Privacy Policy

Ecoplus 110 S.r.l., with registered office in Via Giovanni Amendola 46 – 00185 Rome, C.F. and P. IVA 16079741001 (hereinafter, the “Company“, or the “Data Controller“), is strongly committed to privacy and the protection of personal data. Therefore, we hereby intend to inform you about how we will process your personal data in accordance with the European Data Protection Regulation (the “Regulation” or “GDPR“) in relation to the visit to the website [www.leadingtrains.com] (hereinafter, the “Website”).

1. What types of personal data are processed?

Browsing Data:

The IT systems and software procedures responsible for the operation of this Website acquire, during their normal functioning, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified visitors; however, by its very nature, it could, through processing and association with data held by third parties, allow visitors to be identified. This category of data includes IP addresses or domain names of the computers used by visitors connecting to the Website, URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server’s response (successful, error, etc.), and other parameters related to the visitor’s operating system and IT environment. These data are used solely to obtain anonymous statistical information on the use of the Website and to verify its proper functioning and are deleted immediately after processing. The data may be used to ascertain liability in the event of hypothetical cybercrimes against the Website. Browsing data are processed on the basis of our legitimate interest in ensuring the security of the Website, verifying its proper functioning and obtaining usage statistics (Article 6, paragraph 1, letter f) of the Regulation).

Data voluntarily provided by you:

• In letters/forms voluntarily sent to us: the optional, explicit, and voluntary submission of your personal data to the email addresses published on the Website or through the completion of the contact form available therein entails the subsequent acquisition of such data, which are necessary to implement pre-contractual measures of which you are a party (Article 6, paragraph 1, letter b) of the Regulation);
• contact information (e.g., last name, first name, phone number, e-mail address);
• Personal information (e.g., date of birth, nationality);
• part of the credit card number (for making transactions and reservations);
• information contained in an identity document (e.g., ID card, passport, or driver’s license);
• with your consent, preferences and interests;
• with your consent, any special categories of personal data, for example, data related to health, disability, or food intolerances.

Your personal data are processed for the purposes listed in the next paragraph. You are free not to provide such data. However, failure to provide them may result in the impossibility of fulfilling your request

2. For what purposes of processing will my personal data be processed?

We will process your personal data for the following processing purposes:

Type of treatment	Purpose	Legal Basis	Retention period
Request of information	Responding to requests for information received via online forms, letters or telephone calls.	Necessity to execute a contract or perform pre-contractual measures to which you are party (Article 6(1)(b) of the GDPR).	30 days, unless a contractual relationship is established or negotiations for the establishment of a contractual relationship are initiated.
Managing bookings and sales of our commercial partners’ luxury trains	Your personal data will be used for the purpose of handling your reservation request. Health-related data (e.g. disability, food intolerance) will be processed for the purpose of providing specific assistance on board.	The processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR). Explicit consent (Art. 9(2)(a) GDPR). You have the right to withdraw your consent at any time; however, we may not be able to provide you with the requested assistance and or to carry out your booking, if necessary for the reservation.	Your personal data will be stored for as long as is necessary to fulfil contractual obligations and obligations imposed by law (e.g. tax obligations).
Soft spam	Pursuant to Article 130, paragraph 4, Legislative Decree 196/2003, the Company may use the email address you provided for the purpose of promoting services similar to those already purchased by you, provided that you  do not object to such use, by sending an email to privacy@barlettagroup.com or by clicking on the appropriate link for objection included in commercial communications and promotional emails sent by the Company.	The legitimate interest of the Company to send email communications regarding services similar to those already purchased by the customer (Art. 6.1.f. of the GDPR and Art. 130, paragraph 4, Legislative Decree 196/2003).	Your data will be kept for this purpose until you object to the processing.
Direct marketing	The Company will process your personal data to send you commercial communications and/or promotional material related to the services offered by the Company and to involve you in market research and surveys. For example, we may send you emails or use instant messaging services (including via whatsapp) or contact you by phone through an operator to explain commercial offers, initiatives and promotions related to our services.	Your consent (Art. 6.1.a. of the GDPR). Consent is not mandatory and if you decide not to provide it you will still be able to use the requested services.	Your data will be kept for this purpose until you withdraw your consent.
Profiling	The Company may create a profile based on your personal information, preferences and interests in order to send you personalized promotional information, targeted advertising material and tailored commercial offers.	Your consent (Art. 6.1.a. of the GDPR). Consent is not mandatory and if you decide not to provide it you will still be able to use the requested services.	We will process your personal data for profiling purposes until your consent is revoked. Details of your previous purchases will be kept for 12 months.
Sharing personal data to third parties for marketing purposes	The Company is part of a group of companies and may share your data to other companies within the same  group (Barletta Group), or to other companies with which the Barletta Group has business relations (e.g., Arsenale Group), providing tourist and hotel servicesalso including companies indirectly controlled, for their own autonomous marketing purposes, in order to enable them to send you information and promotional material, as well as to illustrate offers and commercial initiatives related to the products and services they offer.	Your consent (Art. 6.1.a. of the GDPR). Consent is not mandatory and if you decide not to provide it you will still be able to use the requested services.	Your data will be kept for this purpose until you withdraw your consent.
Fulfilment of legal obligations	Your personal data may be used to fulfil any legal obligations.	Fulfilling a legal obligation (Art. 6(1)(c) GDPR).	Your personal data will be kept for as long as necessary to fulfil legal obligations (e.g., in tax matters, the retention period is 10 years from the end of the contractual relationship)
Protection of a right	Your personal data may be used in order to establish, exercise or defend a right of ours, including in court.	Legitimate interest of the Data Controller. (Art. 6(1)(f) of the GDPR). Processing is necessary to establish, exercise or defend a right in court (Art. 9(2)(f) GDPR).	Your personal data will be kept for as long as necessary for the protection of our right.

