Privacy – Embracer

Pursuant to Regulation (EU) 2016/679, which establishes rules relating to the protection of natural persons with regard to the processing of personal data, CTM S.p.a. is obliged to provide you with the following information regarding the processing of your personal data and the data provided by you relating to other persons. The data, according to the principles set out in Article 5 of Regulation (EU) 2016/679, knowsshall be: processed in a lawful, correct and transparent manner, processed for specified, explicit and legitimate purposes and in a manner compatible with such purposes, adequate, relevant and limited with respect to the purposes, accurate and up-to-date, kept for a period of time not exceeding the achievement of the purposes, so as to ensure adequate security, integrity and confidentiality through technical measuresniche and organisational requirements.

The Data Controller is CTM S.p.a. based in Cagliari, Viale Trieste 159/3, certified email address: ctmspa@legalmail.it, telephone 070 20911, fax 070 2091 222.

The Company CTM S.p.a., in compliance with the provisions of art. 37 GDPR, has appointed the Data Protection Officer (DPO) who can be contacted at the following address: rpd@ctmcagliari.it.

The personal data of users who register with the Embracer application and request the on-call transport service provided by CTM S.p.a. will be processed for the following purposes:

1. management of the user's registration to the on-call transport service through the Embracer application;
2. travel request management and transport service planning;
3. provision of the on-call transport service requested by the user;
4. user assistance and complaint management

The processing of data forthe purposes stated above will be carried out to fulfil the contract of carriage.

The controller processes the following categories of personal data:

• identification data (name, surname);
• contact details (telephone, e-mail);
• application registration data;
• data relating to transport requests and trips made;
• payment details and accounting information;
• location data, limited to what is necessary to allow the reservation and provision of the call transport serviceaTA.

The data is collected directly from the data subject by means of an application or telephone reservation or provided by a person other than the passenger.

The processing of data is carried out through paper media or computer procedures by CTM S.p.a. personnel specifically authorised. They are allowed access to your personal data to the extent and to the extent that it is necessary for the performance of the processing activities concerning you.
In addition, to ensure your confidentiality and the integrity of theand personal information provided to us, personal data will be processed in a manner that ensures adequate security, including protection, through appropriate technical and organizational measures.
CTM S.p.a. periodically checks the tools by which the data are processed and the security measures envisaged for them, which require constant updating; checks, also for thethrough the persons authorised to process, who do not collect, process, store or store personal data whose processing is not necessary or whose purposes are exhausted; verifies that the data are stored with the guarantee of integrity and authenticity and their use for the purposes of the processing actually carried out. All the aforementioned data will be conservedfor the duration of the service trial under the Embracer Project and the subsequent cancellation request (by September 2026).

The Data Controller does not carry out processing based solely on automated decision-making processes, nor profiling activities pursuant to Art. 22 GDPR.

The personal data provided by users will be processed by CTM S.p.a. personnel specifically authorised for processing. For the provision of the on-call transport service requested through the application, personal data will also be processed by the company Lucian S.r.l., provider of the technological platform used for the management of the service appointed as Data Processorpursuant to Article 28 of Regulation (EU) 2016/679.
Personal data may also be processed by internal personnel responsible for the management and maintenance of the Data Controller's IT systems.
Only for any technical or maintenance interventions, may external parties who provide assistance and maintenance services also become aware of the personal dataone of the Data Controller's IT systems, appointed, where necessary, as Data Processors.
The identity of the persons appointed as Data Processors may be requested at any time from the Data Controller.

The communication of personal data for the purposes stated above is optional but necessary in order to follow up on the on-call transport service requested by the user.
CTM S.p.a. informs that the possible failure and/or incorrect communication of any of the necessary information could make it impossible to guarantee the adequacy of the processing itself tothe contractual agreements for which it is executed.
It will be your responsibility to inform the Data Controller of any change in the data processed, in order to ensure proper management of the contractual relationship, without prejudice to your right to rectification.

As a Data Subject, you may exercise, at any time, the following rights, as provided for in the articles of Regulation (EU) 2016/679: art. 15 – right to request the data controller to access your personal data, art. 16 – right to request the data controller to correct your inaccurate or incomplete personal data, art. 17 – right toask the Data Controller to delete your personal data, art. 18 – right to ask the Data Controller to limit the processing of your personal data, art. 20 – right to receive from the Data Controller in a structured, commonly used and machine-readable format the personal data concerning you and right to transmit such data to anotherdata controller and right to direct transmission from data controller to another data controller, if technically feasible. This right to data portability may only concern data processed by automated means and on the basis of consent or a contract, art. 21 – right to object at any time, for reasons related to your particular situation, to the processing of data fordata concerning you, art. 22 – right not to be subjected to a decision based solely on automated processing, including profiling.
For the exercise of the aforementioned rights, and for any further information and communication regarding their data, the Data Subject may contact the Data Controller through the communication channels indicated above.