Privacy Policy

Alilauro S.p.A. processes the personal data of its Customers and Passengers in compliance with Regulation (EU) 2016/679 (GDPR) and Legislative Decree of June 30, 2003, No. 196, (Privacy Code), and subsequent amendments, as well as the principles of confidentiality that inspire the Company’s activity. In accordance with Articles 13 and 14 of the GDPR and Article 13 of the Privacy Code, Alilauro S.p.A. provides some information on the use of personal data.

Data Controller

The data controller for personal data is Alilauro S.p.A. with registered office at Molo Beverello snc- Palazzina Volaviamare, 80133 Naples.

Data Protection Officer

Alilauro S.p.A. has appointed the following as the Data Protection Officer:

Lauro.it S.p.A. with registered office at Via Monte Giordano n.23

for the processing of automated data and profiling activities for commercial and marketing purposes;

It is specified that the complete and constantly updated list of the aforementioned subjects to whom personal data may be communicated as Data Processors can be requested using one of the communication channels made available by the Company for the exercise of the rights of the data subjects, as indicated below.

Purpose and legal basis of the processing

In the operations of booking and selling tickets, boarding acceptance, and during the journey, Alilauro S.p.A. acquires and processes the data of both the Customer (the ticket buyer who enters into the transport contract) and the Passenger (i.e., all individuals to whom the ticket refers, embarked on the ferry).

The processing of the acquired personal data takes place for the following distinct purposes and is based on different legal bases for processing:

Management of pre-contractual phases, performance of its own activities, and management of relationships established with all stakeholders; this processing is necessary for the conclusion and execution of the contract of which the data subject is a part.
Compliance with obligations under laws, regulations, EU legislation, provisions issued by Authorities, and competent supervisory and control bodies (in particular, laws on security and anti-terrorism protection; rules related to administrative compliance, etc.). In this case, the legal basis for the processing is represented by the need to comply with a legal obligation.

Additionally, Alilauro S.p.A. acquires Customer data to conduct market research and for marketing and commercial purposes, offering personalized services and promotions based on Customer preferences. In this case, explicit consent from the data subject will be required.

Categories of data acquired and processing methods

The personal data subject to processing, carried out for the purposes of booking and purchasing the ticket and accepting the passenger on board, as well as in accordance with Directive 18/06/1998, No. 41 transposed by DM 13/10/1999, are collected by Alilauro S.p.A. directly from the data subject and/or from third parties (the Customer) and belong to the following categories:

Personal data (name and surname, gender, age or date of birth, nationality);
Contact details (phone number, email, etc.);
Data related to the health status of the passenger (falling under the “special categories of data” referred to in Article 9 of the GDPR and the corresponding articles of Legislative Decree No. 196/2003).

Nature of data provision

Mandatory data: personal data and data related to the nationality of the passenger

These personal data are strictly functional to the provision of the service, acquired and processed for booking and purchasing the ticket, and for accepting the passenger on board.

These data are essential for the establishment and continuation of the relationship, also in accordance with applicable legal and regulatory provisions; therefore, any refusal by the data subject to provide and process them objectively makes it impossible for Alilauro S.p.A. to provide the aforementioned services. For further details, please refer to the “Transport Conditions” published at the following link on the Alilauro S.p.A. website: http://www.alilauro.it/

Optional data: data related to the health status of the passenger (e.g., any disabilities)

The provision of this data is optional as it does not prevent Alilauro S.p.A. from providing the transport service to the passenger.

However, the lack of consent to the provision and processing of these types of data could compromise the quality of the service provided by Alilauro S.p.A., as assistance and any necessary care cannot be guaranteed.

Optional data: contact data acquired for promotional and commercial purposes, marketing, market research, etc.

The provision and processing of this data, which occurs only with the explicit consent of the Customer, is optional and does not impact the service provided by Alilauro S.p.A. to the passenger.

Processing based on the data subject’s consent

For the processing of certain data, Alilauro S.p.A. requires the explicit consent of the data subject:

Processing of special data (data related to the health status of the passenger, etc.)