3. Is the provision of data mandatory or optional?

The provision of personal data is voluntary but necessary – except for the data indicated as optional -, since in case you decide not to provide it, it will not be possible to provide you with the requested services.

4. What parties may become aware of my personal data?

Your personal data may come to the knowledge of our employees and collaborators responsible for managing the Website, providing assistance or fulfilling your requests. In addition, the following categories of persons may also become aware of your personal data, who, as data processors, provide us with services instrumental to the carry out our business activities: providers of IT and logistical services essential for the operation of the Website and group companies that provide intra-group services. When you purchase tickets or make a reservation, your personal data will be transferred to the relevant travel service provider (e.g. Arsenale Express S.p.A.). A complete list of these companies will be made available by sending a written request to the contacts below.

5. Will my personal data be disclosed to third parties?

In addition to what is indicated in the table above, your data may be communicated to third parties belonging to the following categories: to judicial authorities or police forces, in the cases provided for by law; to lawyers and law firms, where necessary to pursue our legitimate interest in exercising or defending a right in judicial and extrajudicial proceedings; to parties who are assignees of the contract or of our company or one of our branches of business.

6. Will my personal data be transferred outside the European Economic Area?

If required for the purpose of using certain of services (e.g., IT), the Company may transfer your personal data outside the European Economic Area. In this case, the transfer will take place in compliance with the provisions of the GDPR; in particular, the data will be transferred only after signing the Standard Contractual Clauses approved by the EU Commission by Decision No. 2021/914/EU or to countries that can guarantee an adequate level of protection of personal data and therefore recipients of an Adequacy Decision adopted by the EU Commission. However, with regard to data obtained through cookies, please refer to our Cookie Policy.

7. Do you use cookies or similar tools on the Website?

Yes, we use cookies on our Website. Please refer to our Cookie Policy.

8. What are my rights and how can I exercise them?

You have the right to exercise at any time, free of charge and without formalities the following rights set out in Articles 15 to 22 of the Regulation: the right to request access to personal data (i.e. the right to obtain from us confirmation as to whether or not personal data concerning you are being processed and, if so, to obtain access to the personal data, obtaining a copy thereof, and to the information referred to in Art. 15 of the Regulations) and rectification (i.e., the right to obtain the rectification of inaccurate data concerning him/her or the integration of incomplete data) or erasure of the same (i.e., the right to obtain the deletion of data concerning him/her, if one of the reasons indicated in Art. 17 of the Regulations) or the limitation of the processing concerning you (i.e., the right to obtain, in the cases indicated by Art. 18 of the Regulations, the marking of the data stored with the aim of limiting their processing in the future), as well as the right to data portability (i.e., the right, in the cases indicated by Art. 20 of the Regulations, to receive from us, in a structured, commonly used and machine-readable format, the data concerning you, as well as to transmit such data to another data controller without hindrance). You also have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you pursuant to Article 6(1) (e) performance of a task carried out in the public interest or in connection with the exercise of official authority) or (f) (legitimate interest) of the Regulation, including profiling on the basis of these provisions. You also have the right to withdraw your consent at any time when a processing is based on your consent. Revocation of consent does not affect the lawfulness of processing based on consent prior to revocation.

9. How can I contact you and exercise my rights?

Requests to exercise your rights, as set out above, may be submitted by e-mail to privacy@barlettagroup.com, or by mail to “ Ecoplus 110 S.r.l., Via Giovanni Amendola 46 – 00185 Rome – to the attention of the Privacy Officer“, or by contacting the Data Protection Officer appointed by the Company writing to the e-mail address dpo@arsenalegroup.com. We remind you that you always have the option of filing a complaint with the Data Protection Authority (www.garanteprivacy.it) or the different Supervisory Authority of the EU Member State where you reside or work or where the alleged violation occurred.

10. How will you be informed of any changes to this Privacy Policy?

This Privacy Policy may be subject to amendments and/or updates. Any changes will, in any case, ensure full protection of your rights. Should modifications be introduced that could limit the safeguards for your data or your rights compared to the current version, you will be promptly informed before your data is processed under the new terms. In any event, we encourage you to regularly review this Privacy Policy to stay informed about any changes made since your last consultation.