1.1. Controller. Go2RAIL A.P.S. (hereinafter referred to as “Go2RAIL”), whose contact details are provided in the “footer” of its website reachable at the URL: http://www.go2rail.eu / (“Site”), in its capacity as controller (“Controller”), is committed to protecting personal data in accordance with (i) Regulation (EU) 679/2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (“GDPR”) as well as (ii) applicable Italian legislation on personal data protection (“National Data Protection Laws”).
1.3. Applicable rules. The Controller processes personal data in accordance with (i) the GDPR; (ii) the provisions of the National Data Protection Laws; (iii) guidelines issued by the Italian Data Protection Authority.
1.7. Definitions. In this document, the terms generally indicated with a capital letter (whether they are singular or plural), save as otherwise specified herein, shall have the meaning set out in the Conditions.
2.1. Data Subjects. The category of data subjects consists of: (i) Participants, as identified in the Conditions; (ii) internationalization officers of Universities accessing the webpage www.go2rail.eu/go2unis of the Site and submitting the required information and personal data (“Officers”); (iii) simple internet users, who use the Site, also when surfing, as simple reader or navigator (“Users”) (Participants, Officers and Users are hereinafter jointly defined as “Data Subjects”).
2.2. Activities carried out through the Site. Through the Site, the following activities are carried out by Go2RAIL:
a. As regards Participants: Collection of their Common Personal Data, as respectively identified hereinbelow, in order to pursue the purposes of the Project and, in particular - when possible - in order to provide promo codes applicable to train tickets and additional discounts, as specified in the Conditions;
b. As regards Officers: Collection of their Common Personal Data, in order to draft and execute the agreement to become part of the network of universities supporting the Project.;
c. As regards Data Subjects: Provision of contents of various nature on the Project and various activities of Go2RAIL, including, forwarding of newsletters and informational materials.
3.1. Source. The Controller processes personal data:
a. Voluntarily provided by Participants or Officers by filling in the specific forms of the Site/Platform or sent to the Controller in the context of the Project or the services offered by the Controller;
b. Voluntarily provided by Data Subjects, when signing up to the newsletter, and requiring the Controller to provide information;
3.3. Common Personal Data processed. Common Personal Data may consist of the following data, including:
a. As regards Participants: for those accessing the webpage www.go2rail.eu/city-go2rail of the Site: name/surname, institutional e-mail address, home institution, host institution, currently enrolled education level, disciplinary area, departure date, preferences on additional promo codes; for those accessing the web page https://www.go2rail.eu/eaie-form-no-city of the Site: name, surname, email address, organization of affiliation, title of the covered position, departure city, day and part of the day for the departure to the event’s venue and return destination when different from the one of departure;
b. As regards Officers: name and surname of natural persons, including name and surname of representatives of legal persons, organizations and associations, by virtue of their powers to act as representatives or authorized contact persons, name and business name, tax code number, VAT number, residence for tax purposes, full references, physical and telephone numbers, facsimile and e-mail addresses, Postal Code Numbers, information needed to execute contracts, bank account details and data referred to payments;
c. As regards Data Subjects: for the newsletter subscription, name and surname and e-mail addresses for communications sent to Controller, name and surname and e-mail addresses.
4.1. Purposes and legal basis. The Controller shall process Common Personal Data for the following purposes and legal basis, as specified in the lines below:
A - Purpose: process Common Personal Data of Participants – as respectively identified above – collected through the Platform/Site according to instructions specified in the Conditions and/or communicated by Go2RAIL in order to pursue the purposes of the Project (in particular, facilitating networking among Participants involved in the same route and – where applicable – providing them with promo codes applicable to train tickets and additional discounts)
A - Legal basis: The data processing is necessary for the performance of a contract or to take steps prior to entering into a contract
B - Purpose: Process Common Personal Data of Officers in order to draft the agreement to become part of the network of universities supporting the Project.
