Privacy App Mobility Power

PRIVACY INFORMATION PURSUANT TO ART. 13 OF THE EUROPEAN REGULATION 679/16 (GDPR)

FOR THE PROCESSING OF PERSONAL DATA

(European regulation on the protection of personal data)

Through the mobile application "mobile ticketing" (the "App") for the sale of travel tickets through the technological platform provided by Masabi Limited ("Masabi"), Miccolis SpA in the person of the legal representative pro tempore (hereinafter "Owner") promotes its services dedicated to customers (hereinafter "Interested") for the mobility and local public transport of Potenza, providing them with the possibility to view and book the trips made available directly through the App.

The "OWNER OF THE TREATMENT", pursuant to art. 4, paragraph 7, of the GDPR, is “Miccolis SpA” PI 05176730728, with headquarters in via delle Mammole, 26/28 Modugno industrial area, (BA) – Tel. 080 5315334, e-mail address: privacy@busmiccolis.it.

The treatment will be carried out both with manual and IT and telematic tools in compliance with the regulations in force and with the principles of correctness, lawfulness, transparency, pertinence, completeness and non-excess, accuracy and with organization and processing logics strictly related to the purposes pursued and in any case in order to guarantee the security, integrity and confidentiality of the data processed, in compliance with the organisational, physical and logical measures envisaged by the provisions in force.

The data protection officer of Miccolis SpA can be reached at the mailbox dpo@busmiccolis.it or by contacting the registered office of Miccolis SpA

The Data Controller is responsible for ensuring that the processing of personal data takes place in accordance with Article 24 of the GDPR.

Municipia SpA is appointed "Data Processor" by Miccolis Spa pursuant to art. 28 GDPR 2016/679.

The data controller will make use of sub-managers, as follows: 

The following sections describe how the personal data of users are collected and processed when they access or register on this App, as well as listing the related rights and respective freedoms provided for by current European legislation.

How do we collect personal data?

The Owner and the Manager and the sub-Managers process the personal data of users in the following cases and in these ways:

• Requests for information on the services offered and/or travel bookings through the App and/or the geographical location of users;
• Registration for the service via the App aimed at receiving information relating to the transport service by e-mail, text message or telephone.

In particular the Treatment Details are

• Application Maintenance Management
• Network Management
• System Administrator Functions
• Customer Support
• Product development
• Categories of interested parties

What personal data can be collected?

Through the methods described in the previous point, the following categories of personal data may be collected:

• Common personal data (e.g. personal data, contact data, education data, marital/family status, professional experience)
• Data regarding the use of the App, i.e. information relating to online browsing, including that collected through tracking technologies;
• Your online account details, or the information provided by the user relating to the name, address, telephone number and possibly the e-mail address when registering or to book the service;
• Contact details provided by the user, or any other information provided by the user using the App or the call center service accessible through it.

For what purposes can personal data be used?

In compliance with European legislation on the protection of personal data, the Data Controller will indicate, for each treatment, the legal basis on which it is based.

In any case, the processing may only take place for the purposes described below, also with the aid of IT tools or through automated methods.

1. Access and use of the App

While browsing, some personal data of users may be acquired in order to allow the correct functioning of the mobile application.

Among them are:

• the IP addresses of the devices used by users;
• the URL addresses of the requested resources;
• the time and method used in submitting the request to the server;
• the code indicating the status of the response provided by the server;
• information relating to the operating system and browser used.

The data, used to provide users with a response to the information or services requested, involves the acquisition of the sender's contact necessary to respond to your requests, as well as all personal data included in the communications. Please note that particular data (formerly sensitive) are not required and are not intended to be processed.

Legal basis of the treatment: Legitimate interest of the owner to make the use of the App safe and usable.

1. Access and registration to the App

The Owner and the Manager and the sub-Managers collect and process information relating to users which constitute data necessary for the purposes of registering on the App, by filling in the form on the home page.

For registration and access, the user's personal data and/or those that identify him are collected, such as a nick name freely chosen by the user and his mobile phone number, the processing of which takes place during the registration procedure.

This personal data is collected and processed for the purposes that can be activated at the user's request.

Legal basis of the treatment: provision of the service requested by the interested party.

1. Requests for information submitted via contact forms in the App

In order to provide adequate response to any requests for information from users, the Data Controller and the sub-processors collect the related contact data directly from the mobile application or from users, also sharing, if necessary, such data with the subjects to this expressly authorized by each of the aforementioned subjects.

