Alitalia – Società Aerea Italiana S.p.A. in limited partnership, wishes to inform you that, pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and Council concerning the protection of individuals with regard to the processing of personal data (hereafter “European Regulation”), needs to process your personal data provided through the molecular (RT PCR) or antigenic swab carried out.
1. DATA CONTROLLER
The Data Controller is Alitalia – Società Aerea Italiana S.p.A. in limited partnership, in the person of its legal representative, domiciled at the registered office in Via A. Nassetti s.n.c., Pal. Alfa, 00054 Fiumicino (RM) (hereafter “Alitalia” or “Controller”).
2. DATA PROTECTION OFFICER
Considering the data processing activities performed by Alitalia, the Controller has deemed it necessary to appoint, pursuant to article 37 of the European Regulation, a Data Protection Officer, who you may contact at the following address: Alitalia Data Protection Officer, Via A. Nassetti s.n.c., Pal. Alfa, 00054 Fiumicino (RM), or by sending an email to firstname.lastname@example.org.
3. PURPOSE OF THE PROCESSES AND LEGAL BASIS
Personal data and, if any, special categories of data collected by Alitalia will be processed for the only purpose of allowing the correct operation of “Covid-Tested” flights and the issue of a refund or of a voucher, upon the passenger’s request, in compliance with the obligations laid down by the relevant legal framework on the processing of personal data and health data, and in compliance with the provisions of the Ordinance of Regione Lombardia.
The legal basis on which the processing is based, is the fulfillment of legal obligations to which the controller is subject.
4. DATA RETENTION PERIOD
Alitalia undertakes to regularly verify the necessity of the retention of the collected data, also considering the evolution of the Covid-19 pandemic and the information given from the competent public authority. Therefore, Your data may be processed until the end of the emergency status. This, except the case where Alitalia will need to keep such data to comply with regulatory obligations, or to ascertain, exercise or defend in practice our right in court.
5. CATEGORIES OF RECIPIENTS
The processed personal data will not be disclosed to third parties. However, your data may be disclosed in relation to the abovementioned processing purposes, to the following categories of recipients:
- Subjects who can access the data pursuant to the provisions of the law provided for by European Union law or by that of the Member State to which the Controller is subject to;
- Persons who carry out, in complete autonomy, as separate Controllers, or as Data Processors appointed by Alitalia for this purpose, auxiliary purposes to the activities and services referred to in paragraph 3., as insurance institutions, law firms, public and private health institutions, service centres, companies or consultants providing services to the Controller, within the limits of the purposes for which they were collected.
Moreover, Your personal data may be disclosed also to our employees, provided that they were previously designated as person acting under the authority of the Controller, in accordance with article 29 of the European Regulation, or as System Administrator.
Any communication of personal data will take place in full compliance with the legal provisions of the European Regulation and the technical and organizational measures prepared by Alitalia in order to ensure an adequate level of security.
6. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES
The Controller does not intend to transfer Your personal data to third countries.
The entire processing of personal data takes place within the borders of the Italian territory and, or in limited cases within those of the European Union.
7. AUTOMATED DECISION-MAKING PROCESSES
The Controller does not intend to use automated decision-making processes, including profiling as for in article 22, paragraph 1 and 4 of the European Regulation. Therefore, the Controller does not provide any information about the logic used, as well as on the importance and consequences for the data subject relating to this type of processing.
8. NATURE OF THE CONFERIMENT/ NATURE OF THE PROVISION
The provision of Your personal data for the purposes referred to in paragraph 3 is mandatory, because the failure to authorize the processing may lead to the impossibility for Alitalia to comply with legal provisions, as well as to allow Your boarding on the “Covid-Tested” flight.
9. RIGHTS OF THE DATA SUBJECT
Regarding the processing of Your personal data, in accordance with the European Regulation, You have the right to:
- Withdraw the consent to data processing, at any time, for all further data processing procedures that are not necessary to execute the service agreement. However, it has to be underlined that the withdrawal of the consent does not constitute a bias to the lawfulness of data processed based on consent provided prior to withdrawal of the consent itself, in accordance with article 7, section 3, of the European Regulation;
- Obtain the access to personal data from the Controller, in accordance with article 15 of the European Regulation;
- Obtain, from the Controller, the rectification and the integration of incorrect personal data, also providing a providing a simple integrative statement, in accordance with article 16 of the European Regulation;
- Obtain, from the Controller the deletion of personal data if even just one of the reasons established by article 17 of the European Regulation is present, for all further data processing that might not be necessary to execute the service agreement;
- Obtain from the Controller the limitation of personal data processing, if even one of the cases theorized in article 18 of the European Regulation is present, for all further data processing that might not be necessary to execute the service agreement;
- Receive, from the Controller, the personal data that concern you, in a structured format widely used and legible by an automatic device. You have also the right to transmit these data to another Data Controller, in accordance with article 20 of the European Regulation;
- Object at any moment, for reasons associated with Your particular situation, to the processing of personal data carried out in compliance with article 6, section 1, letters e) or f), including profiling based on these provisions, in accordance with article 21 of the European Regulation;
- Not to be subjected to decisions solely based on automated data processing, including profiling, that will have legal repercussions for you, if you have not consented explicitly in advance, in accordance with article 22 of the European Regulation. By way of a non-exhaustive example, this category includes any form of automated personal data processing intended to either analyze or foresee aspects that concern consumption and purchase choices, the economic situation, interests, reliability and behavior;
- Submit a complaint to the control authorities if you deem that the processing of your data violates the European Regulation. The complaint can be submitted in the Member State where You habitually reside or work or in the place where a presumed violation occurred, in accordance with article 77 of the European Regulation.
In order to use each of Your rights, You can contact the Controller, in the person of its legal representative, by sending a communication to the registered office of Via A. Nassetti s.n.c., Pal. Alfa, 00054 Fiumicino (RM).
Alternatively, You can contact the Data Protection Officer by sending a communication to the Alitalia Data Protection Officer office of Via A. Nassetti s.n.c., Pal. Alfa, 00054 Fiumicino (RM), or by sending an email to the following email address: email@example.com.