Dear customer, in collecting your data we try to operate in compliance with the provisions of the legislation on the protection of personal data (the so-called "privacy"), i.e. EU Regulation no. 2016/679 (also known as "GDPR") and, as applicable, the complementary Italian legislation, as well as the Measures issued by the Privacy Authority (hereinafter, cumulatively, "the Privacy Regulations"). For this reason, this policy describes how your personal data is processed, as a user who navigates and/or is registered on the website https://www.egoairways.com (hereinafter, the "Site").
If necessary, on the basis of what you have requested, this Policy may be accompanied by a specific form for the issuance of consent as provided for in Article 7 of the GDPR, articulated according to the further type of use we intend to make of your personal data.
A) About us (Identity and contact details of the Data Controller)
Your data provided with your navigation, registration to our newsletter or those relating to bookings and/or purchase of tickets are processed by EGO Airways S.p.A. with registered office in Viale Giulio Richard, 1 - 20143 Milan, (what GDPR defines as "the Data Controller" (hereinafter referred to as the "Data Controller") who can be contacted by email at the following address firstname.lastname@example.org.
B) Which data we process, for what purposes and legal basis of the processing; obligation or faculty to provide the data
Your data may be processed for various purposes, which we indicate below.
- Collection and processing of navigation data on the Site. As mentioned above, we invite you to check the details of the cookies used by connecting to the page https://www.egoairways.com/en/cookies-policy. In any case, we collect navigation data on the Site in order to better manage the use of the Site by our users, to verify the pages most visited, and therefore to improve their usability to allow access to the various pages published. As better indicated in the informative note, the legal basis for this processing is the legitimate interest.
- Collection of data for sending newsletters, performing a service, or to comply with the law, or for internal administrative purposes.
a. To send our Newsletter and/or to perform a service (contractual purposes): Some users may provide us with their personal details and contact data or to register with the Site; others may register with our Newsletter and others may make reservations, purchase tickets or want to use our services, and/or participate in initiatives promoted through the Site. In other cases we may also process data to manage and respond to requests, reports, to provide assistance and communications relating to bookings or purchases made, as well as for ancillary and complementary services, such as the fulfilment of specific requests before the conclusion of the contract. In such cases the processing of data has its legal basis in the need to implement a pre-contractual measure. In order to provide a service (sending the Newsletter) or to fulfill the contract by honouring the reservation made or performing the requested service, and therefore does not require your consent, as the data are provided to us to perform a service (as required by Article 6.1.b of the GDPR (execution of the contract or pre-contractual measure). You are not obliged to provide us with your data for these purposes, but the data is necessary for the fulfilment of the stated purposes. In practice: if you want to book a flight or a service, if we do not have your details, we will not be able to do what you have asked us to do. If you do not provide us with your email address, we will not be able to send you the Newsletter, etc.. Therefore, if you do not provide us with this information, we will be unable to conclude the contract or provide you with the services you have requested.
b. To comply with a legal obligation: Our activity obliges us to process certain data in order to fulfill our obligations under the law. These obligations include, among other things, the keeping of company accounts for both civil and fiscal purposes, the accounting operations of the relevant data, the internal administrative acts and procedures aimed at fulfilling the above and the preparation of the financial statements, the preparation and filing of passenger lists and travel and transport documents, as well as the fulfilment of all the instructions given by authorities legitimated by law, EU regulations and binding international agreements and therefore having the value of law in our country. The processing of personal data for these purposes has its legal basis in the need to comply with a legal obligation and therefore in the provision of Article 6.1.c (legal obligation) of GDPR and does not require your consent.
c. To carry out marketing, promotional and commercial communication activities: To those who have provided us with their contact details (e.g. email, mobile phone number for sending text messages) if they so wish we send other commercial and promotional communications relating to events, promotions or services offered to customers. We may also use the data to assess customer satisfaction by sending you email or paper mail or by sending you fax, mms or sms. The processing of personal data for this purpose finds its legal basis in our desire to keep in touch with customers, informing them of our activities, in accordance with the provisions of art. 6.1 (a) of GDPR; the provision of data for this purpose is optional, with the only consequence that you will not be able to be updated on our new programs, promotions and initiatives. Therefore, those who want to be able to start this communication channel and receive communications for commercial/marketing purposes must necessarily give their express, free and unequivocal consent in the manner provided in this Site, and consent is the legal basis for this treatment.
d. To carry out the so-called profiling activities: we may use your data (of navigation, services requested, reservations and/or preferences expressed, and in any case of your interactions with us) to analyse them in order to improve our offer and to be able to send you information material and personalised offers selected on the basis of your interests. This type of activity and processing can only take place with your express and free consent, which is the legal basis.
