Pursuant to Regulation (EU) 2016/679, which establishes rules relating to the protection of natural persons with regard to the processing of personal data, CTM S.p.a. is required to provide you with the following information regarding the processing of your personal data. The data, in accordance with the principles set out in Article 5 of Regulation (EU) 2016/679, will be: processed in a lawful, correct and transparent mannerentity, processed for specific, explicit and legitimate purposes and in a manner compatible with those purposes, adequate, relevant and limited with respect to the purposes, accurate and up-to-date, kept for a period of time not exceeding the achievement of the purposes, and processed in such a way as to ensure adequate security, integrity and confidentiality through appropriate technical and organizational measures.
CTM S.p.a., as Data Controller, informs that drive recorder devices have been installed on all buses and trolleybuses to reconstruct the dynamics of road accidents and passenger accidents, in compliance with current legislation.
A summary information, contained in special notice signs, is posted at each of thezzi supervised by the system.
Holder
The Data Controller is CTM S.p.a. based in Cagliari, Viale Trieste 159/3. At any time, you can contact the Data Controller through the following channels: e-mail/certified email: ctmspa@legalmail.it, fax 070 2091 222.
Data Protection Officer
CTM S.p.a. has appointed the Data Protection Officer (DPO) who can be contacted at the following address: rpd@ctmcagliari.it
Purpose and legal basis of processing
With the installation of the drive recorder systems, your personal data will be processed for the following purposes:
- support the kinematic reconstruction of claims involving CTM buses and trolleybuses
- safeguard the assets of the companyto fraudulent behaviour as well as increase the safety of users and employees
- significantly reduce claims litigation
- preconstitute a means of evidence for purposes of justice to protect a subjective right of the data controlleror third parties involved in a claim.
The legal basis of the processing is the pursuit of the legitimate interest of the Data Controller.
Processing methods and data retention period.
The data are processed in electronic format and kept secure and made accessible only to subjects specifically authorised by the Data Controller. Under no circumstances will CTM S.p.a. disseminate the images to the public.
Personal data will be kept for a period of time not exceeding the achievement of the purpose, referred to in this policy and specifically:
- drive recorder devices retain a total of 300 images which are then progressively erased by overwriting.
Only in the event of claims, the images are extrapolated and stored for the periods specified below:
- inin the case of claims with damage to property, no later than two years from the last act put in place or until the definition, with a final judgment, of any judicial proceedings;
- in the case of claims with damage to persons, no later than five years from the last act in place or until the definition, with a past sentencein res judicata, of any legal proceedings;
- in the case of claims with deceased, no later than ten years from the last act put in place or until the definition, with a final judgment, of any judicial proceedings.
Data Recipients or Categories of recipients.
The data collected and processed may be disclosed exclusively for the purposes specified above to the following recipients: Insurance Companies of the Company and their Claim Inspectorates, Companies that provide assistance and maintenance on hardware and software applications, Legal and Consultants of the Company, FGVS Insurance Company, Judicial Authority, Fof the Order, Law Firms, Insurance Companies and Claim Inspectorates of the counterparty, Road Accident Practices Agencies.
Data Subject Rights
As a Data Subject, you may exercise, at any time, the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR), the right to data portability (Art. 20 GDPR) and the right to object (Art. 21 GDPR) in the manner indicated in the same articles, to which reference is expressly made.
For the exercise of the aforementioned rights, the data subject may contact the Data Controller using the contact details indicated above.
Right to complain
Event reporting mode
Anyone who wants to report a crime committed on board one of our buses equipped with an internal video surveillance system (theft, pickpocketing, harassment...), must promptly report the incident to the Police in order for them to request the CTM to extract the images before 72 hours have elapsed since the event.
Therefore, in order to recover the filmregarding the event, the data subject must:
– Take note of the place, date and time of the event, line, bus company number (e.g.: via Liguria, 25/03/2013, 1:45 pm, line 3, bus 345)
– Make a regular complaint as soon as possible to the Law Enforcement
CTM, once the formal request has been received from the Judicial Authoritiesto or of the Law Enforcement, provides for the delivery of the footage, exclusively to the requesting Authority.