• The Data Controller is Trenitalia S.p.A., with registered office in Piazza della Croce Rossa 1, Rome, Italy, represented by the pro-tempore Chief Executive Officer, and can be contacted at: titolaretrattamento@trenitalia.it.
• The Data Protection Officer can be contacted at the following email address: protezionedati@trenitalia.it.

The personal data being processed fall into the following categories:

Personal data of the complainant/user:
• Customary data regarding the complainant: personal data (name, surname, address), contact details (email).
• Customary data regarding the user (if different from the person submitting the complaint) and any other passengers involved: personal data (name and surname), copy of identity document.
• Optional data: telephone contacts, CartaFRECCIA number.
• Special Data: depending on the nature of the subject of the complaint that has been submitted, Trenitalia may become aware of personal data that falls under the “special” category (e.g. data relating to health). Due to the fact that such data has been manifestly and freely made available to Trenitalia, the claimant or user is not required to give explicit consent for the handling and processing of the complaint in question. Trenitalia would like to assure the claimant or user that such data will be processed exclusively for purposes strictly related and instrumental to the handling and processing of the complaint itself; in the absence of such personal data, Trenitalia will partially or wholly be unable to follow up your request.

The aforementioned data will be processed using electronic and paper-based formats in order to guarantee suitable measures of security and privacy.

For complaints sent via web form – Data acquired automatically while browsing the website:
to ensure the correct functioning of the website, computer systems are used that automatically acquire certain information, which is directly connected to the use of computer protocols, to maintain the proper operation of the system. This information may include, for example: IP address, type of browser used, ISP, operating system, domain name and addresses of websites from which you accessed or exited (referring/exit pages) the site, information on pages visited within the website, access times, time spent on a single webpage, internal path analysis, etc.

In the case of a complaint made with regard to a ticket for FS Treni Turistici Italiani, the personal data will be processed by Trenitalia as Data Controller. The complete policy for FS Treni Turistici Italiani can be consulted at the following link: https://www.trenitalia.com/it/fstrenituristici.html.

Personal data will be processed for the following purposes:
a. Handling and processing of the complaint (Legal basis: contractual);
b. Transfer of the complaint, which may also include potential special data, to authorised complaint handlers (Legal basis: legal – Measure 5.2 Annex A to Resolution article 28/2021 and article 9 paragraph 2 letter g) GDPR);
c. Improvement in the handling of complaints in the event of communication difficulties and/or to speed up response times through the telephone contact details provided by the data subject (Legal basis: Consent).

Provision of the data required to carry out the purposes referred to in points a) and b) is “mandatory” and therefore any refusal will make it impossible for Trenitalia S.p.A. to process the request. Provision of the data necessary to carry out the purpose referred to in point c) is “optional”; therefore, failure to provide the aforementioned data will solely result in making it impossible for Trenitalia S.p.A. to improve its management of the request and/or to speed up its response times.
Any consent given may be freely withdrawn at any time, without prejudice to the lawfulness of the processing of data carried out prior to withdrawal. Withdrawal of consent can be communicated by contacting the Data Protection Officer at the following email address: protezionedati@trenitalia.it.

In order to pursue the aforementioned purposes, your personal data will be processed by the following parties:

Parties attributable to Trenitalia S.p.A.:

• Persons authorised to process data (Trenitalia S.p.A. employees)
• IT Services companies
• Other companies from the FS Group

Parties non directly attributable to Trenitalia S.p.A.:

• Insurance services companies
• Other railway or transport companies to which the complaint will be forwarded if the subject of the complaint falls within their competence. These companies will handle the aforementioned complaint and process its associated data as Independent Data Controllers
• Transport Regulatory Authority
• Judicial authorities
• Law enforcement authorities

Your data will only be processed by parties expressly authorised by Trenitalia S.p.A. or by companies acting as Data Processors on behalf of Trenitalia S.p.A., and who have signed a specific contract that duly regulates the processing entrusted to them and their obligations regarding data protection. Your data will never be disseminated. The up-to-date list of data recipients is available by contacting the Data Protection Officer at the following email address: protezionedati@trenitalia.it.

Your personal data will never be published, displayed or made available/consultable to unspecified parties.

Personal data that has been provided to us by the data subject will be stored for 10 years from the date the complaint procedure was completed.