Data subjects and scope of processing: Persons filmed by video surveillance systems

 

ABOUT US

Azienda Veneziana della Mobilità S.p.A (hereinafter referred to as AVM), with its registered office in Venice, Isola Nova del Tronchetto 33, is the Data Controller of the personal data that it collects; it manages and provides the urban public transport service of the municipalities of Venice and Chioggia, the suburban transport service of the central-southern area of the metropolitan city of Venice, as well as the private and integrated mobility services of the municipality of Venice (parking facilities, exchange car parks, docks, BiciPark, etc.).
It is the parent company of the AVM Group and controls ACTV S.p.A. and Ve.La. S.p.A.

The Data Controller operates a 24-hour video surveillance system in the area of its premises. The images will be processed with the aid of electronic tools in compliance with the Italian Law governing the protection of personal data and the General Provision dated April 8 2010 issued by the Italian Data Protection Authority, which does not require prior consent from the interested party.

THE PERSONAL DATA THAT MAY BE COLLECTED FROM YOU

In the framework of the activity, we may collect and then process various categories of common personal data, namely: vehicle identification data (licence plate number, vehicle description), image, footage and video surveillance system recordings.

PURPOSES FOR WHICH YOUR DATA MAY BE USED

Specifically, Your personal and contact data will also be used for the following purposes necessary for the fulfilment of the holder's legitimate interest:

• requirements in terms of organisation, production, work safety and the protection of company assets as a result of the installation of audiovisual equipment and/or other instruments that also allow for remote monitoring of the activities of workers, in order to increase the safety and security within the premises of the Company;
• the protection of company assets.

HOW YOUR PERSONAL DATA IS PROCESSED

All of your personal data is stored in our records or the records of our suppliers or business partners and it is accessible and used in compliance with our security standards and policies (or the equivalent standards applied by our suppliers or business partners).

Your personal data may be processed using the following methods:

• a video surveillance system, installed in compliance with all the applicable regulations (and therefore, where necessary, following trade union agreements).

We use a wide range of security measures to improve the protection and maintenance of the security, integrity and accessibility of your personal data.

The measures we implement include, and are not limited to, the following:
- strict restriction of access to your personal data, on a need-to-know basis and only for the specified purposes;
- perimeter security systems to prohibit unauthorised access from external sources;
- permanent monitoring of access to information systems in order to detect and stop the misuse of personal data;
- vulnerability tests, aimed at highlighting any gaps in perimeter security;
- tracking of access to your personal data by our staff and the control of the purpose it serves;

- double-factor authentication;

- encryption using Secure Socket Layer (SSL) technology in the case of transactions on our websites that require you to submit your personal data.

If we have provided you with (or you have chosen) a password that allows you to access certain areas of our website or other portals, applications or services provided to you by our company, please remember to keep this password secret and to also follow any other security procedures that are provided to you.

WHO WE CAN SHARE YOUR PERSONAL DATA WITH

Your data is only processed by our specifically instructed and authorised staff and, more specifically, by the following categories of staff:

• AVM employees in the specific relevant departments.

In order to execute some of the processing activities, we may communicate your personal data to the following categories of external parties, who will process them either as independent data controllers or as data processors, duly appointed in compliance with the applicable legislation:

• subsidiary and associated companies;
• consulting and IT services companies.

Your personal data will not be otherwise disclosed.

HOW LONG WE RETAIN YOUR INFORMATION

In compliance with the principles of lawfulness, purpose limitation and data minimisation, in compliance with Article 5 of the GDPR, we retain your personal data only for the time necessary to achieve the purpose for which it was collected or for any other legitimate related purpose. Therefore, if personal data is processed for two separate purposes, we retain that data until the purpose with the longer retention period expires, but we do not continue to process personal data for the purpose for which the retention period has expired. We restrict access to your personal data only to the subjects who require them to fulfil their tasks.

The personal data that are no longer required, or for which there is no longer a legal requirement for the retention thereof, is irreversibly anonymised (and as such can be safely stored) or destroyed.

Below are the retention times in relation to the purposes listed above:

• Footage is stored for 3 days when recording vehicles (buses) and 5 days when recording waterbus stops. If footage is necessary for the defence, prosecution, or advancement of claims against the interested subject or a third party, personal data may be retained for as long as is reasonably necessary for such purposes.

YOUR DATA PROTECTION RIGHTS AND YOUR RIGHT TO LODGE COMPLAINTS WITH THE SUPERVISORY AUTHORITY

You are entitled to obtain, if the conditions provided for by law are met, confirmation as to whether or not personal data concerning you exist, to have them communicated to you in an understandable form and to lodge a complaint with the supervisory authority.
More specifically, you are entitled to be provided with:

1. access to your personal data and all related information (Article 15 of the GDPR);
2. the correction of inaccurate personal data and the integration of incomplete personal data (Article 16 of the GDPR)
3. the erasure of personal data if any of the cases specified in Article 17 of the GDPR exist
4. the restriction of the processing of your personal data if any of the conditions specified in Article 18 of the GDPR exist
5. the portability of personal data (Article 20 of the GDPR)

You are entitled to object, in whole or in part, to the processing of personal data relating to you:

1. for legitimate reasons associated with your particular situation, even if they are relevant to the purpose of the data collection.

CONTACT DETAILS

Please be informed that the Data Controller is Azienda Veneziana della Mobilità S.p.A (Isola Nova del Tronchetto 33, 30135 Venice (VE), VAT No. 03096680271, contact details: e-mail avm@avmspa.it, telephone + 39 041 27 22 111).

We also inform you of the fact that we have appointed an external Data Protection Officer (DPO), whom you are entitled to contact as a general contact on issues relating to the protection of your personal data and associated rights.
If you have any complaints or concerns about how we process your personal data, we will make every effort to respond to your concerns. In any case, and if you prefer, you may forward your complaints or remarks to the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), using the contact details listed at the following website www.garanteprivacy.it

• DPO Data Protection Officer (e-mail contact details:  dpogruppoavm@avmspa.it).

The updated version of this policy is also available at all times on the following website https://www.privacylab.it/informativa.php?21285466584.