Processing of personal data

Clear Channel Privacy Statement relating to the "Verona Bike" Bicycle Sharing System

To whom does this Privacy Statement apply?

The protection of privacy is seen by Clear Channel Italia S.p.A (“we” "us" or “our” hereinafter) as an absolute priority, and accordingly, we collect and process the Personal Data of the Data Subject securely. To protect the privacy of the Data Subject, Clear Channel Jolly Pubblicità S.p.A. operates in compliance with EU Legislation on Data Protection, and in particular with General Data Protection Regulation 2016/679. We recommend that this Privacy Statement relating to the Verona Bike Bicycle Sharing System ("Verona Bike" hereinafter) should be read with care by the Data Subject before its content is accepted.

This Privacy Statement relating to the Verona Bike Bicycle Sharing System (the "Statement") is addressed to the Data Subject as user of the Smart Bike service or Bicycle-Sharing System (the "User”); its object is to inform Data Subjects of the methods, the time-scales and the purposes of processing their Personal Data. It also explains what are the rights of Data Subjects with regard to the processing of their Personal Data, and how those rights can be exercised.

Why is this Statement important?

The Controller of Data processing is Clear Channel Italia S.p.A., with registered office at Viale Regina Margherita 42, Rome, listed in the Company Register under n° 12710340154.

Clear Channel Jolly Pubblicità S.p.A. is legally bound to inform Data Subjects who are Users of the Verona Bike service, how we process their Personal Data.

Clear Channel Jolly Pubblicità S.p.A. offers a Bicycle Sharing service in the city of Verona, known as “Verona Bike” (the “Service”), which allows users to hire a bicycle after they have taken out a subscription, an operation carried out on the www.bikeverona.it website, by means of an official "Verona Bike" mobile application or using any other appropriately configured mechanism ("Platforms”), in accordance with the conditions of use that can be consulted by visiting the download section of the www.bikeverona.it website. Clear Channel Italia S.p.A. manages the Verona Bike service on behalf of the Municipality of Verona. In order to make this service available, we need to collect and process Personal Data provided by the Data Subject.

"Personal Data" means any personal information relating to an identified or identifiable physical person as defined in accordance with the applicable European regulation (in particular GDPR, the EU General Data Protection Regulation 2016/679).

What is the purpose of this Statement?

This Statement informs Data Subjects of the procedures adopted by us since 25 May 2018 with regard to the processing, utilization and disclosure of Personal Data received from them by way of our Platforms.

What kind of Personal Data do we collect, also how and for what purposes?

We may use the Platforms of our Verona Bike system to collect the following Personal Data, at the times and for the purposes specified below:

  • Name and surname of the Data Subject, at the moment of registering for the first time or thereafter, for the purposes of personal identification;
  • Sex of the Data Subject, at the moment of registering for the first time or thereafter, for the purposes of personal identification;
  • E-mail address of the Data Subject, at the moment of registering for the first time, for the purposes of personal identification, checking an order, providing updates and sending information that might be of interest;
  • Postal and invoicing address of the Data Subject, at the moment of registering for the first time or thereafter, for the purposes of personal identification and processing an order;
  • Mobile phone number of the Data Subject, at the moment of registering for the first time, for the purposes of personal identification and communication;
  • Payment information, at the moment of registering for the first time and at any other moment during registration, for the purposes of completing an order;
  • Direct debit details and relative instruction of the Data Subject, at the moment of registering for the first time and at any other moment during registration, for the purposes of completing an order;
  • Time records relating to telephone calls and to bicycle docking stations (including date and time), logged during calls made to our customer service or at the moment of picking up and returning a bicycle, for the purposes of monitoring the security of our bicycles and preventing their unauthorized use;
  • Secure access credentials, where Data Subjects register in order to enter protected or reserved areas of our Platforms, for example to access their customer account or visit the marketing preferences section of the control panel;
  • Geographic localization (anonymized), serving to record the position of our bicycles for the purposes of security and preventing theft;
  • Geographic localization — in the event that our Platforms are utilized by the Data Subject — for the purposes of providing other localization-based services such as those mentioned below. Where Data Subjects make use of the Platforms in question, we may process further items of their Personal Data, with their consent, as specified hereunder (see: Localization Based Services).
  • Medical information relating to insurance settlements, to the end of supporting the Data Subject in the handling of an insurance claim;
  • Reports to Judicial Authorities and relative documentation
  • Photographic material sent by the User
  • All as stated in the Privacy Statement issued by Clear Channel Jolly Pubblicità S.p.A.

