Notice Website TMB-GEIE

For the purpose of protecting natural persons with regard to the processing of their personal data and the free circulation of the same, in relation to the personal data to which GEIE Traforo del Monte Bianco will have access - through the website www.tunnelmb.cm (hereinafter also referred to simply as “the Website”) or the App “TMB Mobility”(hereinafter also referred to as “the App”) or the other channels of contact indicated therein - and which will be processed by the same, please note the following information.
 
1. Data Controller.
The Data Controller of the personal data is GEIE Traforo del Monte Bianco, with registered office in Courmayeur (11013 - AO), Piazzale Sud del Traforo del Monte Bianco, tel. +39 0165 890411 fax +39 0165 890419, email [email protected] – VAT no. 01007980079.
 
2. Contact details of the Data Protection Officer
The Data Protection Officer ( DPO) can be contacted via email, at the address [email protected], or by telephone at +39 0165 890411.
 
3. Purposes of the personal data processing
Except in the case of the browsing data and the cookies (for which provisions are made in a different notice), the personal data communicated by the Data Subject via the Website, the App, and the other channels of contact can be processed for the purposes indicated below.
A) Fulfilment of the contract or requests for information
The Controller can process the personal data given or entered by the Data Subject (e.g. identifying data, contact details, information requests, etc.) in order to fulfil a contractual relationship or the other services available in the website and in the App, and also to respond, even before the establishment of the contract, to the contact requirements expressed or, if requested, to comply with specific requests submitted by the Data Subject (including cost estimates).
B) Pursuance of other purposes
The Controller can also process the general personal data, if required, to comply with legal obligations, or to pursue his own other legitimate interests such as, for example, defending himself in court, or performing statistical calculations.
 
4. Legal basis for the processing
The legal basis for the processing performed for the purposes listed in point 3.A) above, is the requirement to fulfil the contract of which the Data Subject is a Party, or the pre-contractual measures implemented upon the request of the latter.
The legal basis for the processing performed for the purposes listed in point 3.B) above, is the requirement to comply with the legal obligations to which the Controller is subject, or the legitimate interest of the Controller.
 
5. Categories of recipients to which the personal data have been or will be communicated
The categories of recipients to whom the personal data have been or can be communicated are as follows:
a) persons authorised by the Data Controller, who have undertaken to respect the confidentiality of the data or have an adequate legal obligation of confidentiality (e.g. the Data Controller’s collaborators);
b) any Data Processors with whom a contract has been established pursuant to Article 28 of the GDPR;
c) the Data Controller could also be obliged to communicate or send the data to public authorities, including court authorities.
These recipients are not located in third countries, nor are they international organisations.
The personal data will not be disseminated.
 
6. Personal data retention period
The Controller will store the Data Subject's data for a period of 12 months for the fulfilment of the indicated purposes unless a different retention period is required (such as, for example due to the duration of legal proceedings).
 
7. Nature of the data conferral and consequences of refusal to confer the data
The communication of the data marked with an asterisk is mandatory: failure to confer these data will make it impossible for the Controller to meet the Data Subject's request(s).
The communication of the data not marked with an asterisk is optional: failure to confer these data will in any case enable the Data Subject's request(s) to be met.
 
8. Rights of the Data Subject
The EU Regulation guarantees the following rights to the Data Subject with reference to the processing of their personal data: 
a) the right to access the processed data and, if required, to receive a copy of the same (Article 15 of the GDPR);
b) the right to rectify incorrect personal data without any unjustified delay and to integrate incomplete personal data (Article 16 of the GDPR);
c) the right to erase the personal data without any unjustified delay – the so-called ‘right to be forgotten’ – for one of the reasons indicated from letters a) to f) of Article 17 of the GDPR;
d) the right to the restriction of the processing for one of the reasons indicated from letters a) to d) of Article 18 of the GDPR;
e) the right to data portability (Article 20 of the GDPR);
f) the right to object, for reasons related to the Data Subject's own specific situation, to the processing of their personal data pursuant to Article 6, paragraph 1, letters e) and f) of the GDPR, including profiling; or, should the data have been processed for direct marketing purposes - to the processing of their personal data carried out for these purposes, including profiling in the measure in which it is connected to said direct marketing (Article 21 of the GDPR).
Requests must be sent by email to [email protected].
 
9. Right to lodge a complaint with the Supervisory Authority
The Data Subject who considers that the processing of their personal data violates EU Regulation 2016/679 can lodge a Complaint with the Supervisory Authority (for Italy: Garante per la protezione dei dati personali www.garanteprivacy.it and for France: CNIL Commission Nationale de l'Informatique et des Libertés www.cnil.fr/fr).
 
10. Amendments to this notice
This notice comes into force on the 22/05/2024.
The Controller reserves the right to modify part or all of its contents, also due to variations in the Privacy Law.
The Controller will publish the updated version of this document on the Website and it will be binding from that moment on: the Data Subject is therefore invited to visit this section regularly.