Privacy Notice

NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLE 13 OF REGULATION (EU) NO. 2016/679

Pursuant to and for the purposes of Article 13 of Regulation (EU) No. 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, also known as the General Data Protection Regulation (hereinafter, the "GDPR"), we hereby inform you that the personal data you voluntarily provide to International Shore Services, hereinafter ISS, while browsing the website www.transferandcruise.com (hereinafter, the "Website") or within the App (hereinafter "Transfer&Cruise App") will be subject to processed in compliance with current legislation on the protection of personal data, meaning: the GDPR, Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 (hereinafter the "Privacy Code"), as well as the provisions issued from time to time by the Italian Data Protection Authority (hereinafter the "Data Protection Authority"), and, in any case, in accordance with the principles of confidentiality that guide the Company’s activities.

Categories of personal data processed

ISS will process the following categories of personal data that you provide:

browsing data, such as, for example, information regarding the device used to browse the Transferandcruise Website/App and/or make purchases, IP address, cookies, etc.

While browsing the Website, particularly with regard to the use of cookies, ISS informs you that, in accordance with the provision issued by the Italian Data Protection Authority on June 10, 2021, the Website’s Cookie Policy is available at the following link, containing all the information you need to understand, identify, use, or delete the cookies used on the Website;

personal information, such as, for example, the first and last names of the purchaser and any additional passengers, tax ID number, VAT number, etc.;
contact information, such as, for example, customer ID, email address, and phone number;
bank and/or payment information;
health-related data, only to the extent necessary to achieve the specific purpose referred to in subparagraph (c) of paragraph 2 below;
location data, including GPS location data, if you have enabled access to location services on your device.

Purpose and legal basis of the processing

Personal data provided to ISS through the Transferandcruise website/app may be used for the following purposes:

a) obligations related to the use of the Transferandcruise Website/App, such as, by way of example, the activation through registration, and subsequent management and technical security maintenance, of accounts to manage access to the Transferandcruise Website/App and/or the services made available therein, as well as passwords or similar authentication credentials, the management and processing of your requests for information; submitted by filling out forms on the Transferandcruise Website/App, etc.;
b) compliance with legal obligations to which the Company is subject, including administrative and/or accounting obligations;
c) with regard to the personal data of users who intend to use the services offered by ISS to passengers with reduced mobility, compliance with the legal obligations to which the Company is subject regarding assistance to persons with disabilities or reduced mobility as referred to in Regulation (EU) No. 181/2011 of the European Parliament and of the Council of February 16, 2011;
d) obligations related to the performance of a contract, pre-contractual measures, and/or the provision of services, such as, for example, the establishment and conduct of the contractual relationship with ISS regarding the transport service you requested, customer support related to the services and/or products you purchased through the Transferandcruise Website/App (so-called “customer service”), etc.;
e) obligations related to the need to establish, exercise, or defend a right in court or in administrative proceedings, or in the context of arbitration or conciliation proceedings;
f) direct marketing of services similar to those you have purchased, in accordance with the provisions of Article 130, paragraph 4, of the Privacy Code (so-called "soft spam"). The Company may use the email address you provided when purchasing the ticket. However, you may, at any time (initially or in response to subsequent communications), object to such processing, including by submitting a specific request to the Data Controller, in accordance with the provisions of paragraph 8 below of this policy;
g) the conduct of promotional activities (so-called "marketing") and the sending of informational and promotional communications – by ISS – regarding products and services offered by ISS and its business partners, and/or price reductions on your searches, via mail, the Internet, telephone, and email – including newsletters and direct email marketing – MMS, SMS, including for the purpose of conducting market research (so-called "customer satisfaction");
h) with regard to the personal data of users registered in the restricted area of the Transferandcruise Website/App, the performance of profiling activities carried out to analyze tastes, preferences, habits, needs, and consumption choices in order to receive personalized offers based on purchasing preferences;
i) provide users with information about the nearest bus stops and the services available in the area where they are connected.

The processing of data for the purposes set forth in subparagraphs (b) and (c) does not require your consent, as it is necessary to comply with the legal obligations to which the Company is subject, pursuant to Article 6(1)(c) of the GDPR. In particular, the processing of data for the purpose set forth in subparagraph (c) is necessary to comply with the legal obligations regarding assistance to persons with disabilities or reduced mobility referred to in Regulation (EU) No. 181/2011, pursuant to Article 6(1) (c) and Article 9(2)(b) of the GDPR.

