We apologize for the inconvenience. Currently this section is available only in Italian
ATAC S.p.A. - Azienda per la Mobilità, in its capacity as Data Controller, hereby informs the user/passenger (hereinafter, the “User” or the “Data Subject”) who uses the on-demand Local Public Transport service of Roma Capitale made available via the “ClicBus Atac” App (hereinafter, “ClicBus Atac” or the “App”) and/or via the ATAC call centre (hereinafter, the “On-Demand Service” or the “Service”) that Personal Data will be processed for the purposes and according to the methods described below.
The Data Controller is ATAC S.p.A. - Azienda per la Mobilità, with registered office at Via Prenestina, 45 – 00176 Rome, Italy, Tax Code and VAT No. 06341981006 (hereinafter, “ATAC” or the “Controller”), which can be contacted by:
ATAC has appointed a Data Protection Officer (“DPO”), who can be contacted at the following e-mail address: responsabileprotezionedati@atac.roma.it.
The Personal Data indicated below are collected, depending on the circumstances, directly from the Data Subject, either through the App, by means of the forms used for account creation and for booking, modifying or cancelling a ride, or through ATAC call centre operators, who enter booking data into the system on behalf of the User.
Personal Data are also collected from the Data Subject’s device, within the limits of any permissions granted, for example for the use of geolocation aimed at facilitating the identification of the departure point, as well as generated by the operation of the platform and by the provision of the Service, with particular reference to booking status, timings, any no-shows or late cancellations, and technical and usage data strictly connected with the On-Demand Service.
ClicBus Atac is not intended for persons under 14 years of age. Any requests for booking or use of the On-Demand Service relating to a minor must be submitted by a parent or legal guardian, acting in the interest of the minor and providing only the data strictly necessary for the management of the Service and the provision of the requested ride.
Depending on the processing purposes indicated in the following Section 4, ATAC may process the following categories of the User’s Personal Data:
a) Identification and contact data:
first name, last name, telephone number, e-mail address, as well as authentication and verification data used for the creation and management of the account and for access to the Service, such as the One-Time Password (OTP) code.
b) Booking and ride management data:
pick-up and destination points for the ride, selected addresses or points of interest, any favourites or pins added on the service area map, date and time of the ride, type of request (for example, immediate ride or advance booking), booking status, any changes, cancellations, no-shows, late cancellations, as well as data relating to the performance of the ride, such as the actual departure time and any operational anomalies.
c) Technical and App usage data:
information generated through the use of the App and necessary for its operation, relating to the operating system and the App version.
d) Access and system logs:
technical records of accesses, events and relevant operations performed on the App and on the system.
e) Location/geolocation data:
location data relating to the User’s device, processed only where the Data Subject has enabled the relevant function on their device and solely within the limits necessary to facilitate identification of the departure point or to enable location-based functionalities made available by the Service.
Where, in specific cases connected with a request for the Service, the User communicates to ATAC Personal Data relating to third parties, the User undertakes to do so in compliance with applicable legislation and to inform such third parties about the processing of their Personal Data in accordance with the terms set out in this Privacy Notice.
Special Categories of Data within the meaning of Article 9 of the GDPR (hereinafter, the “Special Categories of Data”) are processed exclusively, where necessary, in the context of the provision of the On-Demand Service, limited to information communicated by the Data Subject relating to assistance needs for persons with reduced mobility, to the extent that such data are necessary to ensure the required level of assistance.
(Hereinafter, “Personal Data” shall mean, jointly, “Personal Data” and “Special Categories of Data”, or either of them, depending on the context.)
ATAC processes the Data Subject’s Personal Data for one or more of the following purposes, on the basis of the corresponding legal grounds indicated below.
ATAC processes identification and contact data and, within the limits strictly necessary, technical and usage data relating to the App and the Service in order to enable registration with ClicBus Atac and the management of the personal account, access to the restricted area, User authentication and the continued use of the Service functionalities, including through the ATAC call centre.
