit of the legitimate interests of the data controller or of a third party..

 Until the duration of the browsing session and for a maximum of an additional 7 days (subject to any necessary investigations of crimes by the Judicial Authority) Necessary to ensure navigation
B) Analysis of navigation a through the use of cookies and comparable technologies.
Further information can be found in the cookie policy		 For cookies and comparable non-technical technologies that are necessary, the processing is based on consent for the processing of personal data (Article 6(1)(a) and C42, C43 of the GDPR). Consent is given through the banner and the cookie policy of the site. Further information within the cookie policy Further information within the cookie policy
C) Request for contact or information through phone contacts, dedicated forms, or similar systems Legitimate Interest | Interested Party Request

Art. 6 letter f) and Recital 47 of the GDPR: the processing is necessary for the pursuit of the legitimate interests of the data controller or of a third party.

 1 Year Necessary for the pursuit of the legitimate interest of the data controller, in accordance with the rights and fundamental freedoms of the user
D) Direct marketing for the distribution of advertising material or direct sales, or for conducting market research, commercial and promotional communication, newsletters, through automated means (email, SMS) and traditional means (telephone and postal mail). The communications may contain promotional activities and/or logos of third-party partners and companies belonging to the group. There will be no transfer of personal data.

For a complete list of the group companies and partners, you can write to the addresses provided below.

The Data Controller, in order to compare and potentially improve the results of automated communications, utilizes systems with reports. Thanks to these reports, the Data Controller can know, for example: the number of readers, openings, unique clickers, and clicks; the devices and operating systems used to read the communication; details on the activity of individual users; details of the emails sent, emails delivered and undelivered, and those forwarded.

 Consent to the processing of personal data
Art. 6 para. 1 letter a) – (C42, C43) GDPR		 Until the revocation of consent (or opt-out) The provision of data is optional. Failure to provide the necessary data will result in the inability to receive direct marketing communications.

 
E) Management of requests for the exercise of rights by data subjects pursuant to Article 15 et seq. of the GDPR (rights of the data subject) The processing is necessary to comply with a legal obligation to which the data controller is subject.

Art. 6 par. 1 lett. c) e (C45) GDPR

 5 years from the closure of the request, unless there are disputes The provision of personal data is mandatory, as it is essential for fulfilling legal obligations.


ECIPIENTS OR CATEGORIES OF RECIPIENTS OF DATA

Personal data will be communicated, based also on the purposes provided in specific areas, to subjects who will process the data as Autonomous Data Controllers or Data Processors (Art. 28 GDPR) and processed by natural persons (Art. 29 GDPR) acting under the authority of the Data Controller and Processors based on specific instructions provided regarding the purposes and methods of processing, for specific purposes based on the relevant area.
The data will be communicated to recipients belonging to the following categories:

  • Subjects providing services for the website and communication networks, including email, hosting, and platform management;
  • Subjects providing consulting and assistance services;
  • Subjects providing services related to the management of the previously mentioned processing purposes;
  • Subjects based in Italy, with whom the Data Controller has signed agreements and prior consent, where required;
  • For the “Work with Us” section, to subjects for managing selection activities;
  • Competent authorities for compliance with legal obligations and/or provisions of public bodies, upon request.

The list of Data Processors is available by writing to: privacy@avionord.com

TRANSFER OF DATA TO A THIRD COUNTRY AND/OR AN INTERNATIONAL ORGANIZATION

Personal data will not be transferred to non-EEA countries. It is specifically noted that the data will be stored in Italy for hosting, management, development, and maintenance services of the site. All third parties to whom the data may be communicated are based in Italy.

AUTOMATED PROCESSES

Personal data will be subjected to traditional manual, electronic, and automated processing. It is specified that there will be no fully automated decision-making processes. Regarding profiling activities, which may be carried out with the explicit consent of the data subject as indicated in the purposes, these will be conducted with the intervention of an operator who will elaborate the profile of the data subject and analyze their habits and consumption choices, in order to improve the commercial offer and services of the Data Controller (non-automated profiling).

RIGHTS OF THE DATA SUBJECT

You may exercise your rights as expressed in Articles 15 et seq. of the GDPR, or by contacting the Data Controller at the email address provided above. You have the right, at any time, to request access to your personal data (Art. 15), rectification (Art. 16), deletion of the same (Art. 17), and limitation of processing (Art. 18). The Data Controller communicates (Art. 19) to each of the recipients to whom personal data has been transmitted any corrections, deletions, or limitations of processing that have been made. The Data Controller will inform the data subject of these recipients if the data subject requests it.
In the cases provided, you have the right to data portability (Art. 20), and in that case, it will be provided in a structured, commonly used, and machine-readable format. You have the right to object (Art. 21), at any time, to the processing of data based on legitimate interest, and in cases where the legal basis is consent, you have the right to withdraw the consent given without affecting the lawfulness of processing based on consent before the withdrawal.
To stop receiving automated direct marketing communications (email, instant messaging), we invite you to contact the Data Controller at: privacy@avionord.com
If you believe that the processing of personal data carried out by the Data Controller occurs in violation of the provisions of Regulation (EU) 2016/679, the data subject has the right to lodge a complaint with the supervisory authority, particularly in the Member State where they usually reside or work, or in the place where the alleged violation of the regulation occurred (Garante Privacy https://www.garanteprivacy.it/), or to take appropriate legal action.

Date of update: September 30,  2024

The Data Controller reserves the right to modify, update, add, or remove parts of this notice.

AVIONORD SRL