Privacy – Complaints

(pursuant to Article 13 of Regulation (EU) 2016/679)

Pursuant to Regulation (EU) 2016/679, which establishes rules relating to the protection of natural persons with regard to the processing of personal data, CTM S.p.a. provides the following information regarding the processing of your personal data in the complaints platform reachable through < a href="https://segnalazioni.ctmcagliari.it/">THIS link.
The data, according to the principles set out in Article 5 of Regulation (EU) 2016/679, will be:

• processed lawfully, fairly and transparently
• processed for specific, explicit and legitimate purposes and in a manner compatible with those purposes
adequate, relevant and limited with respect to the purposes
• accurate and up-to-date
• kept for a period of time not exceeding the achievement of the purposes, in order to guarantee adequate security, integrity and confidentialityza.

The Data Controller is CTM S.p.a. with registered office in Cagliari, Viale Trieste 159/3, certified email address: ctmspa@legalmail.it, fax 070 2091 222.

The "Data Controller", in compliance with the provisions of art. 37 GDPR, has appointed the Data Protection Officer (DPO). DPO contact details: rpd@ctmcagliari.it

The data you provide will be processed for the following purpose: to allow the sending of the request for information and/or sending of complaints by the user and for the management of the relative request.
The processing of your data for the purposes stated above is necessary to follow up on the request to receive information and/or to manage the complaint. The legal basis of the trattraction is the execution of a contractual obligation or legitimate interest of the Data Controller in the correct management of relations with potential third parties.
For the aforementioned purposes, the transmission of special categories of personal data is not required; if the user spontaneously releases such information, the unsolicited data, as other than for the purposes ofdeclared, will be immediately deleted and destroyed. In any case, even if the particular data are necessary for the pursuit of the purposes indicated above, the processing will be considered carried out with the explicit consent of the interested party, manifested through the voluntary provision of such data.

The processing of data is carried out through paper media or computer procedures by specially authorised internal subjects. They are allowed access to your personal data to the extent and to the extent that it is necessary for the performance of the processing activities concerning you.
In addition, to ensure your confidentiality and the integrity of the INFpersonal data provided to us, personal data will be processed in such a way as to ensure adequate security, including protection, through appropriate technical and organisational measures.

CTM S.p.a. periodically checks the tools by which the data are processed and the security measures envisaged for them, which require constant updating; checks, also for theof the subjects authorized to process, which are not collected, processed, stored or stored personal data whose processing is not necessary or whose purposes are exhausted; verifies that the data are stored with the guarantee of integrity and authenticity and their use for the purposes of the processing actually carried out.
Your personal data will be conserfor the purposes referred to in this policy and for 5 years from receipt of the request, except for the period necessary for the definition of any disputes.

Your data will be stored at the aforementioned registered office of the Data Controller and may be communicated to other recipients for the performance of the regulatory obligations, for this purpose, provided for.
Your data may be processed by persons in charge of managing the request and/or request made and, only for occasional technical interventions, by subjects (appointed Data Controllerof the processing) that provide assistance and maintenance to the Computer System of CTM S.p.a.

The communication of personal data for the purposes stated above is optional but necessary to use the requested services. Any failure or incorrect communication by you of any of the information necessary to us and marked as mandatory, will have as main possible consequences the inability to respond to a request for information and/or istcomplaint. Failure to communicate information not marked as mandatory will not have any consequence on the provision of the requested service.
It will be your responsibility to inform the Data Controller of any change in the data subjected to processing, in order to guarantee the correct use of the requested services, without prejudice to your right to rectificationapprox.

As a Data Subject, you may exercise, at any time, the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR), the right to data portability (Art. 20 GDPR) and the right to object (Art. 21 GDPR) in the manner indicated in the same articles, to which reference is expressly made. You have the right to withdraw your consent at any time. The revocation of consent does not affect the lawfulness of the processing based on consent before revocation (Art. 7 GDPR).
For the exercise of the aforementioned rights, and for any further information and communication regarding their data, theData Subject may contact the Data Controllerprocessing through the communication channels indicated above.

Without prejudice to any other administrative or judicial appeal, the data subject who considers that the processing concerning him/her violates Regulation (EU) 2016/679 has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which he/she usually resides, works or in the place where the alleged violation occurred.

To revoke the consent givenyou can send an email to the following address: gruppoprivacy@ctmcagliari.it, indicating in the subject "Revoke consent to complaints".