ATAC also processes such data for sending operational and recurring communications strictly connected with the account and its security, as well as communications necessary to complete access or ensure the correct use of the App functionalities (e.g. One-Time Password (OTP) codes, technical confirmations and security alerts).
This purpose also includes activities strictly necessary for the technical and administrative management of the account, including account deactivation or deletion requests.
Where the Data Subject provides, during account creation, information relating to assistance needs for persons with reduced mobility, ATAC will also process Special Categories of Data in order to record such information and provide the Service with the required level of assistance.
Legal basis:
For identification and contact data and for technical and usage data relating to the App and the Service, performance of a contract or pre-contractual measures taken at the request of the Data Subject pursuant to Article 6(1)(b) GDPR.
Where Special Categories of Data relating to assistance needs for persons with reduced mobility are processed, the legal basis is the performance of a task carried out in the public interest pursuant to Article 6(1)(e) GDPR, in conjunction with Article 2-ter(1-bis) of Legislative Decree No. 196/2003, as amended (the “Italian Privacy Code”), and, with regard to Special Categories of Data, Article 9(2)(g) GDPR, in conjunction with Article 2-sexies(1) and (2)(aa) of the Italian Privacy Code, within the framework of the non-discrimination and assistance obligations provided for by Articles 9, 13 and 14 of Regulation (EU) No. 181/2011.
Provision of data is necessary to create the ClicBus Atac account and use the Service. Failure to provide such data will prevent ATAC from enabling account creation and access to the On-Demand Service.
Provision of Special Categories of Data during account creation is optional, as, if such information is not provided, the User may provide it when making an individual booking in order to receive the required assistance.
ATAC processes identification and contact data and booking and ride management data in order to enable booking of rides, any subsequent modification or cancellation, the operational management of transport requests, vehicle assignment, ride performance and, more generally, the provision of the Service throughout the entire usage lifecycle.
ATAC also processes such data to send communications strictly connected with the specific booked ride and its performance, including, by way of example, ride notifications and reminders, notices concerning changes, delays, cancellations, non-provision of the Service or other operational anomalies.
Where the Data Subject enables geolocation on their device, ATAC will also process location/geolocation data exclusively within the limits strictly necessary to facilitate identification of the departure point or enable the location-based Service functionalities requested by the User.
Where the Data Subject voluntarily provides, during booking, information relating to assistance needs for persons with reduced mobility, ATAC will also process Special Categories of Data to the extent necessary to ensure provision of the Service with the required level of assistance.
Legal basis:
For identification and contact data, booking and ride management data and, where enabled by the User, location/geolocation data, performance of a contract or pre-contractual measures taken at the request of the Data Subject pursuant to Article 6(1)(b) GDPR, as the processing relates to the provision of the Service and the specific functionalities requested.
Where Special Categories of Data relating to assistance needs for persons with reduced mobility are processed, the legal basis is the performance of a task carried out in the public interest pursuant to Article 6(1)(e) GDPR, in conjunction with Article 2-ter(1-bis) of the Italian Privacy Code, and, with regard to Special Categories of Data, Article 9(2)(g) GDPR, in conjunction with Article 2-sexies(1) and (2)(aa) of the Italian Privacy Code, within the framework of the non-discrimination and assistance obligations provided for by Articles 9, 13 and 14 of Regulation (EU) No. 181/2011.
Provision of data is necessary to enable booking of the ride and any subsequent modification or cancellation. Failure to provide such data will prevent ATAC from enabling use of the Service.
Provision of Special Categories of Data during booking is optional, as, in the absence of such information, the User may still use the Service but will not be able to receive the requested assistance for persons with reduced mobility.
ATAC processes identification and contact data in order to send Users general informational communications relating to the Service and, more generally, to mobility in the served areas, which are not strictly connected with a specific booked ride.
Such communications may include, by way of example, information on planned changes to the Service, temporary suspensions or limitations, changes to booking or usage procedures, traffic issues, diversions, organisational updates or other circumstances that may affect the regular operation and use of the Service.
Legal basis:
ATAC’s legitimate interest pursuant to Article 6(1)(f) GDPR, consisting in promptly informing Users of the Service about general circumstances that may affect ClicBus Atac.