The provision of the data for the purposes referred to in point 2.b above is mandatory, as we must carry out what is required by law.
The provision of your data for the purposes 2.c and 2.d above is optional, in the sense that you are free to decide whether to use our services and if not we will be unable to inform you about our offers or to offer you personalized offers. In case you have given your consent, you can revoke it at any time, by making a request to the Owner; you can also oppose to further sending of email newsletters by clicking on the appropriate link for the revocation of consent, which is present in each email. It may happen that, following the exercise of the right to object to the sending of newsletters via email, for technical and operational reasons (e.g. the formation of contact lists already completed shortly before receipt by the Owner of the request for objection) the user continues to receive some additional newsletters or offers. In this case, should the user continue to receive messages and newsletters after the exercise of the right of opposition, please report the problem to the Owner, using the contacts in.
C) Categories of data processed
In accordance with the purposes described above and any consents given, the following categories of personal data may be processed:
- Site navigation data;
- IP address of origin of the user;
- Identifying data - name, surname, personal data, address, etc.;
- Contact data - email address, mobile phone number, fax number, etc..
- Contractual data - reservations, tickets and services used (reservations made and related routes; passengers travelling with you, agencies that have made reservations on your behalf, etc.).
D) Data source
The personal data processed are those that you provide directly to us or those that are collected while browsing the Internet, using various tools such as cookies and tags, etc..
E) Methods of processing, place and period of storage of data
Personal data will be processed both with and without electronic means, using appropriate security measures against the risks of destruction or loss, modification, unauthorized disclosure or access to personal data transmitted, stored or otherwise processed.
The data relating to the services used will be processed for the period of mandatory storage required by law for fiscal, accounting and contractual data.
The data used for registration will be kept until the cancellation of the account or the revocation of your consent.
This is without prejudice to any further retention periods required by law or necessary for judicial protection.
With regard to the processing carried out in order to achieve the purposes set out in section 2.c and 2.d . of this information notice, the Data Controller may legitimately process your personal data until you communicate your willingness to revoke your consent for the purposes for which you have been requested.
F) Recipients of personal data. Subjects who may become aware of them.
In order to allow the achievement of the purposes indicated above, the data may be made available to the following subjects:
- to employees and collaborators of the Data Controller who act under its authority and who are authorized to process them as appointees or authorized persons;
- to companies belonging to the entrepreneurial group of which the Owner is part, and their employees and collaborators;
- to subjects whose activity is necessary for the performance of the services requested and provided by the Holder or to fulfil requests prior to the conclusion of the contract (e.g.: Suppliers and Subsuppliers both domestic and foreign, Companies and institutions in the banking, credit and insurance sector, Financial Intermediaries) as well as law firms for the protection of the Holder's rights;
- to third parties to whom the communication is necessary for the execution of the booking and the transport contract (e.g.: airport service management companies, other airlines that deal with part of the booked route);
- to third parties to which the Owner may outsource certain processing activities and/or activities connected and instrumental to the same on behalf of the Owner and which consequently provide the Owner with certain instrumental services, in any case related to the processing and purposes described above, such as, for example, operators providing administrative, accounting, fiscal, auditing, information system management, communication, credit collection, mass storage, customer support services. These third parties carry out processing on behalf of the Data Controller and are authorized to process them as Data Processors in accordance with the provisions of art. 28 of GDPR;
- to Public Administrations, public security, customs, airport, flight control, inspection authorities and, more generally, to subjects whose right to access data is recognized by specific provisions of law or by an order issued by an authority legitimated by law;
Your data will not be disseminated, i.e. it will not be made known to undetermined subjects.
G) Your rights
GDPR grants you the following rights with regard to your personal data, which you may exercise within the limits and in accordance with the regulations:
- Right of access to your personal data (art. 15); Right of rectification (art. 16); Right of erasure (right to be forgotten) (art. 17); Right of limitation of processing (art. 18); Right to data portability (art. 20); Right of opposition (art. 21); Right to object to a decision based solely on automated processing (art. 22); The right to revoke, at any time, the consent given, without prejudice to the lawfulness of the processing based on the consent given before the revocation (art. 7.3);
You may obtain this by sending a written request addressed to the Data Controller to the postal address or by e-mail, as indicated in section a) of this notice.
Furthermore, you have:
- Right to contact the Data Controller for all matters relating to the processing of your personal data and the exercise of the rights deriving from GDPR.
Right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it) if you believe that the processing of your data is contrary to the legislation in force (art 77) or take legal action (art 79).