Pursuant to the applicable data protection legislation (European Regulation 2016/679, hereinafter the “GDPR”, and Italian Legislative Decree No. 196/2003, as subsequently amended and supplemented), this Privacy Notice is provided to describe how the personal data of users of the FlyNAP application (hereinafter the “App” or “FlyNAP”) are processed.
FlyNAP provides information about the activities carried out by GESAC S.p.A. at Naples Airpor, as well as additional airport services available to users.
Users are not required to create an account to use the App. However, should users choose to register, GE.S.A.C. S.p.A. will collect the personal data of registered users and have access to certain statistical and technical information relating to the use of the App, after users have reviewed this Privacy Notice and the Terms and Conditions of Service.
This Privacy Notice is provided before the Data Subject submits any personal data to the Data Controller.
1. Data Controller
The Data Controller is GE.S.A.C. S.p.A., GESAC Management Offices – Capodichino Airport, 80144 Naples, Italy, VAT and Tax Identification No. 03166090633 (hereinafter “GESAC” or the “Data Controller”).
2. Data Protection Officer
GESAC has appointed a Data Protection Officer (“DPO”), pursuant to Article 37 of the GDPR, whose official address is at the Company's registered office and who can be contacted at the following email address: dpo@gesac.it.
3. Categories of Personal Data Processed
Users may download and access the App without registering a personal account in order to use services that do not require authentication. In such cases, use of the App does not involve the processing of personal data, except for browsing data.
Depending on the features used, the App involves, or may involve, the processing of the following categories of personal data (hereinafter “Personal Data”).
a) Browsing Data
During their normal operation, the IT systems and software procedures used to operate the App collect certain personal data whose transmission is inherent in the use of Internet communication protocols.
This category of data includes IP addresses, browser type, operating system, domain names and addresses of websites from which users access or leave the App, information about pages visited within the App, access times, time spent on individual pages, navigation paths within the App, and other parameters relating to the user's operating system and IT environment.
Such technical and IT data are collected and used exclusively in an aggregated and not directly identifiable form. They may be used to establish liability in the event of suspected cybercrimes affecting the App or upon request by public authorities.
If users activate the “FOLLOW ME” service from the “TRACK FLIGHT” screen, GESAC may send push notifications providing updates on the status of arriving and departing flights, including boarding gate numbers, departure and arrival times, possible delays, etc.
Users may withdraw their consent to receive push notifications at any time.
b) Data Provided for the Purchase of Products or Services through the App
Users may purchase products or services through the App. Please refer to the relevant sections of the App for the complete privacy notices applicable to each service.
4. Purposes and Legal Basis of Processing
Personal Data will be processed for the following purposes:
a) Use, analysis and monitoring of the App, and submission of support requests;
b) Registration of a personal account on the App;
c) Purchase of products or services through the App.
The provision of Personal Data is necessary for the purposes referred to in points a), b) and c), as such data are strictly required for the proper use of the App and, where applicable, for accessing the services it provides.
Failure to provide the required Personal Data will prevent GESAC from providing the requested service.
The legal basis for these processing activities is the necessity of processing for the performance of a contract to which the Data Subject is a party — specifically, registration on the App or provision of the services requested by the user — and the legitimate interest of the Data Controller in ensuring the proper functioning of the App.
For further details regarding the processing of Personal Data referred to in point c), please consult the specific privacy notices applicable to each service requested by the user.
5. Methods of Processing
Personal Data are processed in compliance with applicable legislation using IT and electronic systems, according to procedures strictly related to the purposes specified above, in order to ensure the security and confidentiality of the data.
6. Recipients of Personal Data
Personal Data are processed exclusively by personnel authorised by GESAC, solely for the purposes of fulfilling the Company's responsibilities and obligations.
In accordance with applicable legislation, Personal Data may be disclosed to the competent authorities, acting as independent Data Controllers, where necessary to comply with legal obligations.
Furthermore, specialised providers of technical, IT and maintenance services may have access to Personal Data where they have been appointed as Data Processors pursuant to Article 28 of the GDPR.
7. Data Retention Periods
Personal Data processed for the purposes referred to in Section 4(a) above will be retained for the period necessary for GESAC to fulfil its obligations arising from the provision of the service, plus any additional retention period required under applicable civil, tax and fiscal legislation.
Personal Data collected for marketing purposes, as referred to in Section 4(b), and profiling purposes, as referred to in Section 4(c), will be retained until the Data Subject withdraws consent or until the purposes for which the data were collected cease to apply, unless a longer retention period is necessary for the establishment, exercise or defence of legal claims or to comply with a legal obligation.
Data relating to purchase details will be retained for a period not exceeding 24 and 12 months, respectively, from the date of their recording.
Upon expiry of the applicable retention period, Personal Data collected directly by the Data Controller will be deleted or, where technical means do not allow deletion, anonymised so that the individual to whom they relate can no longer be identified.
8. Transfers of Personal Data Outside the EU
Personal Data will not be disclosed or communicated to third parties located outside the European Economic Area (EEA).
Should such transfers become necessary, they will be carried out in compliance with the safeguards provided for under Articles 44 et seq. of the GDPR, and service providers will be selected from those offering appropriate safeguards, as required by Article 46 of the GDPR.
9. Rights of the Data Subject
Data Subjects whose Personal Data are processed in accordance with this Privacy Notice may exercise the following rights under Regulation (EU) 2016/679 (GDPR):
(i) The right of access (Article 15);
(ii) The right to erasure of Personal Data (Article 17);
(iii) The right to restriction of processing (Article 18);
(iv) The right to data portability (Article 20);
(v) The right to object to processing (Article 21);
(vi) The right not to be subject to automated individual decision-making (Article 22).
To exercise these rights, Data Subjects may contact the Data Protection Officer (“DPO”) by sending an email to: dpo@gesac.it.
Alternatively, requests may be submitted directly to the Data Controller at: privacy@gesac.it.
If the Data Controller refuses to comply with a request, the reasons for such refusal will be provided.
Data Subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), pursuant to Article 77 of the GDPR, through the website www.garanteprivacy.it or by sending an email to garante@gpdp.it or protocollo@pec.gpdp.it.
10. Amendments and Updates
The Data Controller reserves the right to amend or update this Privacy Notice.
