PRIVACY

As required by Article 13 of EU Regulation no. 2016/679 (hereinafter also denoted “General Data Protection Regulation” or “GDPR”), before moving forward with the processing of personal data (hereinafter, “Data” or “the Data”), the Data Subject shall be advised that his/her Data collected shall be subject to processing by the company using electronic and/or online instruments, for the purposes set forth herein.
Therefore, the Data Subject shall be subject to the Privacy Policy generated by Gestione Governativa Navigazione Laghi (hereinafter, also denoted “Government Entity” or “Data Controller”).

1. Data Controller and Data Protection Officer (“DPO”)
The Data Controller for your data is Gestione Governativa Navigazione Laghi, with registered office at Via Lodovico Ariosto, 21, 20145 Milan (MI), Italy, VAT no. 00802050153.
Pursuant to Article 37 et seq. of the GDPR, the Company has appointed a Data Protection Officer, who may be reached via email at: privacy@navigazionelaghi.it
For further information on Data Subject rights, please review the section herein entitled “Data Subject Rights”.

2. Legal basis for, and purposes of, the data processing
Data submitted shall be processed by Data Controller in accordance with applicable law.
The legal basis of data processing is the supply of services by the Governing Entity, the management of reports concerning groups on ferries operating along scheduled routes, the organization of special rental services, the sale of ticket on line, the management and facilitation of the website, the management of restricted areas on the website, the management of forms connected to services made available to customers, your consent, if any, to the processing of your Data (when provided).
The processing of your Data by the Government Entity shall be for the following purposes:

  1. NEWSLETTER SIGN-UP REQUEST: Should you decide to register in the “Newsletter” section of this site, and only upon your providing specific consent to the same, your personal data shall be processed by the Data Controller to register you, and for access thereafter to those dedicated services.
  2. REQUEST FOR REPORTING GROUPS AND RENTAL OF SPECIAL SERVICES: Should you decide to report groups on ferries operating along scheduled routes or ask for information or enter into a contract for the rental of vessels from the fleet of Gestione Governativa Navigazione Laghi for private services, your Data will be processed by the Controller to meet your requests and to provide any information and services requested by yourself.
  3. ACCESS TO THE EMPLOYMENT OPPORTUNITIES SECTION: Should you wish to sign up and create an account through the Employment Opportunities section on www.navigazionelaghi.it, and only upon your providing specific consent to the same, the Data you provide may be processed by the Data Controller to obtain relevant information regarding your CV, and to move forward with a review of your application.
  4. SUGGESTIONS/ALERTS: Should you choose to contact us through the "Suggestions/Alerts” section on www.navigazionelaghi.it, and only upon your providing specific consent to the same, the Data you provide may be processed by the Data Controller to follow up on your request, and to provide you the requested information.
  5. PURCHASE OF TICKETS: Should you decide to purchase ticket by website www.navigazionelaghi.it your Data will be processed by the Controller to send your tickets.
  6. SERVICES FORM: Should you use the forms that are available on board or at stopovers, your Data will be processed to receive and acknowledge your communications/requests or to provide you with temporary replacement equipment under Regulation 1177/2010 art. 15(4), owned by the Governing Entity.
  7. SOCIAL MEDIA: www.navigazionelaghi.it allows you to access Gestione Governativa Navigazione Laghi’s social-media profiles. In that arena, and as better described in the Cookie Policy on this site, third-party cookies on the Gestione Governativa Navigazione Laghi site may be installed on your computer.

3. Nature of the processing
With regard to the purposes set forth in point 1) of the preceding paragraph, submission of your Data and consent to their processing is mandatory. Any failure to provide such consent shall make it impossible for the Governing Entity to include you in the mailing list for the requested newsletter.
With regard to the purposes set forth in point 2) of the preceding paragraph, submission of your Data and consent to their processing is mandatory. Any failure to provide such consent will make it impossible for the Governing Entity to answer your request, to report groups or your requests for information on the rental of special services or your request to proceed with contract stipulation.
With regard to the purposes set forth in point 3) of the preceding paragraph, submission of your Data and consent to their processing is mandatory. Any failure to provide such consent shall make it impossible for the Governing Entity to review your application.
With regard to the purposes set forth in point 4) of the preceding paragraph, submission of your Data and consent to their processing is mandatory. Any failure to provide such consent shall make it impossible for the Governing Entity to reply to your request for information.
With regard to the purposes set forth in point 5) of the preceding paragraph, submission of your Data and consent to their processing is mandatory. Any failure to provide such consent will make it impossible for the Governing Entity to reply to your request of booking on line.
With regard to the purposes set forth in point 6) of the preceding paragraph, submission of your Data and consent to their processing is mandatory. Any failure to provide such consent will make it impossible for the Governing Entity to reply to your report or from providing equipment belonging to the Governing Entity.
In that regard, please note that processing may also be performed to comply with statutory, regulatory, or other legal duties as may from time to time apply to Data Controller.

