This Privacy Notice is provided pursuant to articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Decree 101/2018 ("Privacy Code") to describe how personal data of users interacting with movisalento.it and with the services offered by Movi are processed.
1. Data Controller
The Data Controller is Movi Salento, a project run by Simone as proponent, with operating address in Tricase (LE), Italy. Contact channels: email info@movisalento.it · WhatsApp +39 375 787 6484.
A VAT number is being applied for in connection with this project; the full Controller denomination and tax identifier will be updated on this page as soon as available.
2. Nature of the service
Movi operates as a technical intermediary between users seeking a private transfer service in Salento and authorised NCC drivers who provide the service. Movi is not a transport operator, does not enter into transport contracts and is not liable for the execution of the service. Operational, tax and insurance responsibility for the transfer remains with the NCC driver who holds the authorisation.
3. Categories of data processed
3.1 Browsing data
The IT systems hosting the Site automatically acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of internet protocols: IP addresses, browser type, operating system, references to pages visited, access times and visit duration. These data are used solely to obtain anonymous statistical information about the use of the Site and to verify its proper functioning.
3.2 Data provided voluntarily
- Transfer request via WhatsApp: when you click a "Book via WhatsApp" button or a route link, a WhatsApp conversation opens with a pre-filled message. Any data you choose to share in the chat (name, phone number, route, date, time, number of passengers, preferences) is transmitted via the WhatsApp/Meta Platforms Ireland Limited infrastructure and received by the Controller to handle your request.
- "Become a partner" form: NCC drivers interested in joining fill in a form which, on clicking "Open WhatsApp to send", builds a pre-filled message containing: full name, phone, operating area, number and type of vehicles, declaration of holding an active NCC licence, availability range, English knowledge, optional Instagram/Facebook links and free-text message. The message is opened in WhatsApp and sent by the user to the Controller's number.
- "Notify me at app launch" form: the user voluntarily provides their email address to be notified when the Movi app is released. The data is transmitted via WhatsApp as well.
- Direct email: data communicated in emails sent spontaneously to info@movisalento.it.
3.3 Cookies and tracking tools
The Site uses technical cookies necessary for its operation and, with consent, Google Analytics 4 analytics cookies (with anonymised IP). Full details of all cookies used, purposes, duration and consent management are provided in the Cookie Policy.
4. Purposes and legal bases for processing
| Purpose | Legal basis |
|---|---|
| Responding to transfer booking requests and managing the related intermediation with the NCC driver | Art. 6.1.b GDPR (performance of pre-contractual and contractual measures) |
| Evaluation and management of partner NCC driver applications | Art. 6.1.b GDPR (pre-contractual measures at the data subject's request) |
| Subscription to the mailing list for the app launch notification | Art. 6.1.a GDPR (explicit consent) |
| Aggregate statistical analysis on the use of the Site | Art. 6.1.a GDPR (consent given via cookie banner) |
| Compliance with legal obligations (tax, accounting, administrative) and defence of legal claims | Art. 6.1.c GDPR (legal obligation) and Art. 6.1.f (legitimate interest) |
5. Processing methods
Data is processed using electronic tools in compliance with technical and organisational security measures appropriate to the risk, in accordance with article 32 GDPR. Access to the data is limited to the Controller and to specifically authorised persons. The data is not subject to automated decision-making or profiling.
6. Retention period
- Booking request data: 24 months from the last contact, except for retention obligations of longer duration provided for by law.
- Partner application data: 24 months in case of unsuccessful onboarding; for onboarded drivers, for the duration of the intermediation relationship and subsequently for the period required by tax and accounting obligations (10 years).
- App waitlist email addresses: until consent is withdrawn or in any case no longer than 36 months from registration.
- Browsing and analytics data: in accordance with the times indicated in the Cookie Policy (maximum 14 months).
7. Recipients of the data
Personal data may be communicated to the following parties, in connection with the purposes set out above:
- Partner NCC drivers to whom the transfer request is forwarded for booking and contact purposes. Drivers act as independent data controllers as regards the performance of the transport service;
- Technology providers appointed as Data Processors pursuant to article 28 GDPR: Vercel Inc. (platform hosting), Google Ireland Ltd (analytics), WhatsApp Ireland Ltd / Meta Platforms Ireland Ltd (communication);
- Consultants and professionals assisting the Controller in legal, tax and accounting matters;
- Competent authorities in compliance with legal obligations or orders of the authority.
Data is not disseminated and is not communicated to parties other than those listed.
8. International data transfers
Some of the providers listed above (in particular Google and Meta) may process personal data in countries located outside the European Economic Area, in particular in the United States. Such transfers take place on the basis of the Standard Contractual Clauses adopted by the European Commission and, where applicable, the Data Privacy Framework certification, ensuring an adequate level of protection.
9. Data subject rights
As a data subject, you have the right, pursuant to articles 15-22 of GDPR, to:
- access your personal data;
- request its rectification or erasure;
- request restriction of processing;
- object to processing on legitimate grounds;
- receive the data concerning you in a structured and interoperable format (portability);
- withdraw your consent at any time, without prejudice to the lawfulness of processing based on consent before withdrawal.
To exercise your rights write to info@movisalento.it. We will respond within the time required by applicable law (usually within 30 days).
10. Complaint to the supervisory authority
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) if you believe that the processing of your data infringes applicable law. For more information: www.garanteprivacy.it.
11. Changes to this notice
This notice may be updated at any time to reflect any regulatory or organisational changes. The date of last update is shown at the top of the document. Please review it periodically.
Document drafted on the basis of the public guidelines of the Italian Data Protection Authority and widely used professional templates. For specific cases, dedicated legal advice is recommended.