Privacy - Lost and Found

Regulation (EU) 2016/679 (GDPR) provides for the right to protection of natural persons with regard to data processing. In compliance with this legislation, with reference to your personal data provided to us, the company CTM S.p.a. wishes to inform you in advance, pursuant to Articles 12, 13 and 14 of the GDPR, that such processing will be based on the principles of lawfulness, fairness, transferprotection of your privacy and your rights as enshrined in Article 5 of the GDPR.

The Data Controller is CTM S.p.a. with registered office in Cagliari, Viale Trieste 159/3, e-mail/certified e-mail address: ctmspa@legalmail.it, telephone 070 20911, fax 070 2091 222.

Your data will be processed exclusively for specific, explicit and legitimate purposes, and subsequently processed in such a way that it is not incompatible with these purposes. In particular, CTM S.p.a. will process your personal data for the delivery of the items you have lost on board the CTM S.p.a. buses and for any subsequent verification activities of the correct exerciselegal basis of the processing is the legal obligation to which the Data Controller is subject (Article 927 et seq. of the Italian Civil Code).

The Data subject to Processing are common data (for example personal data or contact data).

The Data is collected, in addition to directly from you, also from the finder of your data on board our vehicles.

The processing of data is carried out through manual tools and paper media by specially authorised personnel employed by CTM S.p.a. and the company entrusted with the concierge service. They are allowed access to your personal data to the extent and to the extent that it is necessary for the performance of the processing activities concerning you and towhich CTM has appointed as "External Data Processor".
CTM S.p.a. periodically checks the tools by which the data are processed and the security measures provided for them, which it constantly updates; it guarantees, also through the persons authorised to process, that no personal data are collected, processed, stored or storedwhose processing is not necessary or whose purposes are exhausted; it guarantees that the data are kept in compliance with the principles of integrity and authenticity and their use for the purposes of the processing actually carried out. CTM S.p.a. guarantees that the data that are excessive or irrelevant or non-essential will not be used except for the eventualstorage, in accordance with the law, of the deed or document containing them. Pursuant to art. 13, paragraph 2, letter a), the data requested from you will be kept in a form that allows your identification for a period of time not exceeding the achievement of the purposes, after which your data will be definitively destroyed or made anonymous. In particular, personal datathey will be stored for up to 18 months from discovery.

Documents and objects containing personal data not collected by the interested parties will be sent, after a maximum of 6 months from the date of discovery, to the Municipality of Cagliari, as required by current legislation.

The communication of personal data for the purposes stated above is optional but necessary in order to allow the storage and delivery of the objects you have lost/found on board the CTM S.p.a. buses. Any failure or incorrect communication by you of any of the information necessary for us, will have as main possible consequences the impossibilityto deliver to you the lost objects of your property in our possession. It will be your responsibility to inform the Data Controller of any change in the data processed, in order to ensure proper management, without prejudice to your right to rectification.

As a Data Subject, you may exercise, at any time, the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR), the right to data portability (Art. 20 GDPR) and the right to object (Art. 21 GDPR) in the manner indicated in the same articles, to which reference is expressly made. For the exercise of the aforementioned rights and for any further information and communication regarding their data, the Data Subject may contact the Data Controller through the communication channels indicated above.

Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the Regulation.