4. Processed data
The Data subject to processing by the Data Controller are those provided by the user while browsing www.navigazionelaghi.it, upon registering/signing up for services made available by the Governing Entity and/or the sending of one's own CV through the “Job Opportunities” section.

5. Processing Method; Data Retention
Data Processing shall be performed by the Data Controller in accordance with applicable law. The Data Controller performs Data processing using electronic and/or online instruments, and with organisational methodologies and logic strictly related to the pursuit of the objectives set forth in the instant policy, as well as by adopting the security measures needed to prevent the unauthorised access, disclosure, modification, or deletion of the Data, their loss, or the unlawful / improper use of the same. The company further undertakes to process the Data according to the principles of ethics, lawfulness, and transparency, and to collect them only insofar as is strictly and precisely necessary to process them, and to allow their use solely by their own personnel for authorised purposes. Management and retention of any Data acquired shall take place in file storage or servers located within the European Union and owned by the Data Controller and/or third-party companies appointed as External Data Processors, all of which are currently located in Italy.
The Data shall be retained for the time strictly necessary to pursue such objectives, and always within the bounds of applicable law. Such retention period shall vary depending on the specific purpose for which they were collected.
The company shall, without exception, take care to avoid using the data for an indeterminate period of time, and shall at intervals duly confirm the continued interest of the data subject to whom they refer.

6. Data Recipients and Data Processors
The collected data shall never be disseminated or disclosed to any third party except insofar as permitted, and in the manner permitted, by the instant policy and/or by law. Data shall be processed by company employees within the scope, and for the purposes described herein. Some Data processing may also be performed by third parties appointed as External Data Processors, as presently or hereafter engaged by Data Controller to manage one or more contracts, distribute proffered services, or for reasons relating to Data Controller's internal business needs. To wit, the Data may be disclosed to parties including but not limited to:

  1. Private and public entities accessing the Data pursuant to EU statute, regulation, or law, to the extent permitted under the same;
  2. Parties needing to access the Data for purposes relating to the current contract binding the parties, to the extent strictly necessary to carry out any ancillary duties (such as banks and credit institutions, technical-service providers, hosting service providers, IT firms, communication firms, postal couriers, and shipping companies);
  3. Consultants, to the extent required to perform the professional services with which they were tasked.

An updated list of External Data Processors is available at Data Controller’s registered office, and is also readily available to the Data Subject via email by sending a request to privacy@navigazionelaghi.it

7. Transfer of Data abroad
Data shall not be transferred outside the European Union. However, if and when needed, Data Controller may move the server to a non-EU country. In such cases, Data Controller anticipatorily warrants that the transfer of such data outside the EU shall take place in accordance with Art. 44 et seq. of the GDPR and all other applicable provisions of law; if necessary, ad-hoc agreements ensuring an adequate level of protection shall be executed.

8. Rights of the Data Subject
As Data Subject, you have the right to exercise the following rights established under the GDPR:

  1. The right, pursuant to Art. 15, to have confirmation on whether any processing is being performed on your Data, and if so, to have access to the Data and the following information: (i) the purposes of the processing; (ii) the categories of the Data involved; (iii) the recipients, or categories of recipients to whom the Data have been or will be disclosed, especially in the case of any non-EU country or international organisation; (iv) if possible, the retention period for the Data, or if not possible, the criteria used to determine such retention period; (v) the existence of the right on the part of the Data Subject to request the Data Controller correct or delete the Data, to limit their processing, or to object to their processing; (vi) the right to lodge a complaint with a control authority under Art. 77 et seq. of the GDPR; (vii) where the Data has not been collected from the Data Subject directly, all available information regarding their source; (viii) the existence of an automated decision-making system, including any profiling, as defined by Article 22, paragraphs 1 and 4 of the GDPR and in such cases, salient information on the logic utilised, as well as the significance of the same, and the consequences contemplated to accrue to the Data Subject because of such processing; (ix) the right to be advised regarding the existence of adequate safeguards under Article 46 of the GDPR with respect to any transfer, where Data are transferred to a non-EU country or to an international organisation;
  2. The Data Subject shall also have the right (when and where applicable) to exercise those rights under Art. 16-21 of the GDPR (the right of correction, the “right to be forgotten”, the right of processing limitations, the right to Data Portability, the right of objection).