In certain circumstances, we may ask Data Subjects to provide additional items of Personal Data so that we can respond more fully to their needs. Failure on the part of Data Subjects to communicate Personal Data when requested may result ultimately in limitations being imposed on their ability to access the Service, or on our ability to provide them with the necessary assistance.

Sensitive Personal Data

We will not ask any Data Subject to provide us with Sensitive Personal Data, except when this may be necessary in the context of a claim for insurance compensation or in the event of our having to report a problem to the legal authorities.

The expression "Sensitive Personal Data" relates to Personal Data regarding: racial or ethnic origin, political opinions, religious or philosophical beliefs; trade-union membership; physical or mental health; sex life or criminal convictions. Where Sensitive Personal Data may be provided by a Data Subject, Clear Channel will seek that person's explicit consent to ensure that the information in question will be used exclusively for the intended purposes.

What are the purposes of and the legal grounds for collecting personal data?

In addition to the purposes stated above, we may collect this information so as to make all the functionalities of Verona Bike available to the Data Subject, in particular: to verify and formulate uses; to handle payments connected with the use of the service; to keep Data Subjects updated on their activities related to the service; to respond to their enquiries; to support them in the process of recovering a missing or stolen bicycle and provide assistance in the event of injury or setbacks. We are able to perform these functions as the Data Subject is registered for the purpose of using the Verona Bike service and the legal grounds allowing us to process the data is that of the fulfilment of a contract, unless otherwise stated.

Other valid legal grounds are provided by our legitimate corporate interests and those of the city of Verona, as concerning our agreement to use certain types of information in customizing our Platforms according to the characteristics of the Data Subject and to improve his or her experience as a user of the service; to adapt and improve our Platforms; to provide assistance to customers and deal with complaints (which could involve checking items of personal information relating to the Data Subject or choosing to have them checked by third parties, should this be necessary in order to provide tailored services); to manage the supply of bicycles on behalf of the city of Verona; to provide information on the Data Subject to our service department and to the team tasked with the recovery of bicycles; to prevent fraud; to communicate delivery schedules, information on services and other updates to the Data Subject and to enable statistical procedures involving the anonymization of data. We can also process Personal Data originating from third party applications needed for operation of the Service.

We may need to share details of the Data Subject with local law enforcement agencies, including the police, if required to do so by law, or if necessary in order to satisfy our own legitimate interests or to safeguard the interests of the Data Subject or of other subjects.

Localization based services

Clear Channel may collect, utilize and share precise localization data, including the real time geographic localization of the bicycle currently hired by the User, to the end of providing our Verona Bike system with localization based services. Localization based services could make use, if available, of GPS and Bluetooth technology, the IP address of the user, crowd-sourced Wi-Fi hotspots and other technologies to determine the approximate position of the user's device and the distance by bicycle.

The use of these devices is designed exclusively to ensure correct operation of the Bike Sharing service using electric pedal assisted bicycles and to safeguard the integrity of Clear Channel corporate assets, with reference in particular to the functional effectiveness of the "Theft report" feature.

Rights of the Data Subject

In accordance with the EU General Data Protection Regulation 2016/679, the Data Subject has the right to receive information on and access to all Personal Data in our possession concerning him or her, and such rights can include, by way of example, the right to request that one's Personal Data be rectified or erased; the right to withdraw one's consent; the right to know the purposes for which one's Personal Data will be processed and the recipients to whom the Personal Data can be communicated (subject to existing legal and regulatory requirements).

Anyone who does not wish their Personal Data to be processed as described in the present Statement is asked not to send their Personal Data to Clear Channel by way of the Platform or utilizing any other means of transmission.

Right to have Personal Data rectified

We assume the responsibility of keeping accurate records of Personal Data subsequent to their communication, but we cannot assume any responsibility for confirming the accuracy of records if Data Subjects do not update their Personal Data.