The processing of data for the purpose described in subparagraph (d) does not require your consent, as it is necessary for the fulfillment of contractual and/or pre-contractual obligations, pursuant to Article 6(1)(b) of the GDPR.

The processing of data for the purposes listed in subparagraphs (a), (e), and (f) does not require your consent, as it is necessary for the pursuit of a legitimate interest of the Company, pursuant to Article 6(1)(f) of the GDPR and/or Article 130(4) of the Privacy Code.

The processing of data for the purposes listed under g), h), and i) requires your consent pursuant to Article 6(1)(a) of the GDPR.

Methods of processing

Personal data will be processed using appropriate paper-based, electronic, and/or telematic means, in accordance with procedures strictly related to the purposes set forth above and, in any case, in a manner that ensures the security and confidentiality of the data.

Provision of Data and Consequences of Refusal

The provision of personal data for the purposes listed in subparagraphs b), c), and d) of paragraph 2 above is necessary for the fulfillment of legal and/or contractual obligations. Any refusal to provide such data and/or the provision of inaccurate and/or incomplete information could result in the following consequences:

(i) the Company’s inability to comply with all requirements imposed by applicable law; which are essential and/or otherwise related to the establishment and/or performance of the contractual relationship to which it is subject;
(ii) the inability to enter into the transportation contract and/or to ensure the proper and timely performance of the relevant contractual relationship, including customer support services related to the services and/or products you have purchased through the Transferandcruise Website/App (hereinafter “customer service”).

The provision of personal data for the purposes listed in subparagraphs (a), (e), and (f) of paragraph 2 above is necessary for the pursuit of the Company’s legitimate interests as indicated above. Any refusal to provide such data and/or the provision of inaccurate and/or incomplete information could result in the following consequences:

i) the Company’s inability to fulfill its obligations related to the use of the Transferandcruise Website/App, including the management and processing of your requests for information submitted by filling out forms available on the Transferandcruise Website/App;
(ii) the Company’s inability to establish, exercise, or defend a right in court or in administrative proceedings, or in arbitration or conciliation proceedings;

iii) the Company’s inability to engage in direct sales of services similar to those you have purchased, in accordance with the provisions of Article 130, paragraph 4, of the Privacy Code.

The provision of personal data for the purposes listed in subparagraphs (g), (h), and (i) of paragraph 2 above is optional; however, a refusal to provide such data and/or the provision of inaccurate and/or incomplete information could result in:

i) the Company’s inability to contact you and/or send you informational and commercial communications, including those of a promotional nature, advertising material, and/or offers of goods and services from ISS, as well as to conduct market research;
(ii) the Company’s inability to analyze tastes, preferences, habits, needs, and consumption choices and to send personalized offers based on purchasing preferences;

iii) the Company’s inability to provide information regarding the nearest bus stops and the services available in the geographic area where the connection is made.

Recipients or categories of recipients of personal data

Your personal data may be disclosed to shareholders, members of the board of directors, or other administrative bodies, as well as to the Data Protection Officer, external data processors, data processing officers, and/or authorized data processors designated by the Company in the performance of their duties.

Your personal data may be disclosed to any parties that provide the Company with services or support services necessary for the purposes indicated in paragraph 2 above, such as, by way of example only, individuals, entities, and/or companies that manage and/or participate in the management and/or maintenance of the websites and the electronic and/or telematic tools used by us.

Your personal data may also be disclosed to suppliers, contractors, subcontractors, banks, and/or insurance companies, consultants who assist ISS in various capacities, particularly with regard to legal, tax, social security, accounting, and organizational matters; to law enforcement agencies or judicial authorities in the context of police or judicial investigations for the purposes of preventing, detecting, or prosecuting crimes; any other party to whom the data must be disclosed pursuant to an express provision of law.

Transfer of Data to Third Countries

Your personal data may be disclosed and/or transferred abroad, in accordance with the provisions of applicable law, including to countries outside the European Union.