The Data Subject may, at any time, exercise the aforementioned rights and request the updated list of Data Processors by sending a request to the following email address: privacy@navigazionelaghi.it

The Governing Entity undertakes to reply to Data Subject requests within a month, except in the more complex cases, in which case the deadline shall be three (3) months. Regardless, the Data Controller shall provide evidence to the Data Subject regarding the justification for the delay within a month of the request being received. The result of the request shall be provided in writing or in electronic format. Should any request for correction, deletion, or limits-on-processing be submitted, the Data Controller undertakes to provide the results of any requests received from the Data Subject to each recipient of your Data, unless such performance proves impossible, or represents an undue burden.

The Governing Entity has appointed a Data Protection Officer (“DPO”) pursuant to Article 37 of the GDPR, who may be reached at the following email address: privacy@navigazionelaghi.it

9. Amendments to the instant Policy
Data Controller reserves the right to make changes to the instant Privacy Policy at any time, providing notice to all users through its website, www.navigazionelaghi.it. Therefore, we ask that you kindly refer back to this page, noting the version date at the end of the document. Should you choose not to accept the changes made to the instant Privacy Policy, you as Data Subject may request the Data Controller delete your Data. Unless otherwise specified, the foregoing Privacy Policy shall continue to apply to any Data theretofore collected.

Privacy Policy: last updated 17 May 2019

COOKIE POLICY

privacy@navigazionelaghi.it

Pursuant to Articles 13 and 14 of EU Regulation no. 2016/679 of the European Parliament and Council of 27 April 2016 regarding personal-data processing protections for natural persons, as well as the free circulation of data (General Data Protection Regulation, hereinafter also denoted “Regulation” or “GDPR”), we would like to inform you that over the course of your visit to our site, information and Personal Data may be collected using “cookie”.

cookie” are small files sent to a user's browser and stored on the user’s device when an internet site is visited. Cookies allow for the efficient functioning of the website, and improve performance of the same. Furthermore, cookies may provide information to the website owner for statistical and marketing purposes, generally to customise the user’s experience by remembering user preferences. By accepting the instant privacy policy, the user accepts the use of site cookies.

1. Processing purposes
This website, www.navigazionelaghi.it, makes use of different types of cookies and related technology, each one with its own specific function:

  • Navigation and functional cookies: navigation cookies are needed to ensure proper site functioning, and allow the viewing of content on the device by recognising the language and market of the country from which the user is connecting to the site. Functional cookies improve site navigation and quality. Other technical cookies may be used to monitor data traffic. In some situations, disabling these cookies may not be technically feasible, in that they are necessary to ensure site performance;
  • Third-party statistical cookies: statistical cookies are used to generate statistical analyses on user site navigation. The results of these analyses are used in an anonymous format, and solely for statistical purposes. The site uses some third-party services: these might install their own cookies, outside of our control.

In terms of additional third-party cookie usage, meaning cookies for sites or web servers other than those used by Gestione Governativa Navigazione Laghi, used by such third parties for their own purposes, Gestione Governativa Navigazione Laghi notes that it has no specific control over the characteristics of such cookies. Thus, users are encouraged to visit the privacy-policy pages of such third parties (listed below), where they can consent or withhold consent regarding installation of such cookies.

The following is a list of cookies installed on the website, with an explanation of the related purposes for the same, and the retention period for any information gleaned by the same.

Functional cookies (installed by Gestione Governativa Navigazione Laghi)
Name Party installing the cookies Cookie type Purpose Retention period for any data acquired
ASP.NET_SessionId Gestione Governativa Navigazione Laghi Technical cookies Identify the user's browsing session, facilitating site navigation Ten (10) hours
CurrentLanguage Gestione Governativa Navigazione Laghi Technical cookies Identifies the language used to view text for the site as selected by the user Fourteen (14) days
NEL_cookies_consent Gestione Governativa Navigazione Laghi Technical cookies Used to verify user's cookie acceptance Thirty (30) days
__AntiXsrfToken Gestione Governativa Navigazione Laghi Technical cookies Used to prevent cross-requests between websites Fourteen (14) days
Functional cookies (installed by third parties)
Name Party installing the cookies Cookie type Purpose Retention period for any data acquired
_ga Google Statistical cookies Used to manage Google Analytics Two (2) years
_gid Google Statistical cookies Used to manage Google Analytics Twenty-four (24) hours

2. Data-retention period
Your Personal Data shall be processed for the time strictly necessary to pursue the previously stated purposes and/or to discharge statutory/regulatory duties.

