This Privacy Policy describes how the personal data of users of the FlyNAP application (the “App” or “FlyNAP”) are processed.
FlyNAP provides information about the activities carried out by GESAC S.p.A. on behalf of Naples Airport and Salerno Airport, as well as additional airport services available to users.
Users are not required to create an account to use the App. However, if users choose to register, GE.S.A.C. S.p.A. will collect their personal data and have access to certain statistical and technical information concerning their use of the App, after they have reviewed this Privacy Policy and the applicable Terms and Conditions of Service.
Under Regulation (EU) 2016/679, “processing” means any operation performed on personal data relating to a natural person (hereinafter the “Data Subject” or “User”), including the mere collection and/or storage of such data. “Data Controller” means the natural or legal person who determines the purposes and means of processing. “Personal Data” means any information relating to an identified or identifiable natural person, including a person who can be identified indirectly by reference to other information.
This Privacy Policy is provided before the Data Subject submits any Personal Data to the Data Controller.
The Data Controller is GE.S.A.C. S.p.A., GESAC Management Offices – Capodichino Airport, 80144 Naples, Italy, VAT and Tax Identification Number 03166090633, email: privacy@gesac.it (hereinafter “GESAC” or the “Data Controller”).
The Data Controller has appointed a Data Protection Officer (DPO), who may be contacted free of charge by sending a registered letter to the company's registered office or by emailing privacy@gesac.it.
Users may download and access the App without registering an account in order to use services that do not require authentication. In such cases, use of the App does not involve the processing of Personal Data, except for browsing data (see point a) and, where the User has consented to such processing, geolocation data (see point c).
Depending on the features used, the App involves or may involve the processing of the following categories of personal data (hereinafter “Personal Data”).
a) Browsing Data
The IT systems and software procedures used to operate the App automatically collect certain Personal Data during their normal operation, the transmission of which is inherent in the use of Internet communication protocols.
This category includes IP addresses, browser type, operating system, domain names and addresses of websites from which users access or leave the App, information about pages visited within the App, access times, time spent on individual pages, navigation paths and other parameters relating to the User's operating system and IT environment.
Such technical and IT data are collected and used exclusively in aggregated form and in a manner that does not directly identify individual users. They may be used to establish liability in the event of suspected cybercrimes affecting the App or at the request of public authorities.
If the User selects the “FOLLOW ME” service from the “TRACK FLIGHT” screen, GESAC may send push notifications providing updates on the status of arriving and departing flights, including boarding gate numbers, departure and arrival times, possible delays and other relevant information.
Users may withdraw their consent to receive push notifications at any time.
b) Data Provided for the Purchase of Products or Services Through the App
Users may purchase products or services through the App. Please refer to the relevant sections of the App for the full privacy notices applicable to these services.
Personal Data will be processed for the following purposes:
a) Use, analysis and monitoring of the App, and submission of support requests;
b) Registration of a personal account on the App;
c) Purchase of products or services through the App.
The provision of Personal Data is necessary for the purposes described in Section 3, points a), b) and c), as it is essential for the proper use of the App and, where applicable, for accessing the services offered through it.
Failure to provide the required Personal Data will prevent GESAC from providing the requested service.
The legal basis for such processing is the necessity of processing for the performance of a contract, particularly in relation to registration on the App or the provision of services requested by the User, as well as the legitimate interest of the Data Controller in ensuring the proper functioning of the App.
For further details concerning the processing of Personal Data referred to in Section 2, point d), please consult the specific privacy notices applicable to each service requested by the User.
Personal Data may be processed by GESAC personnel who have been specifically authorised to process such data and provided with appropriate operational instructions.
Personal Data may also be processed by third-party companies providing services on behalf of the Data Controller. Such companies are duly appointed as Data Processors pursuant to Article 28 of the GDPR and operate under the direction and supervision of the Data Controller.
Furthermore, the Data Subject's Personal Data may be disclosed to the competent authorities where necessary for security purposes.
Users may request an updated list of the categories of recipients of their Personal Data by emailing privacy@gesac.it.
GESAC, including through its appointed Data Processors, will collect, process, record, store and archive Personal Data using manual, electronic and IT-based systems.
Such processing will be carried out in accordance with procedures strictly related to the purposes for which the data were collected and, in all cases, in a manner that ensures their security and confidentiality.
The security of Personal Data and their transmission is ensured through appropriate protective measures, including antivirus and anti-ransomware systems, firewalls, access passwords and physical security measures designed to restrict and prevent unauthorised access to the premises where the data are stored.
7. Personal Data Retention Periods
Personal Data processed for the purposes referred to in Section 3(a) will be retained for the period necessary for GESAC to fulfil its obligations arising from the provision of the service, plus any additional retention period required under applicable civil, tax and fiscal legislation.
Personal Data collected for marketing purposes, as referred to in Section 3(b), and profiling purposes, as referred to in Section 3(c), will be retained until the Data Subject withdraws their consent or until the purposes for which the data were collected cease to apply.
This is without prejudice to any extension of the retention period necessary for the establishment, exercise or defence of legal claims or compliance with legal obligations.
Data relating to purchase details will be retained for no longer than 12 months (for commercial purposes) and 24 months (for marketing purposes) from the date of their recording.
Upon expiry of the applicable retention periods, Personal Data collected directly by the Data Controller will be deleted or, where technical limitations prevent deletion, anonymised so that the natural person to whom they relate can no longer be identified.
8. Rights of the Data Subject
The Data Controller will facilitate the exercise of the rights granted to Data Subjects under applicable legislation.
These include the right to request access to their Personal Data, rectification or erasure of such data, restriction of processing, objection to processing and data portability.
Data Subjects also have the right to lodge a complaint with a supervisory authority (the Italian Data Protection Authority – Garante per la protezione dei dati personali).
Where a Data Subject informs the Data Controller of their intention to exercise one or more rights under applicable legislation, the Data Controller will provide information on the action taken without undue delay and, in any event, within one month of receiving the request.
In particular, Data Subjects are entitled to:
i) The right of access to their Personal Data;
ii) The right to rectification;
iii) The right to erasure;
iv) The right to restriction of processing;
v) The right to be notified of rectification, erasure or restriction of processing;
vi) The right to data portability;
vii) The right to object to processing;
viii) The right not to be subject to a decision based solely on automated processing.
To exercise any of the rights provided for under applicable legislation, Data Subjects may contact the Data Controller using the contact details provided above.
9. Updates to This Privacy Policy
This Privacy Policy may be updated from time to time.
Where changes are made to the processing of Personal Data, the Data Controller will duly inform the Data Subject.
Where required by applicable legislation, the Data Subject will be given the opportunity to provide consent to any new processing activities.
If consent is refused, the Data Subject's Personal Data will not be processed in accordance with the changes described in this Privacy Policy.
10. International Data Transfers
The Data Subject's Personal Data will be processed and stored exclusively within the territory of the European Union and will not be transferred to third countries outside the EU.
All processing activities will be carried out in full compliance with the provisions and safeguards established by Regulation (EU) 2016/679 (GDPR), ensuring an adequate level of protection for the Data Subject's Personal Data.