The Data Subject has the right to object to such processing at any time pursuant to Article 21 GDPR.
No specific provision of data is required, as ATAC will process, where necessary, data already collected for other purposes, as this additional purpose is connected and compatible with the original purposes.
ATAC processes identification and contact data, booking and ride management data and additional profile and preference data, limited to feedback and Service satisfaction information, in order to assess the User’s level of satisfaction with the Service provided, including through surveys, feedback requests, questionnaires or other customer satisfaction tools, as well as to use the information collected to improve the quality of the Service.
Legal basis:
ATAC’s legitimate interest pursuant to Article 6(1)(f) GDPR, consisting in assessing User satisfaction and improving the quality of the Service.
Provision of data for this purpose is optional and failure to provide such data will not affect registration or use of the Service.
The Data Subject has the right to object to such processing at any time pursuant to Article 21 GDPR.
ATAC processes identification and contact data, booking and ride management data and technical and usage data relating to the App and the Service in order to analyse the performance of the Service, prepare operational and statistical reports, monitor volumes, support organisational and planning decisions, as well as manage no-shows, late cancellations and prevent improper or circumvention-based use of the Service.
This purpose also includes the consultation, extraction and analysis of Service data through the tools made available by the platform, as well as the possible adoption of organisational measures connected with repeated instances of User no-shows.
Legal basis:
ATAC’s legitimate interest pursuant to Article 6(1)(f) GDPR, consisting in ensuring the correct operation, reliability, efficiency, organisational sustainability and improvement of the Service.
No specific provision of data is required, as ATAC will process, where necessary, data already collected for other purposes, as this additional purpose is connected and compatible with the original purposes.
The Data Subject has the right to object to such processing at any time pursuant to Article 21 GDPR.
Subject to the specific consent of the Data Subject, ATAC will process identification and contact data and booking and ride management data in order to send newsletters and promotional or commercial communications relating to initiatives, services, benefits, campaigns or other opportunities offered by ATAC.
Such communications may be sent through automated contact methods (including, by way of example, e-mail, Short Message Service (SMS), push notifications, instant messaging systems or other mass messaging tools that may be used by ATAC) and, where applicable, through traditional communication methods.
Legal basis:
Consent of the Data Subject pursuant to Article 6(1)(a) GDPR.
Provision of data for this purpose is optional and failure to provide consent will not affect registration or use of the Service.
Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.
The Data Subject may also object at any time to receiving promotional communications through all or only some of the contact methods indicated above.
ATAC processes the Data Subject’s Personal Data in order to comply with obligations to which it is subject under applicable legislation, including obligations arising from laws, regulations and European and national legislation on public transport and passenger rights, as well as to implement provisions, requests, orders or measures issued by public authorities, supervisory and control bodies or other entities authorised by law.
Legal basis:
Compliance with a legal obligation to which ATAC is subject pursuant to Article 6(1)(c) GDPR.
Where, in this context and in the cases provided for by applicable legislation, Special Categories of Data are processed, processing will take place pursuant to Article 9(2)(g) GDPR, in conjunction with Article 2-sexies of the Italian Privacy Code.
Provision of data is necessary to the extent required for compliance with the relevant legal obligation. Failure to provide such data will prevent ATAC from correctly fulfilling its obligations.
ATAC processes Personal Data in order to manage complaints, disputes, reports, claims, incidents or other harmful events occurring in connection with the provision of the Service, as well as to prevent, identify and counter any abusive, fraudulent or evasive conduct relating to the use of ClicBus Atac, the User account, the booking system and the functionalities connected with the Service.
ATAC may also process Personal Data in order to establish, exercise or defend its own rights or the rights of third parties before judicial, administrative, out-of-court or insurance bodies.
Legal basis:
ATAC’s legitimate interest pursuant to Article 6(1)(f) GDPR, consisting in managing complaints, claims and disputes, preventing and countering abusive, fraudulent or evasive use of the Service, and protecting the rights of ATAC or third parties.