Should the Data Subject inform us that his or her details are no longer correct, we will ensure that they are rectified or updated (provided that the communication received is exact and legitimate). The Data Subject can inform us of any inexact data items by contacting our customer service department at info@bikeverona.it

Right to obtain copies of Personal Data and Right of transfer

Where permitted by law, a Data Subject has the right to contact us in order to request a copy of the Personal Data concerning him/her and being processed by us. Before responding to any such request, we may ask the Data Subject (i) to provide us with proof of identity and (ii) to furnish us with further details that will enable us to deal with the request more satisfactorily. Data Subjects can also request that their data be transferred to another entity. This right can be exercised by contacting the customer service department, sending an e-mail to info@bikeverona.it

Right to Erasure of Personal Data or Restriction of processing

Data Subjects are entitled in certain instances to have their Personal Data erased by us, for example in the event that we no longer need the data in question, or that their consent (where applicable) is being withdrawn. If we have shared their data with third parties, we will inform these parties as far as possible of the decision to erase.

Right to withdraw consent

Where a Data Subject may have given consent at any time to our processing of his or her Personal Data in the situations and for the purposes described above, and wishes subsequently that such processing should cease, the pertinent registration can be cancelled by contacting our customer service department, sending an e-mail to info@bikeverona.it

Rights concerning automated decision-making and profiling

Data Subjects have the right not to be subjected to decision-making based solely on automated processing, including the sole process of profiling. We are entitled to resort to this type of decision-making process only where the decision is necessary for the purposes of concluding or fulfilling a contract; or where authorized by the laws of the Union or of the member State to which we are subject; or where based on the explicit consent of the Data Subject. We will always inform Data Subjects if and when recourse is made to such processes during the utilization of their Personal Data.

Right to object to processing for marketing and promotional purposes

Data Subjects have the right to object to the sending of promotional and marketing communications, proceeding as follows:

  • by changing their marketing preferences in the User area of the Verona Bike portal.

In the event that the Data Subject should not wish to receive promotional and marketing messages in future, we will make no further contact for the purposes of direct marketing. This will not prevent the Data Subject from using our Verona Bike Platforms.

Any question or complaint the Data Subject may have with regard to the handling of his/her Personal Data can be addressed to our Privacy Office at mydata@clearchannelint.com.

Personal data of children

Our Platforms are not targeted at children under 14 years of age. Accordingly, we do not knowingly undertake any activity through these Platforms that may involve the processing of their Personal Data.

Third party websites

The fact that there may be links on our Platforms to websites that do not belong to Clear Channel implies neither any liability nor any approval on our part as concerning these sites. The websites of third parties are regulated by different conditions of use (including privacy statements) and the user alone assumes responsibility for viewing and interacting with the sites in question, according to the conditions of use applicable for each one. Clear Channel declines any liability whatsoever deriving from the manner in which personal information is handled by third party websites, which are excluded from the scope of this Statement unless specified to the contrary.

Security of Personal Data

The Personal Data of the Data Subject (including business information) will be processed guaranteeing the maximum level of confidentiality and security. Clear Channel implements suitable technical and organizational measures in this regard, fully adhering to statutory requirements and established industry practices. In compliance with the provisions of EU General Data Protection Regulation 2016/679, moreover, Clear Channel observes strict security procedures as concerning the storage and disclosure of Personal Data provided by the Data Subject, in order to avoid any risk of unauthorized access as far as possible.

In order to safeguard the confidentiality of Personal Data provided by Data Subjects, we adopt standard industry practices, using firewalls and Secure Socket Layer protocol. We look on the Personal Data of any Data Subject as an asset to be protected against loss, alteration, destruction and unauthorized access. Our employees and representatives are duty bound to ensure the confidentiality of such data, which will be protected against any unauthorized access on the parts of users inside and outside of Clear Channel by means of various security methods. We also implement internal protection systems to ensure that the Personal Data of users can be accessed only by employees or by representatives who need to know the details for the purpose of fulfilling a specific function. Whilst total security is impossible to guarantee, we are nonetheless committed to adopting the appropriate measures in the event of violation occurring.

The Data Subject will be informed, if deemed appropriate, of any security breaches affecting his or her Personal Data.

Transfer of Personal Data

Third parties

Should it be necessary to involve external service providers for the purposes of performing our contractual obligations or to ensure compliance with regulatory provisions, Clear Channel undertakes not to transfer identifiable, non-aggregated Personal Data to subjects other than third parties entrusted with processing operations, who are bound by a data processing agreement that reproduces the conditions of the present Statement, in accordance with the relative provisions.