3. Methods of use for the Data
With respect to the foregoing purposes, the processing of information collected through the use of cookies shall take place through suitable hard-copy, electronic and/or online instruments, using a logic strictly tied to the purposes set forth supra, in order to ensure the security and privacy of the information/data themselves.

4. Data-circulation - scope
The data may be processed by third-party companies performing activities on Data Controller’s behalf in their role as external data controllers (including but not limited to suppliers/consultants who manage and/or assist in the management of, and/or the maintenance of, electronic and/or online instruments we use, for the period strictly necessary to ensure the optimal performance of such service). Your personal data shall only be rendered accessible to those who, within Gestione Governativa Navigazione Laghi, need to access the same in the performance of their job duties, or as a matter of the organisational chain of command. Such parties shall be properly instructed in order to avoid data loss, deletion, or any unauthorised / impermissible use of the same.

Even without your express consent (pursuant to Art. 6, subparts [b] and [c] of the Regulation), the Data Controller may disclose your data to supervisory entities, court authorities, and other parties disclosure to whom is mandated by a specific provision of law.

5. Data disclosure
Your data shall not be subject to disclosure to undetermined parties.

6. Browser settings Procedure to manage cookies and direct connection to the dedicated browser section
Please note that to manifest your choices regarding the use of cookies by the website, including through your browser settings, please follow the procedure to modify/manage such settings, available at the following links:

7. Data Controller and Data Protection Officer
The Data Controller for your data is Gestione Governativa Navigazione Laghi, with registered office at Via Lodovico Ariosto, 21, 20145 Milan (MI), Italy, VAT no. 00802050153.

Gestione Governativa Navigazione Laghi has appointed a DPO – Data Protection Officer – pursuant to Article 37 of the Regulation: Paolo Mazzucchelli, licensed engineer. That party may be contacted for any requests relating to the processing of your Data at: privacy@navigazionelaghi.it.

8. Exercising one’s rights
As Data Subject, you have the right to exercise the following rights established under the Regulation, to wit:

  1. The right, pursuant to Art. 15, to have confirmation on whether any processing is being performed on your personal data, and if so, to have access to the personal data and the following information: (i) the purposes of the processing; (ii) the categories of personal data at issue; (iii) the recipients, or categories of recipients to whom the personal data have been or will be disclosed, especially in the case of any non-EU country or international organisation; (iv) if possible, the retention period for the personal data, or if not possible, the criteria used to determine such retention period; (v) the existence of the right on the part of the Data Subject to request the Data Controller correct or delete the personal data, to limit their processing, or to object to their processing; (vi) the right to lodge a complaint with a control authority under Art. 77 et seq. of the GDPR; (vii) where the personal data has not been collected from the Data Subject directly, all available information regarding their source; (viii) the existence of an automated decision-making system, including profiling, as defined under Article 22, paragraphs 1 and 4 of the GDPR and in such cases, salient information on the logic utilised, as well as the significance of the same, and the consequences contemplated to accrue to the Data Subject because of such processing; (ix) the right to be advised regarding the existence of adequate safeguards under Article 46 of the GDPR with respect to the transfer, where personal data are transferred to a non-EU country or to an international organisation;
  2. The Data Subject shall also have the right (when and where applicable) to exercise those rights under Art. 16-21 of the Regulation (the right of correction, the “right to be forgotten”, the right of processing limitation, the right to Data Portability, the right of objection).

Please note that Gestione Governativa Navigazione Laghi undertakes to reply to your requests no later than one (1) month of receipt of the same. Such deadline may be extended depending on the complexity or volume of the requests fielded; Gestione Governativa Navigazione Laghi shall take care to explain the reasons for such delay within one (1) month of request-receipt. The results of your request may be provided to you in writing or in hard-copy or electronic format.

9. Method of exercising your rights
The Data Subject may exercise the aforementioned rights at any time as follows:

  1. By emailing: privacy@navigazionelaghi.it

An updated list of data processors is available by sending a request to privacy@navigazionelaghi.it.

Data Controller
Gestione Governativa Navigazione Laghi