NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLE 13 OF REGULATION (EU) NO. 2016/679
Pursuant to and for the purposes of Article 13 of Regulation (EU) No. 2016/679 of the European Parliament and of the Council of
April 27, 2016, on the protection of natural persons with regard to the processing of personal data, as well as
the free movement of such data, and repealing Directive 95/46/EC, also known as the General Data Protection
Regulation (hereinafter, the “GDPR”), we hereby inform you that the personal data you voluntarily provide to International Shore Services (hereinafter “ISS”) while browsing the website www.parkandcruise.com
(hereinafter, the “Website”) or within the app (hereinafter “Park&Cruise App”) will be subject to
processing in compliance with current legislation on the protection of personal data, namely
the GDPR, Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 (hereinafter, the “Privacy Code”), as well as the
provisions issued from time to time by the Italian Data Protection Authority (hereinafter, the
“Privacy Authority”), and, in any case, in compliance with the principles of confidentiality that guide the Company’s activities.
- Categories of personal data processed
ISS will process the following categories of personal data that you provide:
- browsing data, such as, for example, information regarding the device used to
browse the Parkandcruise Website/App and/or make purchases, IP address, cookies, etc.
While browsing the Website, particularly with regard to the use of cookies, ISS informs you that, in accordance with the
Provision of the Italian Data Protection Authority dated June 10, 2021,
the following link The Website’s Cookie Policy is available for review;
it contains all the information you need to understand, identify, use, or delete the cookies used
on the Website;
- personal information, such as, for example, the first and last names of the purchaser and any additional passengers,
tax ID number, VAT number, etc.;
- contact information, such as, for example, customer ID, email address, and phone number;
- bank and/or payment information;
- health-related data, only to the extent necessary to achieve the specific purpose
referred to in subparagraph (c) of paragraph 2 below;
- location data, including GPS location data, if you have enabled access to location services on your device.
- Purpose and legal basis of the processing
Personal data provided to ISS through the Parkandcruise website/app may be used for the following purposes:
- a) obligations related to the use of the Parkandcruise Website/App, such as, for example,
activation through registration, and subsequent management and technical security maintenance, of accounts
to manage access to the Parkandcruise Website/App and/or the services made available therein, as well as
passwords or similar authentication credentials, the management and processing of your requests for information
submitted by filling out forms on the Parkandcruise Website/App, etc.;
- b) compliance with legal obligations to which the Company is subject, including administrative and/or accounting obligations;
- c) with regard to the personal data of users who intend to use the services offered by ISS to
passengers with reduced mobility, compliance with the legal obligations to which the Company is subject regarding
assistance to persons with disabilities or reduced mobility, as set forth in Regulation (EU) No. 181/2011 of the
European Parliament and of the Council of February 16, 2011;
- d) obligations related to the performance of a contract, pre-contractual measures, and/or the provision of services,
such as, by way of example, the establishment and performance of the contractual relationship with ISS regarding the
transportation service you have requested, assistance related to the services and/or products you have
purchased through the Parkandcruise Website/App (so-called “customer service”), etc.;
- e) obligations related to the need to establish, exercise, or defend a right in court or in administrative proceedings, or in the context of arbitration or conciliation proceedings;
- f) direct marketing of services similar to those you have purchased, in accordance with the provisions of
Article 130, paragraph 4, of the Privacy Code (so-called “soft spam”). The Company may use the
email address you provided when purchasing the ticket. However, you may, at any time (initially or in response to subsequent communications), object to such processing, including by submitting a specific request to the Data Controller, in accordance with the provisions of paragraph 8 of this policy;
- g) the conduct of promotional activities (so-called "marketing") and the sending of informational and promotional communications – by ISS – regarding the products and services of ISS and its business partners,
and/or price reductions for your searches, via mail, the internet, telephone, and email – including newsletters
and direct email marketing – MMS, and SMS, including for the purpose of conducting market research (so-called “customer
satisfaction”);
- h) with regard to the personal data of users registered in the restricted area of the Parkandcruise Website/App, the performance of profiling activities carried out to analyze tastes,
preferences, habits, needs, and consumption choices in order to receive personalized offers based on
purchasing preferences;
- (i) provide users with information about the nearest bus stops and the services available
in the area where they are located.
The processing of data for the purposes set forth in subparagraphs (b) and (c) does not require your consent, as it is necessary to comply with the legal obligations to which the Company is subject, pursuant to Article 6(1)(c) of the GDPR. In particular, the
processing of data for the purpose under c) is necessary to comply with legal obligations regarding assistance
to persons with disabilities or reduced mobility as set forth in Regulation (EU) No. 181/2011, pursuant to Article 6(1)(
(c) and Article 9(2)(b) of the GDPR.
The processing of data for the purpose under (d) does not require your consent as it is necessary for the fulfillment
of contractual and/or pre-contractual obligations, pursuant to Article 6(1)(b) of the GDPR.
The processing of data for the purposes listed under a), e), and f) does not require your consent as it is necessary for the
pursuit of a legitimate interest of the Company, pursuant to Article 6(1)(f) of the GDPR and/or Article
130(4) of the Privacy Code.
The processing of data for the purposes listed under g), h), and i) requires your consent pursuant to Article 6(1)(a) of the GDPR.
- Methods of processing
Personal data will be processed using appropriate paper-based, electronic, and/or telematic means,
in accordance with procedures strictly related to the purposes set forth above and, in any case, in a manner that ensures the security and
confidentiality of the data.
- Provision of Data and Consequences of Refusal
The provision of personal data for the purposes listed in subparagraphs (b), (c), and (d) of paragraph 2 above is necessary for the
fulfillment of legal and/or contractual obligations. Any refusal to provide such data and/or the provision of inaccurate
and/or incomplete information could result in the following:
- (i) the Company’s inability to comply with all requirements imposed by applicable law
that are instrumental to and/or otherwise related to the establishment and/or performance of the contractual relationship to which it is subject;
- (ii) the inability to enter into the transportation contract and/or to ensure the proper and timely performance of the relevant contractual relationship, including customer service activities related to the services and/or products you have purchased through the Parkandcruise Website/App (hereinafter “customer service”).
The provision of personal data for the purposes listed in subparagraphs (a), (e), and (f) of paragraph 2 above is necessary for the
pursuit of the Company’s legitimate interests as indicated above. Any refusal to provide such data and/or the provision of
inaccurate and/or incomplete information could result in the following:
- i) the Company’s inability to fulfill its obligations related to the use of the Parkandcruise Website/App,
including the management and processing of your requests for information submitted by
filling out forms available on the Parkandcruise Website/App;
- (ii) the Company’s inability to establish, exercise, or defend a right in court or in administrative proceedings, or in arbitration or conciliation proceedings;
iii) the Company’s inability to engage in direct sales of services similar to those you have purchased, in accordance with the provisions of Article 130, paragraph 4, of the Privacy Code.
The provision of personal data for the purposes listed in subparagraphs g), h), and i) of paragraph 2 above is optional; however, a refusal to provide such data and/or the provision of inaccurate and/or incomplete information could result in the following consequences:
- i) the Company’s inability to contact you and/or send you informational and commercial communications, including those of a promotional nature,
advertising material, and/or offers of goods and services from ISS, as well as to conduct market research;
- (ii) the Company’s inability to analyze tastes, preferences, habits, needs, and consumption choices and to send personalized offers based on purchasing preferences;
(iii) the Company’s inability to provide information regarding the nearest bus stops and the services
available in the geographic area where the connection is made.
- Recipients or categories of recipients of personal data
Your personal data may be disclosed to shareholders, members of the board of directors or other administrative bodies, and, in any case, to the Data Protection Officer, external data processors, data processors, and/or authorized data processors designated by the Company in the performance of their duties.
Your personal data may be disclosed to any parties that provide the Company with services or support essential to the purposes indicated in paragraph 2 above, such as, by way of example, individuals, entities, and/or companies that manage and/or participate in the management and/or maintenance of the websites and electronic and/or telematic tools used by us.
Your personal data may also be disclosed to suppliers, contractors, subcontractors, banks,
and/or insurance companies, consultants who assist ISS in various capacities, particularly with regard to legal,
tax, social security, accounting, and organizational matters; to law enforcement agencies or judicial authorities in the context of
police or judicial investigations for the purposes of preventing, detecting, or prosecuting crimes;
any other party to whom the data must be disclosed pursuant to an express provision of law.
- Transfer of Data to Third Countries
Your personal data may be disclosed and/or transferred abroad, in accordance with the provisions of applicable law, including to countries outside the European Union.