The processing of data related to the health status of the passenger (or other special data under Article 9 of the GDPR) is carried out only with the data subject’s consent and exclusively for the fulfillment of contractual obligations and compliance with applicable laws and regulations.

Processing of personal data for promotional and commercial purposes, marketing, market research, etc.

The Customer always has the option to express consent regarding the processing for marketing and commercial purposes, market research, and the provision of services, without the failure to provide such consent or its revocation affecting the performance of the service under the contract.

In each of these cases, the Data Controller provides the data subject with tools to revoke consent as easily as it was given.

The methods for revoking consent are explicitly explained in the same way the data subject gives consent to the processing of the data.

Regarding the mentioned commercial and marketing purposes, the processing of data is mainly carried out in an automated manner and will be done to ensure the security and confidentiality of the data subject.

Dissemination and communication of data to the data subject

Alilauro S.p.A. does not disclose or communicate passengers’ personal data to third parties, except in cases where communications are necessary to comply with legal obligations, administrative requirements, and orders from Public Authorities.

Employees responsible for the operational and commercial functions of Alilauro S.p.A., as well as external Data Processors mentioned above, may have access to the personal data collected from Customers in the performance of their duties.

Retention of personal data

Data acquired for the provision of the service

These data will be processed for the entire duration of the contract entered into with the Customer/Passenger.

These data will also be archived, in paper or electronic format, in compliance with current legislation on document retention (e.g., for tax and accounting purposes) and/or for the possible protection of the rights of the parties in the event of legal disputes. Electronic/digital data are stored on systems located in the European Union.

Data acquired for marketing and commercial purposes

Data provided for direct marketing purposes (e.g., newsletters) will be processed for 24 months, or until the withdrawal of consent by the data subject.

Additionally, data processed for profiling purposes will be kept for 12 months, or until the withdrawal of consent by the data subject.

Transfer of personal data abroad

Alilauro S.p.A. does not transfer passenger data outside the European Union.

Rights of the data subject

According to Articles 15 to 20 of the GDPR and the corresponding articles of the Privacy Code, data subjects have the right to obtain, at any time:

confirmation of the existence or not of a processing concerning them and access to their data, including information regarding:
the purpose of the processing;
the categories of personal data subject to processing;
the recipients to whom the data are or will be communicated;
any transfer of data outside the European Union and the existence of related safeguards;
the period of data retention or the criterion for determining it;
the possible right to rectify and erase data, to limit and object to processing;
the right to lodge a complaint with the supervisory authority;
the origin of the data if the data;
the existence of automated decision-making processes.
a copy of the personal data subject to processing, provided that this does not infringe on the rights and freedoms of others;
the rectification of inaccurate personal data;
the erasure of personal data concerning them;
the withdrawal of consent provided;
the limitation of the processing of their personal data;
the personal data provided in a structured, commonly used, and machine-readable format, also for the purpose of transmitting it to another data controller.

Furthermore, according to Articles 21 and 22 of the GDPR and the corresponding articles of the Privacy Code, data subjects also have the right to:

object at any time, for legitimate reasons related to their particular situation, to the processing of data concerning them that is necessary for the performance of tasks of public interest or for the pursuit of the legitimate interest of the data controller;
not be subject to decisions based solely on automated processing, which may have legal effects or significantly affect the data subject.

To exercise their rights, or to obtain information about the processing of data concerning them, data subjects can contact Alilauro S.p.A. using one of the following methods:

via postal service to the following address: Alilauro S.p.A. Molo Beverello snc Palazzina Volaviamare
privacy@alilauro.it

Right to lodge a complaint with the Supervisory Authority

According to Article 77 of the GDPR and the corresponding articles of the Privacy Code, data subjects have the right to lodge a complaint with the Supervisory Authority if they believe that a processing concerning them violates one of the provisions of the GDPR or the Privacy Code.

Data relating to the payment of tickets purchased online on the website www.alilauro.it cannot be acquired and processed in any way by Alilauro S.p.A., as the transaction is managed by the servers of the Banca Sella service.