WEBSITE AND APP PRIVACY POLICY

This privacy policy on the processing of personal data ("Policy") applies to the processing of your personal data by Rome Shuttle Limousine Soc. Cooperativa (hereinafter, "RSL." or "Controller") carried out through the website romeshuttlelimousine.com/ ("Site") and through the mobile application "RSL Rental" ("App"), in accordance with the provisions of Regulation (EU) 2016/679 ("GDPR"), Legislative Decree 196/2003, as amended. ("Privacy Code"), the relevant measures and guidelines of the national and European data protection authorities, as well as applicable national and European legislation (jointly, "Applicable Legislation").

• Contact details of the data controller
  • The data controller is RSL Soc. Cooperativa., with registered office in via Crescenzio, 99/E - 00193 Roma (RM), Italy, Fiscal Code and VAT number 13023811006.
    For any request regarding the processing of your personal data, you may contact us by sending a communication by mail to our office or by e-mail to info@romeshuttlelimousine.com.
• Categories of personal data, purpose of processing and legal basis
  • We will process your personal data, both by manual and automated means, for the purposes and according to the legal basis described below.

    Purposes	Legal basis	Categories of personal data
    (i) To enable you to use the Site and/or App and access the content made available through the Site and/or App.	Necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR).	Details of the web browser used and the IP address and any other data relating to navigation.
    (ii) To process and respond to any requests, as well as to allow you to use the rental service through the contact and booking channels indicated on the Site and/or App (e.g. bookings, contacts, new booking).	Necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR).	Identification, contact and payment data provided by you (i.e. first name, last name, e-mail address and payment data) as well as any other information provided by you and/or necessary for the handling of your requests.
    (iii) To comply with legal obligations and/or respond to requests from competent authorities.	To comply with a legal obligation to which we are subject (Art. 6(1)(c) GDPR).	Any information that may be required by law or to comply with requests received from competent authorities.
    (iv) To safeguard our rights and those of our employees and contractors, both in judicial and extrajudicial proceedings.	Pursuit of our or a third party's legitimate interest (Art. 6(1)(f) GDPR).	Any information necessary to fulfill this purpose.
    (v) To carry out extraordinary operations concerning the Data Controller (including mergers, acquisitions, disposals, corporate reorganizations, corporate restructuring), to the extent strictly necessary for the pursuit of such purpose and on the basis of the legitimate interest of the Data Controller following an appropriate balancing with the fundamental rights and freedoms of the data subjects.	Pursuit of our or a third party's legitimate interest (Art. 6(1)(f) GDPR).	Any information necessary to fulfill this purpose.

• Nature of data submission
  • The personal data collected for the purposes referred to in numbers (i), (ii) and (iii) of point 2 above will be processed as necessary to perform a contract to which you are a party and/or pre-contractual measures taken at your request, as well as to fulfill a legal obligation to which the Data Controller is subject. You are free to communicate your data to us or not, but without the requested data we will not be able to allow you to use the Site and/or the App and related features, examine your reservation, or respond to your requests.
    
    Personal data collected for the purposes set out in numbers (vi) and (vii) of point 2 above will be processed on the basis of the legitimate interests of RSL or third parties. The right to object may be exercised by contacting the Data Controller at the contact details indicated in this Policy. The possible exercise of the right to object may affect your ability to continue to use the Site and/or the App or related features.
• Data storage
  • Your personal data will be kept for a period of time strictly necessary to achieve the purposes for which they are collected, as well as for any longer period necessary to comply with legal obligations and/or for judicial protection purposes, and in any case not beyond the ordinary prescriptive terms. At the end of the storage period, your personal data will be deleted or anonymized.
    
    In particular, your personal data, processed for the purposes set out in section 2 above, will be stored in accordance with the terms and criteria specified below:
    • Purposes (i), (iii), (iv) and (v): personal data collected for these purposes will be kept for the time strictly necessary to pursue these purposes, unless it is necessary to keep it longer in order to comply with a legal obligation, an order of an authority or to defend one of our rights.
    • Purpose (ii): Data collected to fulfill your request and/or reservation will be kept until your request and/or reservation is fulfilled, unless it is necessary to keep it longer in order to comply with a legal obligation, an order from an authority or to defend our rights.
    
    More detailed information regarding retention periods is available upon request by contacting the Data Controller at the contact details indicated in this Policy.
• Data transfer outside the European Economic Area
  • Your personal data will not be transferred outside the European Economic Area (“EEA”).
• Subjects or categories of subjects to whom personal data may be communicated or who may become aware of your personal data
  • For the pursuit of the purposes indicated in point 2 of this Information Notice, the data that you have provided may be processed by the following categories of subjects:
    • authorized personnel of RSL, who are provided with specific instructions for processing;
    • third parties who carry out activities connected or instrumental to the activity of RSL (such as, for example, drivers, suppliers who are entrusted with the maintenance and development of the computer system, companies which provide computer and telematic services to RSL, filing and/or other administrative, accounting or legal services);
    • third parties who perform activities connected or instrumental to the activity of the Controller (such as, for example, professionals, legal and/or tax consultants).
    • independent authorities, law enforcement agencies or judicial and administrative authorities for their institutional purposes within the limits of the law, as well as for the detection and prosecution of crimes, prevention and protection from threats to public safety, to allow RSL to ascertain, exercise or defend a right in court, and for other reasons related to the protection of the rights and freedoms of others.
    
    These subjects will act, as the case may be, as autonomous controllers of the processing or as data processors, in the latter case under a specific written agreement on the processing of personal data and following the instructions given by the Controller
    
    The list of recipients of your data is available upon request, to be sent to RSL at the addresses indicated in this Policy.
• Your rights.
  • If applicable to the processing described in this Policy, you may exercise your rights according to Articles 15 et seq. of the GDPR:
    • Right of access (Art. 15 GDPR);
    • Right to rectification (art. 16 GDPR);
    • Right to erasure (so called right to be forgotten, art. 17 GDPR);
    • Right to restriction of processing (art. 18 GDPR);
    • Right to data portability (art. 20 GDPR);
    • Right to object (art. 21 GDPR).
    
    In addition, if you believe that the processing of your personal data violates the principles laid down by the Applicable Legislation, you may lodge a complaint to the judicial authority or the supervisory authority for the protection of personal data in the Member State in which you normally reside, work or in the place where the alleged violation occurred. The competent authority in Italy is the Garante. Further information on the modalities of presentation of the claims are available on the site of the Garante to the address http://www.garanteprivacy.it.
    
    The rights listed above may be exercised at any time by sending a communication by mail to our office, or by sending an e-mail to info@romeshuttlelimousine.com.
• Changes and updates of the Policy
  • The evolution of our services may lead to changes in the characteristics of the processing of your personal data described above. Consequently, this Policy may be subject to changes and amendments over time, which may also be necessary in relation to new legislation. Therefore, we invite you to periodically check this page to make sure that nothing has changed: where possible, we will try to promptly inform you about the changes made and their consequences.
    
    The updated version of the Policy, in any case, will be published on this page, indicating the date of its last update.
    
    This Policy is current as of May 2022.