On 27 April 2016, the European Union approved a major reform of the data protection framework, by adopting the 'General Data Protection Regulation' (GDPR or Regulation), which is directly applicable in Member States. The Regulation replaced Directive 95/46/EC ('Data Protection Directive') and its application became mandatory as of 25 May 2018, two years after its entry into force.

The new Regulation strengthened the right to personal Data Protection and recognized it as a fundamental right in the EU. The Regulation was also a necessary and urgent response to the challenges posed by technological developments that allow the collection and processing of large amounts of personal data in real time, enabling automated decisions beyond human intervention. The Regulation meets the need for privacy protection, a matter increasingly felt by European citizens.

Infrarail S.r.l. consider protection of the personal data of their customers, employees and suppliers an obligation that goes beyond mere regulatory compliance. For this reason, it has its own Data Protection Framework, understood as the set of roles and responsibilities, internal rules and methodologies, aimed at ensuring the management and mitigation of risks to the rights and freedoms of individuals linked to the processing of personal data.

Rights of Data Subjects

EU Regulation 2016/679 (Articles 15 to 23) grants data subjects the exercise of specific rights. In particular, in relation to the processing of your personal data, you have the right to request, from Infrarail S.r.l., access to your data; modification, cancellation and portability of your data; restriction of processing; objection to processing. More specifically:

  • Right of access: You may ask Infrarail S.r.l. to confirm whether or not personal data concerning you are being processed and, if so, to obtain access to your personal data;
  • Right to rectification: You may obtain from Infrarail S.r.l. the rectification of inaccurate personal data concerning you;
  • Right to erasure/right to be forgotten: You may, under certain circumstances, obtain from Infrarail S.r.l. the deletion of personal data concerning you;
  • Right to data portability: Under certain circumstance, you may obtain from Infrarail S.r.l. portability of your personal data in a structured, commonly used and machine-readable format. Also, you have the right to transfer them to another Data Controller without hindrance from Infrarail S.r.l.;
  • Right to restriction of processing: You may, under certain circumstances, obtain from Infrarail S.r.l. the restriction of processing of your personal data;
  • Right to object to processing: You may object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you; Infrarail S.r.l. shall refrain from further processing your personal data, unless they prove the existence of compelling legitimate grounds for processing which override your interests, rights and freedoms, or in the event of establishment, exercise or defence of a legal claim.

In addition, you may lodge a complaint with the Supervisory Authority, which in Italy is the Garante per la Protezione dei Dati Personali. You may ask to exercise your rights at Infrarail S.r.l. at any time, by writing to titolaretrattamento.ifr@infrarail.it or by contacting the Data Protection Officer Contact Person, at protezionedati.ifr@infrarail.it

Personal Data Protection Policy - Processing of Personal Data of users consulting the www.ifr-infrarail.it

This policy describes the personal data we collect from users consulting the Infrarail S.r.l. website, and how we process them. The Information Notice concern processing of the personal data of users visiting the www.ifr.it, for the purposes specifically identified below, and does not concern any data collected through other methods, sources or any other websites that may be reached by the user through links present on this website, unless expressly specified.  

Please refer to the specific information provided when data are collected, for details on each process.

Here are Infrarail S.r.l. reference data:

Below is a list of the personal data processed through the website, within the limits of the purposes defined in this policy:

  • Personal data provided voluntarily (e.g. first name, last name, e-mail address, etc.) will be processed solely for the purposes described in the specific 'Data Protection Notice' drafted by the Data Controller, based on the online services. These Information Notices, which can be consulted when providing the data, will include further information, such as the legal bases of the processing, the possible recipients of the personal data, the period of retention of the personal data (or the criterion for determining this period), the existence of automated decision-making processes, including profiling, as well as all information useful for exercising privacy rights;
  • The voluntary submission of electronic mail to the addresses indicated on this Website entails the subsequent acquisition of the e-mail address, and any other personal data included in the electronic communication, as well as the sender's data, which is necessary to reply to requests. Such data is used for the sole purpose of providing the requested information;
  • Data shall not be used for any other purpose except with the explicit consent of the person concerned;
  • When browsing the website, technical information relating to the hardware and software used by visitors is collected (e.g. IP addresses or domain names of the computers and terminals used by users, URI/Url notation addresses, etc.). This information does not reveal the User's personal data, but only data of a technical/informative nature used in an aggregate and anonymous manner for the sole purpose of improving the quality of the service and providing statistics concerning the use of the Site. For further information, see the relevant Cookies section.

Personal data will be processed by for the time strictly necessary to achieve the purposes for which they were provided, and the related computer media will be protected by the adoption of appropriate technical-organisational measures, pursuant to Article 32 of the GDPR.

The user transmitting the personal data shall be responsible for its accuracy and truthfulness.