In all such cases, the transfer is carried out on the basis of an adequacy decision by the Commission (Article 45 of the GDPR) or in accordance with standard data protection clauses or other appropriate safeguards pursuant to Articles 46 or 49 of the GDPR.

Duration of processing and retention period

Your personal data will be processed only for as long as is necessary to achieve the purposes for which it is being processed.

The data will be retained in accordance with the following criteria:

Data processed for purposes related to compliance with legal and contractual obligations and/or pre-contractual obligations referred to in letters b), c), and d) of paragraph 2, “Purposes and Legal Basis of Processing,” of this privacy notice, will be retained for a period of 10 years, unless there is a need for further retention to enable ISS to defend its rights;
The data processed for the purpose of direct sales of services similar to those you have purchased, as described in letter f) of paragraph 2, "Purposes and Legal Basis of Processing," of this privacy policy, will be retained for a maximum period of 24 months;
Data processed for marketing purposes as referred to in paragraph 2(g) "Purposes and legal basis of processing" of this privacy policy will be retained for a maximum of 24 months;
Data processed for the profiling purpose referred to in subparagraph (h) of paragraph 2, "Purposes and legal basis of processing," of this privacy notice will be retained for a maximum of 12 months;
The data processed for the purposes of pursuing the legitimate interests referred to in subparagraphs (a) and (e) of paragraph 2 of the section titled “Purposes and Legal Basis of Processing” in this privacy notice will be retained for a period not exceeding the statute of limitations applicable to the rights that may be exercised by the Data Subject, as applicable from time to time;
The data processed for the purpose of location tracking referred to in subparagraph (i) of paragraph 2 of the section titled "Purposes and Legal Basis of Processing" in this privacy policy will not be retained.

Rights of the data subject

Please be advised that at any time, with regard to your personal data, you may exercise the rights provided for within the limits and under the conditions set forth in Articles 7 and 15–22 of the GDPR.

To exercise the rights described below, please contact the Data Controller at the email address support@transferandcruise.com; we will respond to your request without delay and, in any case, within one month of receiving it.

Specifically, as a data subject, you have the right to:

to obtain confirmation as to whether or not personal data concerning you is being processed;
if processing is ongoing, to obtain access to personal data and information regarding the processing, as well as to request a copy of the personal data;
to have inaccurate personal data corrected and incomplete personal data completed;
to have your personal data erased, if any of the conditions set forth in Article 17 of the GDPR apply;
to obtain, in the cases provided for in Article 18 of the GDPR, the restriction of processing;
receive your personal data in a structured, commonly used, and machine-readable format; and request that it be transmitted to another controller, if technically feasible.

8.1. Right to object

Every data subject has the right to object at any time to the processing of their data carried out for the purpose of pursuing a legitimate interest of the Data Controller. In the event of an objection, your data will no longer be subject to processing, unless there are legitimate grounds for processing that override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of a legal claim.

8.2. Right to object and to withdraw consent regarding processing carried out for the purposes of marketing, profiling, and geolocation

With regard to the processing of data for the purposes listed under subparagraphs (g), (h), and (i) of paragraph 2, "Purposes and Legal Basis of Processing," of this privacy policy, any data subject may at any time withdraw any consent previously provided or object to the processing of their data by sending an email to support@transferandcruise.com.

Withdrawing your consent will not affect the lawfulness of processing based on the consent you gave before the withdrawal.

Objection to processing exercised in this manner also extends to the sending of commercial communications via the postal service or through telephone calls with an operator, without prejudice to the possibility of exercising this right in part, for example by objecting only to processing carried out through automated communication systems.

8.3. Right to file a complaint with the Data Protection Authority

Finally, pursuant to Article 77 of the GDPR, we remind you that you have the right to lodge a complaint with the Data Protection Authority, if you believe that your rights under the GDPR have been infringed, in accordance with the procedures outlined on the Data Protection Authority’s website, accessible at www.garanteprivacy.it.

Data Controller, Data Processors, and Data Protection Officer

The data controller is International Shore Services sarl , represented by its current legal representative , with its registered office in Geneva (Switzerland), at 14 Rue du Conseil-General.

The updated list of Data Processors is available at the Data Controller’s office and may be requested by sending an email to support@transferandcruise.com.

The Data Protection Officer can be contacted at the email address support@transferandcruise.com