Clear Channel may receive and transmit information about users visiting the Platforms, including their Personal Data, to its partners or sub-contractors (Data Processors) in the sphere of technical, payment and identity verification procedures and delivery services, also to providers of analytical services and credit reference agencies;

We will share the Personal Data of Data Subjects with third party Processors only in the following cases:

  • Where it is necessary to involve an external service provider, for the purposes of performing our contractual obligations regarding provision of the Service to the user (e.g. a payment processing system, when costs incurred in connection with the Service are charged to the User);
  • When pursuing our legitimate business interests, for example:As part of the utilization process, we may employ various IT applications for the purposes of providing the Service to the user.
  • Disclosure to a service provider entrusted with maintenance of our Platforms;
  • We engage providers of analytical services and search engines to help improve and optimize our Platforms.
  • In addition, we can disclose information on users if required to do so by law or if we are of the opinion, in good faith, that access, retention or disclosure may be reasonably necessary (i) for the purposes of responding to complaints that could be made against us, (ii) in the pursuance of legal proceedings, (iii) for the application of agreements with our users, typically our Terms and Conditions and our Privacy Statement, (iv) in the event of an emergency involving danger to public health, or a risk of death or serious personal injury, (v) in the context of an investigation, or (vi) to protect the rights, property or personal safety of employees and representatives of Clear Channel Jolly Pubblicità S.p.A.

Requests for further information on third parties engaged as data processors can be addressed to mydata@clearchannelint.com

Intragroup Transfers between Data Controllers

Clear Channel Jolly Pubblicità S.p.A. belongs to a group of businesses led by parent company Clear Channel International Limited, with registered address at 33 Golden Square, London W1F 9JT, which is a subsidiary of Clear Channel Outdoor Holdings, a US publicly listed company. It may become necessary on occasion to transfer Personal Data collected by Clear Channel Jolly Pubblicità S.p.A. to the parent company and to the US holding company, and to their respective Data Processors, in furtherance of our legitimate business interests.

Transfers outside the European Union

The processing of Personal Data referred to in this Statement takes place in Europe. We will not transfer any data outside the European Union without the consent of the Data Subject.

Sale or merger

In the event that Clear Channel Jolly Pubblicità S.p.A. or its assets are sold to or merged with another organization, the Data Subject will understand that the Personal Data collected by us may be transferred to the acquiring or absorbing company. In this instance we will seek to ensure that the acquiring company is obligated to utilize any Personal Data transferred in a manner consistent with applicable law and with the present Statement, albeit there can be no guarantee that such requirements can be imposed or that the acquiring company will abide by them.

Retention of Personal Data

Where a user has communicated Personal Data to Clear Channel, including localization data, the information will be stored for the duration of that user's subscription to the Verona Bike service, for the length of time specified by applicable laws, or for a reasonable period of time needed in order to achieve the operational ends of the bicycle sharing service (Clear Channel or the relative our third party data processors will proceed to rectify or erase the Personal Data of the Data Subject when no longer needed in order to achieve the operational ends of the bicycle sharing service ).

Contacts

Any comments, complaints, enquiries or questions relating to this Statement, to the rights of the Data Subject, to the Platform, to our advertising and promotional material, or to the Services provided by Clear Channel, can be addressed to the Personal Data Protection Officer at Clear Channel, sending an e-mail or a letter to the Privacy Office:

Data Protection Officer

Privacy Office

Clear Channel International

33 Golden Square

London, UK

W1F 9JT

E-mail: mydata@clearchannelint.com

There is also the option of contacting the local office of the Data Protection Authority: details at www.garanteprivacy.it. The authority entrusted with the protection of data processed by Clear Channel Jolly Pubblicità S.p.A. is the UK Information Commissioner’s Office (ICO), which the Data Subject can contact by clicking here

Changes to this Privacy Statement

The present Statement is reviewed periodically in order to guarantee its compliance with current statutory regulations.

Clear Channel retains all applicable rights of ownership on the information collected, and reserves the right to change or modify the content of this Statement, also to add or remove provisions to or from this same content as necessary. Any changes to this Notice will be posted here, and accordingly, the user is encouraged to check periodically.

Applicable law

The present Statement is regulated and interpreted in accordance with Italian law.