B - Legal basis: The data processing is necessary for the performance of a contract or to take steps prior to entering into a contract
C - Purpose: Provide, through the Site/Platform, services as agreed with Data Subjects;
C - Legal basis: The data processing is necessary for the performance of a contract or to take steps prior to entering into a contract
D - Purpose: send to Data Subjects newsletters and informational material in relation to the Project or the activities carried out by Go2RAIL
D - Legal basis: Consent.
4.3. Giving and withdrawal of consent. In relation to the purpose set out in the Table under letter D, the consent is deemed given by Data Subjects when they have checked the appropriate box in the registration or compilation form. Data Subjects may withdraw their own consent at any time according to the instructions given in every newsletter or in the Site. Once a withdrawal of consent has been expressed, the data in question will be cancelled from the Controller’s databases and lists.
5.1. Persons in charge of the processing. Personal data are processed by persons in charge of the processing, who have been appropriately instructed. 5.2. Processors/recipients of data. Personal data may be disclosed to data processors, who process data based on previous agreements with Go2RAIL. Data processors may belong to the following categories: (i) suppliers of implementation, management, assistance and maintenance services applied to the Platform/Site and the IT infrastructure; (ii) suppliers of software, applications and hardware and related technical support/maintenance services; (iii) suppliers of connectivity services, email services and related management, assistance/maintenance services; (iv) accounting and tax consultants.
In addition, personal data may be disclosed to third parties, acting as independent data controllers, such as for example: (i) legal consultants; (ii) public authorities; (iii) certification entities and bodies; (iv) subjects to whom disclosure is mandatory by law.
Go2RAIL provides specific information on data processors and recipients, at the request of the Data Subject.
6.1. Methods of processing. The Common Personal Data of Data Subjects are processed almost exclusively by automated procedures, by using computerized systems or in a limited number of cases through manual means, but in any case, by adopting methods which are strictly related to the purposes for which data have been collected and anyway to guarantee their security.
6.2. Place of processing. Processing of Data Subjects’ Common Personal Data is made in the head offices of the Controller and/or – if appointed – of the processors. Common Personal Data of Data Subjects are collected in one or more electronic databases, hosted on servers/data centers located in the European Union.
6.3. Data retention period. Common Personal Data of Participants are processed as long as any Participant decides to avail itself of the services provided or the activities carried out by Go2RAIL through the Site/Platform. The Controller will cancel, at the Participants’ request, their Common Personal Data, which are not necessary to comply with legal obligations and/or to exercise the right of defense and to manage/resolve a dispute. Common Personal Data of Officers are retained for the entire duration of the contractual relationship and are then cancelled ten years and six months after the termination of the same for defensive purposes, unless there is and objection/dispute, in which case the data will be kept for the time necessary to exercise the right of defense and to manage/resolve the dispute. Common Personal Data used for the purpose of sending newsletters/informative communications regarding the Project or the activities of Go2RAIL are retained until the withdrawal of consent by the Data Subject concerned and then are cancelled from Go2RAIL ‘s databases and lists.
6.4. Personal Data transfer abroad. Currently, the Controller has no intention to transfer personal data to third countries extra EU. In any case, the transfer – if any – will take place only after verification of compliance with the provisions contained in articles 44 and following of the GDPR and, in particular, upon previous communications concerning the extra EU country in question and the appropriate safeguards according to the GDPR provisions.
7.1. Rights. Data Subjects as natural persons may directly address to the Controller in order to enforce their rights according to the GDPR (articles 15 et seq.) and, in particular, to access their own personal data, request the rectification, updating, cancellation or limitation of said data, as well as to request the portability of said data; Go2RAIL may be contacted using the contact details as set out above or, with specific regard to the newsletter, by clicking the “unsubscribe” button.
7.2. Complaint. Any Data Subject who believes that the processing of data concerning him or her is in violation of the GDPR, in accordance with the provision of article 77 of the GDPR, may lodge a complaint with a supervisory authority where the data subject usually lives or works or with a supervisory authority where the alleged infringement has occurred.