PRIVACY POLICY PURSUANT TO ARTS. 13 AND 14 OF EU REGULATION NO. 679/2016 (GDPR)

DATA CONTROLLER AND CONTACTS
The Data Controller is Azienda Trasporti Milanesi S.p.A. (ATM) with registered office in Foro Buonaparte 61, 20121, Milan (Italy). The Data Protection Officer, whom you can contact to exercise your rights under art. 13 and/or for any clarifications regarding personal data protection, can be contacted at the following email address: rpd@atm.it.

PURPOSE OF THE PROCESSING AND LEGAL BASIS
The purpose of the processing is on-call bus booking. The legal basis is the execution of a contract of which the interested party is a party or the execution of pre-contractual measures adopted at the request of the same pursuant to art. 6, paragraph 1, letter b, of EU Regulation No. 679/2016. The booking can only be made by an adult, able to contracting.
CATEGORIES OF DATA PROCESSED AND RECIPIENTS
Data processed are ordinary personal data (name, surname, telephone number, email address, booking details) and special (case of disability). Personal data are processed by authorized personnel and may be shared with companies that provide services related to the process (e.g. booking service company).

METHODS OF PROCESSING AND POSSIBLE TRANSFER OF DATA
Data are processed only for mentioned purposes above, according to the principles of lawfulness, correctness, transparency, accuracy, integrity and confidentiality, established by applicable laws. The personal data management takes place usually through automated and computerized processes. The personal data collected will not be transferred outside the European Economic Area.

DATA RETENTION PERIOD
Data are stored for 10 years.

DATA SUBJECT RIGHTS
All the rights of the data subject are guaranteed in accordance with the provisions of Articles 15, 16, 17, 18, 20, 21, 22 and 77 of the GDPR:
• right of access to your personal data and all information on the processing carried out;
• right to rectification of inaccurate personal data and integration of incomplete data;
• right to erasure (‘right to be forgotten’);
• right to limit the processing of your personal data;
• right to data portability;
• right to object to the processing of your personal data;
• right not to be subject to a decision based solely on automated processing;
• right to lodge a complaint with the Italian Data Protection Authority in case a violation is thought to have been carried out.