ASF Flex Privacy

ASF FLEX local public DRT service personal data disclosure.

Last update: 07/04/2025

1. Background and identification of personal data processing figures

ASF Autolinee S.r.l. collects and processes a series of personal data belonging to customers who use the local public transport service provided by the company.

This document provides interested parties with information regarding the processing of their personal data pursuant to Art. 13 of European Regulation 679/16 on the protection of personal data (hereinafter RE 679/16) for the booking and provision of local on-demand public transport services.

In addition to this specific policy for on-demand services, ASF Autolinee S.r.l. provides customers (including via the website www.asfautolinee.it) with information on the processing of personal data for the provision of local public transport services in general, as applicable.

The owner of the processing of personal data covered by this information is ASF Autolinee S.r.l., tax code, VAT number IT02660190139, REA Como CO – 272121, PEC, mail.

The Data Controller has appointed a Data Protection Officer (DPO) who can be contacted at this address.

2. Processing of data disclosed by customers for booking and use of DRT services

ASF Autolinee S.r.l. processes personal data provided by customers to book and use the ASF FLEX on-demand public transport service. This service can be booked using the dedicated smartphone app called “ASF FLEX” or by telephone through the call center. The data processed includes first and last name, telephone number, email address, route used, day and time of service use, and indication of access for people with disabilities, which the individual concerned communicates to ASF Autolinee S.r.l. to request the provision of the service. In the case of booking via the app, the geolocation data of the smartphone is also processed to allow the selection of the ASF authorized stop closest to the departure and destination locations.

The purpose of processing such personal data is therefore to provide the on-demand public transport service, and such data is necessary for the provision of the requested service. Without such data, the service cannot be provided.

The legal basis for this processing is the need to satisfy the request of the data subject and to fulfill the relevant transport contract with them.

ASF Autolinee S.r.l. may also process the data indicated above for:

  • to perform internal and aggregate analysis on the collected data in order to improve the services and operation of the ASF FLEX App; the legal basis for such processing is the legitimate interest of the data controller in improving the services provided;
  • carry out direct marketing activities aimed at its customers; the legal basis for this processing is the consent of the data subject, which may be provided when reading the privacy policy.

3. Method of processing and retention time

The personal data covered by this notice are processed, including through managers appointed in compliance with applicable regulations and for the sole purposes indicated, using both paper and electronic methods and adopting appropriate measures to ensure their protection. The personal data covered by this notice processed for contractual and legal obligations will be kept by ASF Autolinee S.r.l. for up to 10 years.

The processing of personal data based on the legitimate interest of the Data Controller is carried out for a period not exceeding two years.

The processing of personal data based on the consent of the data subject is carried out until the consent is revoked.

In the event of litigation with a data subject or a specific request by the competent Authorities, personal data may be retained for as long as necessary to protect the interests of the Data Controller or to comply with the Authority’s request.

In any case, the data provided will be stored electronically in ASF Autolinee data centers located in Italy or in other European Union countries.

4. Rights of the data subject

The data subject may exercise their rights pursuant to Articles 15, 16, 17, 18, 19, and 20 of Regulation (EU) 2016/679. In particular, they have the right to request access to their personal data, the rectification or erasure of such data, as well as to request the restriction of or object to the processing of such data or request its portability.

To exercise these rights, please refer to the contacts indicated at the beginning of this policy. Requests received will be processed and responded to within a period not exceeding 30 days, as indicated by RE 679/16. In the event of complex requests or a large number of requests, this period may be extended to 90 days, subject to notification to the data subject.

Upon final resolution of the request and against the same, the interested party has the right to lodge a complaint with the supervisory authority and to seek judicial review.

Download PDF

Skip to content