This section of the website aims to outline the policies of CTM S.p.a. pursuant to Regulation (EU) 2016/679, which establishes rules relating to the protection of individuals with regard to the processing of personal data, concerning the data collected during navigation on this website.
This notice applies only to the website managed by CTM S.p.a. and not to any other websites the user may access through links.
Data controller
Following consultation of this website, data relating to identified or identifiable persons may be processed.
The data controller is CTM S.p.a., with registered office in Cagliari, viale Trieste 159/3, pec/email: ctmspa@legalmail.it, fax 070 2091 222
Data Protection Officer contact
The data controller, in accordance with Art. 37 GDPR, has appointed a Data Protection Officer (DPO). DPO contact details: rpd@ctmcagliari.it
Types of data processed
Data provided by the user
Personal data provided by users is used solely for the purpose of performing the requested service or provision, and is communicated to third parties only where necessary for that purpose. Processing of personal data is therefore carried out for the performance of contractual obligations and/or where the data controller is subject to a legal obligation.
Where processing is based on the data subject's consent, this may be given in the ways indicated from time to time. Consent can always be withdrawn at any time by contacting the data controller at the addresses above. Withdrawal does not, however, affect the lawfulness of processing based on consent prior to withdrawal.
Navigation data
The information systems and software procedures used to operate this website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of internet communication protocols.
This information is not collected in order to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.
This category of data includes IP addresses or domain names of the computers used by users connecting to the site, the addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response given by the server (success, error, etc.) and other parameters relating to the user's operating system and IT environment.
COOKIES
For more details on the processing of data carried out through the release of cookies, please see the dedicated cookie notice available at THIS LINK
Optional nature and consequences of refusing to provide data
Apart from what is specified for navigation data or what may be indicated in relation to specific types of processing within the various services offered on the website, the user is free to provide the personal data entered in the relevant request forms.
Failure to provide such data may make it impossible to obtain what is requested (for example, the sending of information materials).
In order to ensure correct management of the requested matters and services, the user is responsible for informing the data controller of any changes to the data subject to processing, without prejudice to the right to rectification.
Processing methods and personal data retention period
Data processing is carried out on paper or by computerised means by duly authorised internal staff. They are permitted access to your personal data to the extent and within the limits that such access is necessary for the processing activities relating to you. All your data, including data belonging to special categories, is subject to adequate technical and organisational measures to ensure a level of security appropriate to the risk.
Furthermore, to guarantee your privacy and the integrity of the personal information provided to us, personal data will be processed in a way that ensures adequate security, including protection by means of appropriate technical and organisational measures, from unauthorised or unlawful processing and from accidental loss, destruction or damage.
CTM S.p.a. periodically reviews the tools by which data is processed and the security measures provided for them and provides for their constant updating; it verifies, including through the authorised data processing staff, that personal data for which processing is unnecessary or whose purposes have in the meantime been exhausted are not collected, processed, archived or retained; it verifies that data is kept with a guarantee of integrity and authenticity and for the purposes of the processing actually carried out.
With regard to data belonging to special categories (data capable of revealing health status, ethnic origin, political affiliation, etc.), the periodic reviews allow CTM S.p.a. to assess their strict pertinence, non-excessiveness and indispensability in relation to the ongoing or completed relationship, provision or assignment, including with regard to data provided.
CTM S.p.a. guarantees that data which, even following reviews, proves to be excessive, irrelevant or unnecessary will not be used except for the possible retention, required by law, of the deed or document containing such data.
The data requested from you will be kept in a form that allows your identification for a period no longer than that required to achieve the declared purposes, after which your data will be permanently destroyed. Retention periods or the criteria for their determination are expressly indicated in the specific notices provided at the time of collection of personal data and before proceeding with their processing.
Recipients or categories of recipients
The processing connected to the services provided through browsing on this website takes place at the registered office of the data controller and may be communicated to other recipients for the performance of regulatory obligations provided for this purpose.
Your data may be processed by staff duly authorised and tasked with managing the services requested by the user; and, as regards navigation data, these may be processed exclusively by technically authorised staff instructed by the data controller, or by external parties to whom maintenance operations are occasionally entrusted. Companies responsible for managing and maintaining the information systems which, for purely technical reasons, may access data released on this website are appointed as data processors; the identity of these providers may be requested at any time from the data controller.
Data subject's rights
As a data subject, you may at any time exercise the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR), the right to data portability (Art. 20 GDPR) and the right to object (Art. 21 GDPR) in the ways indicated in those same articles, to which express reference is made.
To exercise the above rights, and for any further information and communication regarding your data, the data subject may contact the data controller through the communication channels indicated above.
Right to lodge a complaint with the supervisory authority
Without prejudice to any other administrative or judicial remedy, the data subject who considers that the processing relating to them infringes Regulation (EU) 2016/679 has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement.