1. Browsing the Website, registering a personal account and managing security

The Data Controller will process your personal data, referred to in paragraph 2, in accordance with Article 6(1)(b) of the GDPR (legal basis: performance of a contract or taking steps at the request of the data subject prior to entering into a contract), in order to enable browsing and to access the various Website sections, to allow you to register and manage your personal account, and to ensure the overall security and proper technical operation of the Website ("service provision purpose"). Providing your personal data for this purpose is optional but necessary to allow you to browse the Website and use the features reserved for registered users. If you fail to provide such data, the Data Controller may not be able to grant you access to the services offered.



2. Subscribing to the ITA Airways job opportunities newsletter

The Data Controller will process your personal data, subject to your specific consent pursuant to Article 6(1)(a) of the GDPR, to enable you to subscribe to the ITA Airways job opportunities newsletter and to email communications about the Company events, initiatives and professional opportunities, including new job postings and further employment opportunities ("newsletter subscription purpose").
The legal basis for this type of processing is the free, specific and informed consent given by the data subject at the time of subscribing to the newsletter. You may withdraw your consent, or object to the processing of your data, at any time by contacting the Data Controller and/or the DPO at the contact details provided in paragraph 7 of this policy, or by using the dedicated unsubscribe link at the bottom of each email received. Withdrawal of consent does not affect the lawfulness of the processing activities prior to withdrawal. Providing your personal data for the newsletter subscription purpose is optional, and failure to give your consent will not entail any consequences, nor will it in any way affect your ability to access and browse the Website.




Once provided, personal data may also be processed by ITA Airways for the following purposes:



3. fulfilment of legal obligations, regulations or national and EU legislation to which the Data Controller is subject, including the provisions of the Data Protection Authority and/or the decisions of judicial and/or administrative authorities (“compliance purpose”). The legal basis for this purpose constitutes lawful processing of personal data pursuant to Article 6(1)(c) of the GDPR;


4. in the event that it is necessary to establish, exercise or defend a right in court or out of court, including debt recovery (“defence purpose”), for the pursuit of the Data Controller’s legitimate interest pursuant to Article 6(1)(f), in that, once you provide your personal data it may become necessary to process the data in order to establish, exercise or defend a right in court, or whenever the judicial authorities exercise their functions.

We may disclose your Personal Data to the following parties (collectively referred to as the Recipients), for the purposes set out in paragraph 3 of this Notice:

1. the parties authorised by the Data Controller pursuant to Articles 29 and 32 of the GDPR and Article 2-quaterdecies of the Privacy Code, in order to process personal data required to carry out activities that are strictly related to the use of the Website. These parties must undertake to observe strict confidentiality obligations or enter into an ad hoc confidentiality agreement;
2. the parties acting as data processors, pursuant to Article 28 of the GDPR, on behalf of the Data Controller, especially those providing services required for the Website operations (e.g. hosting providers, technical maintenance service providers, suppliers providing services related to the management of the Website, etc.). The full list of data processors is available upon written request to the Data Controller and/or DPO, at the contact details provided in paragraph 7 of this Notice;
3. the parties, entities or authorities to whom disclosure is mandatory under the law, or if required by the competent authorities. Such parties will process any personal data as independent data controllers.

The Data Controller will process and store the personal data it collects through the Website in its servers located in the European Economic Area (EEA). In certain specific circumstances (e.g. for purposes related to the electronic storage and management of data), some of your data may be provided to Recipients who may then transfer them to third countries. In this case, the Data Controller guarantees that the personal data transferred to Recipients located in third countries outside the EEA, or by international organisations, will be processed in accordance with the law, or any of the methods permitted by law, pursuant to Articles 44–49 of the GDPR, such as, for example, the consent of the data subject, the adoption of Standard Contractual Clauses approved by the European Commission, the selection of entities participating in international programmes for the free movement of data, in accordance with Recommendation 01/2020 adopted on 10 November 2020 by the European Data Protection Board.
Further information is available by sending a written request to the Data Controller and/or the DPO at the addresses indicated in paragraph 7 of this Notice.