Legal basis of the treatment: provision of the service requested by the interested party.

Characteristics of the Treatment

• Partial or Mixed Outsourcing: The processing takes place (in whole or in part) at the headquarters of the Manager
• The Manager also or only performs System Administrator activities and/or the accesses are managed by the Manager 
• The data (or part of them) are kept only or also by the Manager (or the Manager keeps a copy of it) 
• The data (or part of it) is processed through applications deployed on the Processor's servers
• The desktops/laptops/mobile devices (or some of them) used for the processing are provided by the Manager 

How do we ensure the security of personal data?

The Owner and the Manager and the sub-Managers adopt the necessary security measures, including encryption and authentication tools, in order to improve the protection, integrity and accessibility of users' personal data.

Although it is not possible to totally prevent intrusions or unauthorized accesses, physical, electronic and procedural safeguards are nevertheless used to protect users' personal data in accordance with the provisions of European Regulation no. 679/2016.

These measures include:

• the rigorous restriction of access to the personal data of the interested party, based on the need and only for the purposes communicated by them;
• the transfer of collected data only in encrypted form;
• storing highly confidential information (such as credit card information) only in anonymous or encrypted form;
• the adoption of protection systems to prevent unauthorized access;
• permanent monitoring of access to IT systems to identify and block the inappropriate use of personal data.

How long do we keep personal data?

Personal data is kept only for the time necessary to achieve the purposes for which it was collected or for any other legitimate related purpose (for example, where it is relevant to the presence of a legitimate interest).

Personal data that are no longer necessary, or whose legal basis has eliminated the conditions for their conservation, will be irreversibly anonymised or permanently cancelled. Also in this case, personal data will be kept for the time necessary to achieve the purposes for which they were collected.

To whom do we communicate the collected data?

The technical personnel expressly indicated by the Data Controller may collect further information during the performance of the related services provided to the user, in compliance with the purposes indicated in this statement.

To this end, the subjects who will have access to personal data will be specifically authorized to process it by the Data Controller and therefore the Data Processor and the sub-processors pursuant to articles 28 and 29 of the GDPR.

The list of subjects to whom the Data Controller may communicate the personal data collected can be consulted at the Data Controller's headquarters or may in any case be requested using the contact details indicated in the following point.

No data will be disseminated in any way.

The data provided will be processed exclusively by persons authorized to process and suitably trained, under the control of the Data Controller, as well as by data processors linked to Miccolis SpA by specific contract (art. 28 of Regulation 679/18), as mentioned above.

In particular, by accepting the Terms of use of the APP you are aware and accept that although Masabi uses AWS servers located in the EU, in order to provide the services offered by the App, your personal data could be accessed and consulted by employees of Masabi in locations outside the EU, currently in the UK. By downloading and using the App you therefore expressly consent to your personal data being accessed by Masabi employees in locations outside the EU.

The data may also be communicated to third parties (Transport Regulatory Authorities, Public Bodies, Police Forces, Judicial Authorities, etc.), but exclusively for the purpose of fulfilling legal obligations or community regulations or legislation.

What are the rights of the interested party?

Based on current legislation, the interested party, as an identified or identifiable natural person, has the right:

• to receive information on the treatments implemented by the Data Controller;
• to obtain a copy of the personal data provided following consultation of the App in a structured, readable and commonly used format;
• to obtain the rectification of inaccurate or incomplete data;
• to obtain the cancellation of the data held in the absence of the relevant legal conditions;
• to revoke your consent, in the event that the treatment is based on consent;
• to oppose any processing (including profiling) for direct marketing purposes;
• to limit the methods of processing personal data in the phase of establishing a complaint.

In the event that the interested party exercises one of any of the aforementioned rights, the Data Controller will take care to evaluate its validity and to provide any feedback, as a rule, within a month.

In the event of withdrawal of consent or exercise of the right to cancellation, the interested party may be contacted as part of the marketing activities which have already been carried out in the period preceding the submission of the request.

If the interested party believes that the treatment has taken place in violation of the rules established by the European Regulation for the protection of personal data, he can propose, pursuant to art. 77 of the GDPR, complaint before the Guarantor Authority or in the foreseen cases, directly to the Judicial Authority (art. 79).