Where, in this context, Special Categories of Data are processed, processing will take place, within the limits of strict necessity, pursuant to Article 9(2)(f) GDPR.
No specific provision of data is required, as ATAC will process, where necessary, Personal Data already collected for other purposes, as this additional processing is connected with the original purposes or required by applicable legislation.
ATAC processes Personal Data mainly through IT and electronic tools and, where necessary, also through telephone-based methods, according to procedures strictly related to the purposes indicated in the previous Section 4 and in compliance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, integrity and confidentiality provided for by the GDPR.
Processing is carried out in such a way as to limit the use of Personal Data to what is strictly necessary in relation to each purpose pursued.
Personal Data may be processed both through the “ClicBus Atac” App and through the ATAC call centre, as well as through the application platform and the tools used for the operational management of the On-Demand Service.
ATAC adopts appropriate technical and organisational measures to ensure the security of Personal Data and to prevent unauthorised access, loss, destruction, unlawful disclosure or misuse thereof.
Personal Data may be processed, on behalf of ATAC and within the limits of their respective responsibilities, by internal personnel expressly authorised and instructed pursuant to Article 29 GDPR, including, in particular, call centre operators and personnel responsible for operational control activities and Service management.
For the purposes indicated in this Privacy Notice, Personal Data may also be disclosed, strictly where necessary, to the following categories of recipients:
Personal Data may also be disclosed to public authorities, supervisory and control bodies, public entities, institutional bodies or other authorised parties, where provided for by law, regulations or measures issued by the competent authorities, or where such disclosure is necessary to comply with legal obligations or to respond to lawful requests, orders or requirements.
Such recipients process Personal Data, depending on the circumstances, either as data processors appointed pursuant to Article 28 GDPR or as independent data controllers.
An updated list of data processors may be requested at any time from the Data Controller using the contact details indicated in Section 1.
Personal Data are not subject to disclosure to the public.
Personal Data are processed mainly within the European Economic Area (EEA).
However, the use of certain tools and/or service providers may, on a residual basis, involve transfers of Personal Data to countries outside the European Union or the EEA.
Such countries include, in particular, the United States, Israel and the United Kingdom.
In such cases, transfers are carried out in compliance with Chapter V of the GDPR, on the basis of an adequacy decision where available, or through the adoption of appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission, supplemented, where necessary, by additional measures suitable to ensure a level of protection essentially equivalent to that guaranteed within the European Union.
ATAC retains Personal Data for no longer than is necessary to achieve the purposes for which they are collected and processed, in compliance with the principle of storage limitation set out in Article 5(1)(e) GDPR.
Once the applicable retention period has expired, Personal Data are deleted or irreversibly anonymised, unless their further retention is necessary to comply with legal obligations, respond to requests from competent authorities, or establish, exercise or defend rights in judicial, administrative or out-of-court proceedings.
In any case, for technical reasons, the cessation of processing and the consequent final deletion or irreversible anonymisation of Personal Data may be completed within 7 days from the date of the request or within any longer period strictly necessary for technical reasons.
The retention periods applicable to the different purposes described above are indicated below:
The Data Subject may, at any time, exercise the rights provided for under Articles 15 to 22 GDPR by contacting ATAC in order to request:
Right to object
In addition to the rights listed above, the Data Subject has the right to object at any time, on grounds relating to their particular situation, to the processing of Personal Data carried out for the pursuit of the Controller’s legitimate interest, as well as to processing carried out for marketing purposes.
The Data Subject may exercise the above rights by completing and submitting the relevant form available at the relevant link, or by sending a certified e-mail (PEC) to protocollo@cert2.atac.roma.it or, alternatively, by registered post with acknowledgement of receipt to the registered office address of ATAC (see the contact details indicated in Section 1).
If the Data Subject believes that the processing of Personal Data infringes the GDPR, they have the right to lodge a complaint with the Italian Data Protection Authority (“Garante per la protezione dei dati personali”), using the contact details available on the website www.garanteprivacy.it, or to seek judicial remedy.