Dear Client,
in compliance with Reg. (EU) 2016/679 and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, laying down provisions for the protection of persons and other subjects with regard to the processing of personal data, we wish to inform you that the personal data you provide will be processed in compliance with the above-mentioned legislation and the confidentiality obligations to which Consorzio Noleggiatori Malpensa is the
DATA CONTROLLER
The data controller of personal data is the company Consorzio Noleggiatori Malpensa (hereinafter, “Data Controller”):
Registered office: Via Mameli 31, 20129 Milan (MI)
P. VAT: 03682810126
Telephone: +39 0331 1812650
OBJECT OF PROCESSING
The data whose processing consent is required, which may be requested when filling out the “Contact” form within the site (indicated by an asterisk) or, subsequently, when preparing the service, are as follows:
*personal data of the service applicant: first name, last name, nationality (optional);
*contact details: e-mail address, telephone number, residential address;
master data of service users (passengers): first and last name;
data contained within the identity document and tax code, exclusively in the case of travel outside the national territory of Italy: personal data (first name, last name, place and date of birth, nationality), address data (residential address), marital status, profession, data on salient features and markings, photographic image, signature
payment data;
generic data related to the person’s physical disability status, where applicable and if strictly necessary for the use of the service.
Special categories of data
With the exception of data relating to place of birth and citizenship that may reveal racial or ethnic origin and generic data relating to the person’s state of physical disability, and the processing of which takes place exclusively following consent from the data subject, Consorzio Noleggiatori Malpensa does not process additional special data such as political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, data relating to the person’s sex life or sexual orientation.
PURPOSE OF PROCESSING AND LEGAL BASIS
Consorzio Noleggiatori Malpensa assures the interested parties that the personal data collected are complete, pertinent and not excessive and will be collected exclusively for the types of purposes indicated below:
execution of the requested car rental service with driver;
to send messages, via e-mail, or contact you, including by telephone, in relation to the requested and contractually defined car rental service with driver;
for administrative, accounting and tax purposes;
to comply with legal obligations and measures of the competent Authorities; by way of example, we report the obligation, on the part of the operators of the rental service with driver, provided for by Law No. 21 15/01/92, as amended by D. L. No. 35 of 14/12/2018, for the driver to complete and keep the service sheet;
for the purpose of ascertaining, exercising or defending a right, constituting a legitimate interest of the Data Controller to pursue remedies to ensure compliance with its contractual rights or to demonstrate that it has fulfilled its obligations arising from the contract with the data subject or imposed on the Data Controller by law.
The processing of data for the above-mentioned purposes finds its legal basis in Article 6, paragraph 1, lett. a) (consent), lett. b) (performance of pre-contractual and contractual obligations), lett. c) (fulfillment of legal obligation) and lett. f) (legitimate interest) of EU Reg. 2016/679.
METHODS OF PROCESSING
The provision of data is optional, it is understood that any refusal to provide such data and failure to consent to their processing will result in the impossibility of fulfilling the mandate conferred and the impossibility of implementing the requested car rental service with driver.
The processing will be carried out with the support of paper, computer or telematic means.
Specific security measures are observed to prevent the loss of data, illicit or incorrect use of the same and unauthorized access, so as to allow access only to appointed appointees or managers. Personal data acquired will be stored electronically, managed in a secure environment with controlled access. Personal data in paper format will be kept and stored in protected premises with controlled access.
The logic underlying the data processing is strictly related to the purposes listed above and based on the data held by Consorzio Noleggiatori Malpensa
In any case, the processing of personal data will take place in accordance with the law, according to principles of lawfulness and fairness.
Consorzio Noleggiatori Malpensa will not use the personal data of the data subjects for profiling purposes, nor will such data be used or disclosed to third parties for marketing purposes; furthermore, the Data Controller does not adopt any automated decision-making process, as referred to in Article 22(1) and (4) of EU Regulation No. 679/2016.
The processing carried out by the Controller consists of the collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and destruction of data.
SCOPE OF COMMUNICATION AND DISSEMINATION OF DATA
The personal data of the data subject will be processed exclusively by the staff and collaborators of the Data Controller or the companies expressly appointed as Data Processors.
If applicable, the data subject’s personal data may be communicated by the Controller exclusively to the following categories of recipients:
consultants and accountants or other professionals who provide functional services for the purposes indicated above;
Credit institutions, financial and insurance intermediaries that provide functional services for the purposes indicated above;
Judicial or administrative authorities, for the fulfillment of legal obligations.
The personal data of the interested party will not be disseminated under any circumstances.
The communication of the aforementioned data will take place in any case with a guarantee of protection of the rights of the interested party and with prohibition of further communication or dissemination without prior explicit authorization.
In any case, the data will be processed exclusively for the pursuit of the purposes indicated above and subject to the signing of a deed of appointment as Data Processor.
TRANSFER OF PERSONAL DATA
The personal data of the data subject will not be transferred either to member states of the European Union or to third countries outside the European Union.
DURATION OF PROCESSING
The data collected will be kept for the period strictly necessary for the aforementioned purposes, and also following the service provided, for the fulfillment of all possible obligations related to or resulting from the conclusion of the contract. In any case, the data collected will be kept for a period not exceeding 5 years from the last communication received from the data subject.
RIGHTS OF THE DATA SUBJECT
At any time, the data subject may exercise his or her rights vis-à-vis the Data Controller in accordance with Article 14(2)(c), (d) and (e), Reg. (EU) 679/2016.
You have the right to request access to, update, rectification or erasure of your personal data, restriction of processing, portability as well as the right to object to their processing (Articles 15-21 Reg. (EU) 679/2016) and to revoke previously given consent at any time.
In particular, the data subject has the right to:
request confirmation of the existence or non-existence of their personal data;
obtain indications about the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be communicated and, when possible, the storage period;
obtain rectification and erasure of data;
obtain the restriction of processing;
obtain portability of the data, i.e., receive them from the Data Controller, in a structured, commonly used and machine-readable format, and transmit them to another Data Controller without hindrance;
object to the processing at any time;
request from the Data Controller access to and rectification or erasure of personal data or restriction of processing concerning him or her or to object to its processing, as well as the right to data portability;
revoke consent at any time without affecting the lawfulness of the processing based on the consent given before revocation;
to lodge a complaint with a supervisory authority.
To exercise the above rights, the Data Subject may send a registered letter with return receipt or PEC to the following addresses:
Consorzio Noleggiatori Malpensa, Via Mameli 31 20129 Milan (MI).
[email protected]
He/she also has the right to lodge a complaint with the Control Authority in the event of an alleged or ascertained violation of his/her legitimate rights and interests (art. 77 Reg (EU) 679/2016).
In any case, the Data Controller reserves the right to fully implement the aforementioned requests within and no later than the following terms:
acceptance of the request – 10 working days;
processing of the request – 15 working days after taking charge.
The Holder will notify, in writing and addressed to the interested party, the completion of the requested procedure.