Personal Data processed for the purposes set out in section 3, points (a) and (b) of this Notice, will be stored by the Company solely for the time strictly required to fulfil those purposes, in accordance with the principles of data minimisation and storage limitation provided for in Article 5(1)(c) and (d) of the GDPR. Personal data processed for the purposes referred to in point (a) of paragraph 3 of this Notice will be stored for the time strictly required to fulfil the said purposes, namely, for the time required to perform the requested service, also taking into account the storage periods provided by law. For the newsletter subscription purpose referred to in point (b) of paragraph 3 of this Notice, your personal identification and contact details will be processed until you withdraw the consent given pursuant to Article 7 of the GDPR and/or until you object to the processing pursuant to Article 21 of the GDPR.
In any case, the Data Controller reserves the right to store the data for the time required to fulfil any regulatory obligations to which it is subject and/or to meet any defence requirements.
Further information regarding the data storage period, and the criteria used to determine such a period, may be requested by sending a written request to the Data Controller and/or the DPO at the addresses indicated in paragraph 7 of this Notice.

Data subjects may exercise their rights and/or request information regarding the processing of their personal data by contacting the Data Controller and/or the DPO at the contact details provided below, preferably by including the phrase "Request to exercise privacy rights" in the subject line of the communication.

In particular, they may exercise the following rights at any time:

1. right to withdraw the consent granted to processing (Article 7 of the GDPR) – You have the right to withdraw your consent to processing at any time, without this affecting the lawfulness of the processing carried out prior to the withdrawal;
2. right of access (Article 15 of the GDPR) – You have the right to obtain confirmation as to whether or not your personal data are being processed, as well as the right to receive all information relating to such processing;
3. right to rectification (Article 16 of the GDPR) – You have the right to obtain the rectification of your personal data, if it is incomplete or inaccurate;
4. right to erasure (Article 17 of the GDPR) – In certain circumstances, you have the right to obtain the erasure of your personal data held in our records;
5. right to restriction of processing (Article 18 of the GDPR) – Under certain conditions, you have the right to obtain the restriction of the processing of your personal data;
6. right to data portability (Article 20 of the GDPR) – You have the right to transmit your personal data to another controller and to receive the data concerning you in a structured, commonly used and machine-readable format;
7. right to object (Article 21 of the GDPR) – You have the right to object, at any time, to the processing of your personal data, setting out the reasons justifying the objection. The Data Controller reserves the right to assess such a request, which may be rejected if there are compelling legitimate grounds for the processing which override your interests, rights and freedoms. Furthermore, you may object to – and therefore stop receiving – marketing newsletters via the dedicated link found at the bottom of every commercial email received. In any case, you may always exercise this right by writing to the Data Controller and/or the DPO at the contact details provided below;
8. right to lodge a complaint with the supervisory authority (Article 77 of the GDPR) – In accordance with the procedures set out in the following paragraph, if you consider that the processing concerning you infringes the data protection legislation, you may lodge a complaint with the supervisory authority of the Member State in which you habitually reside, work or where the alleged infringement occurred;
9. right to effective judicial remedy (Article 79 of the GDPR).

To exercise any of your rights, you may contact the Data Controller, in the person of the legal representative of the Company, by sending a letter to the registered office at Via XX Settembre 97, 00187 Roma (RM), or by writing to the PEC registered email address italiatrasportoaereo@legalmail.it

Alternatively, you may contact the Data Protection Officer by sending a letter to the ITA Airways Data Protection Officer, Via XX Settembre 97, 00187 Roma (RM), or by sending an email to dpo@ita-airways.com, providing the following details:

1. Your first name, last name and postal address
2. The details of your request

The Data Controller reserves the right to amend or simply update this Notice, in part or in full, also as a result of changes in the applicable legislation. The Data Controller therefore invites you to visit this section on a regular basis, to find out if a more recent and up-to-date version of the privacy notice has been issued.