In all such cases, the transfer is carried out on the basis of an adequacy decision by the Commission (Art. 45 of the GDPR) or in accordance with standard data protection clauses or other appropriate safeguards pursuant to Articles 46 or 49 of the GDPR.
- Duration of processing and retention period
Your personal data will be processed only for as long as is necessary to achieve the purposes for which it is being processed.
The data will be retained in accordance with the following criteria:
- The data processed for purposes related to compliance with legal obligations and contractual and/or pre-contractual obligations referred to in subparagraphs (b), (c), and (d) of paragraph 2, “Purposes and Legal Basis of Processing,”
of this policy will be retained for a period of 10 years, unless there is a need for further retention to allow ISS to defend its rights;
- The data processed for the purpose of direct sales of services similar to those you have purchased, as described in
subparagraph (f) of paragraph 2, “Purposes and Legal Basis of Processing,” of this notice,
will be retained for a maximum period of 24 months;
- Data processed for marketing purposes as referred to in subparagraph (g) of paragraph 2, “Purposes and Legal Basis of Processing,” of this privacy policy will be retained for a maximum of 24 months;
- Data processed for the profiling purpose referred to in subparagraph (h) of paragraph 2, “Purposes and legal basis of the processing,” of this notice will be retained for a maximum of 12 months;
- The data processed for the purposes of the legitimate interests referred to in subparagraphs (a) and (e) of paragraph 2 of the section titled “Purposes and Legal Basis of Processing” in this notice will be retained for a period not exceeding the statute of limitations applicable to the rights that may be exercised by the Data Subject, as applicable from time to time;
- The data processed for the purpose of location tracking referred to in subparagraph (i) of paragraph 2 of the section titled "Purposes and Legal Basis of Processing" in this privacy notice will not be retained.
- Rights of the data subject
Please be advised that you may exercise your rights regarding your personal data at any time, subject to the limits
and conditions set forth in Articles 7 and 15–22 of the GDPR.
To exercise these rights, as described below, please contact the Data Controller
at the following email address:
support@parkandcruise.com; we will respond to this request without delay
and, in any case, within one month of receiving the request.
Specifically, as the data subject, you have the right to:
- to obtain confirmation as to whether or not personal data concerning you is being processed;
- if processing is ongoing, to access personal data and information regarding the processing, as well as to request a copy of the personal data;
- to have inaccurate personal data corrected and incomplete personal data completed;
- to have your personal data erased, if any of the conditions set forth in Article 17 of the GDPR apply;
- to obtain, in the cases provided for in Article 18 of the GDPR, the restriction of processing;
- to receive your personal data in a structured, commonly used, and machine-readable format;
and to request that it be transmitted to another controller, if technically feasible.
8.1. Right to Object
Every data subject has the right to object at any time to the processing of their data carried out for the purpose of pursuing a legitimate interest of the Data Controller. In the event of an objection, your data will no longer be subject to processing, unless there are legitimate grounds for processing that override the interests,
the rights and freedoms of the data subject, or for the establishment, exercise, or defense of a legal claim in a
With regard to the processing of data for the purposes set forth in subparagraphs g), h), and i) of paragraph 2, “Purposes and Legal Basis for Processing,” of this policy, each data subject may at any time withdraw any consent previously provided or object to such processing by sending an email to the address
support@parkandcruise.comv.
The withdrawal of your consent will not affect the lawfulness of processing based on the consent given prior to the
withdrawal.
Objection to processing exercised through these means also extends to the sending of commercial communications via the postal service or through telephone calls with an operator, without prejudice to the possibility of exercising this right in part, for example by objecting only to processing carried out through automated communication systems.
8.3. Right to lodge a complaint with the Data Protection Authority
Finally, pursuant to Article 77 of the GDPR, we remind you that you have the right to lodge a complaint with the Data Protection Authority,
should you believe that your rights under the GDPR have been violated, in accordance with the
procedures indicated on the Data Protection Authority’s website, accessible at www.garanteprivacy.it.
- Data Controller, Data Processors, and Data Protection Officer
The data controller is International Shore Services sarl, represented by its Legal Representative
on an interim basis, with headquarters in Geneva (Switzerland), at 14 Rue du Conseil-General.
The updated list of Data Processors is available at the Data Controller’s headquarters and may be requested
by sending an email to
support@parkandcruise.com.
The Data Protection Officer can be contacted at the following email address
support@parkandcruise.com
