Quick Links

Personal Data Protection Policy 

Information pursuant to EU Regulation no. 679/2016 in relation to the protection of individuals with regard to the processing of personal data and the free movement of such data, while repealing Directive 95/46/EC (General Data Protection Regulation - GDPR)

The Data Controller for the ATM Group is A.T.M. S.p.A., with registered office in Milan, Foro Buonaparte 61, Postal Code 20121.

The contact points for the Data Controller and for the Data Protection Officer can be found at the bottom of this statement (under Contacts).

Processing purposes

The data processing purposes within the ATM Group are aimed at providing local public transport services, mobility services for urban and extra-urban areas of competence and related services, and in particular refer to (by way of example and not limited to):

a) the management of transport systems, structures and infrastructures and the mobility of people, things and information;
b) the road and rail transport services in the rental sector (i.e. tram restaurant, tourist services, bike sharing, etc.);
c) consultancy activities within the ATM Group in the insurance sector, aimed at claims inquiry and settlement;
d) the management of services for transporting people and things and relevant planning and operational organization activities regarding the handling and maintenance contracts for metropolitan systems in Italy and in the EU;
e) design and construction, maintenance and integrated diagnostics of structures and metro-tram control systems in Italy and in the EU;
f) passes;
g) checking;
h) paid parking;
i) removal and custody of vehicles;
j) ATM events open to the public.

The data will not be processed, nor disclosed, nor used, nor stored for other purposes different by the ones related to the company reference processes and services provided.

All the rights fixed by the GDPR are guaranteed, as established by current legislation, of which the main ones are listed below:

1. access,
2. amendment,
3. deletion,
4. limitation,
5. opposition,
6. data portability,
7. submitting a complaint to the Personal Data Protection Authority.

Personal data can be managed and processed with automated and computerized processes too.

Data retention is linked to the needs of the company reference processes and to the services provided in compliance with the provisions of the Guarantor for the Protection of Personal Data.

The transfer of personal data collected to extra-EU countries is not foreseen.

Considering children under the age of 16, or in any case under the age established by current legislation, the rights may be exercised by who has parental authority.

Data Processors outside the ATM Group
The ATM Group processes data with the support of external Processors whose references will be notified in compliance upon specific request, according to GDPR.

Authorized processors
Personal data may be managed by authorized processers and employees and may be passed to other subjects if it’s due to service provision.

Communications relating to computer systems
This notice is also addressed to all natural persons interacting electronically with web services provided in these websistes and web applications:
• www.atm.it
• www.atm-mi.it
• www.atm-alert.it
• www.lavorareinatm.it
• www.nordesttrasporti.it
• ATM Milano Official App mobile application owned by Azienda Trasporti Milanesi S.p.A.
• ATM Group newsletter.

Personal data will be processed using IT/electronic tools for newsletter services and will be used for anonymous statistical and market research studies, always due to service offered.

The information is valid only for the above-mentioned websites and not for other sites that can be consulted by link to third-party websites.

This information is also based on Recommendation n. 2/2001 adopted by the European Authorities in order to identify the requirements for collecting personal data online with the methods, timing, and nature of the data provided by the controllers to end users when they connect to web pages, regardless of the purposes of the connection.

Another processing purpose, in this specific case, is the correct browsing on ATM Group's websites indicated above, as well as the use of services provided by ATM Group to those who register theirselves.

Types of data processed
During normal functioning, computer systems in general, Internet transmission protocols and the based site software collect  some  personal data.
The information is not collected for identification purposes, although this may be possible through processing by the competent Authorities.

Data collected
The data collected refers to: IP addresses; Uniform Resource Identifier (URI) addresses of the requested resources; time of the request; methodology used for the server request; size of the file obtained in response; numerical code indicating the status of the response given by the server (successful outcome, error, etc.) and other parameters relating to the operating system and the user's computer environment.
Appropriate security measures are applied for all data processing in order to prevent the loss of information, illegal or improper use and incorrect or unauthorized access.
This data will be used only for anonymous statistical purposes and for managing the sites and the mobile application ATM Milano official app.

Processing methods and Cookies
Cookies are text files containing small amounts of information that are downloaded to the user's device, if enabled, when browsing the Azienda Trasporti Milanesi S.p.A. website and mobile app ATM Milano official app.
No personal data is acquired by the site unless knowingly provided by the user.
ATM Group doesn’t use cookies to pass on natural person information, although cookies are used in an aggregate way, not in order to identifythe website visitors, nor to monitor customers’ browsing habits. In this field, ATM Group web activities are focused only  to improve the service offered and to make browsing on the site more secure and efficient.
Azienda Trasporti Milanesi S.p.A. uses "cookies" in order to provide the website’s visitors with contextualised information and to obtain access statistics (using the Google Analytics service) https://support.google.com/analytics/answer/6004245?hl=en

The site uses cookies in accordance with the following purposes and classification:

System cookies
These cookies allow the user to browse the site and use its functions, for example, to access the sites and ATM Milano official app secure areas. Without these cookies, it will not always be possible to provide the authentication and correct functioning of the website.
These cookies are not defined by Azienda Trasporti Milanesi S.p.A.; rather they are generated and used automatically by the software platforms used.
Nevertheless, they are intended for the purpose of general functioning and do not have any effect on the protection of the user's personal data.

Cookies for performance and browsing analysis statistics
Azienda Trasporti Milanesi S.p.A. uses the Google Analytics statistics platform and incorporates its cookies and access methods.
This analytical tool collects the standard log information used on the Internet and anonymous information on the visitor's browsing behaviour.
Should you wish not to choose be analyzed by Google Analytics on all websites, visit https://tools.google.com/dlpage/gaoptout, and follow Google's instructions.

Technical Cookies
The cookies used are considered technical, also called "session" or "temporary", which help the user browse the site and remember the choices made during the session. They are deactivated as soon as you leave the site via the log out procedure or after a period of inactivity. Profiling cookies are not used.

Registering to the site and creating an account
When registering to the ATM Group website services, the user must create a personal account from the registration page. To do this, the user must enter some basic personal data, a user ID (e-mail) and a password.
The user is responsible for the correctness and truthfulness of the information, as well as the safe custody of access credentials and the website activities attributable to their identity.

How to delete your profile
To delete your ATM profile it is necessary to enter your personal area and, in the "Profile section", click on the "Delete profile" button (at the bottom of the page).

Location services and third part map services
The location access is not mandatory and can be refused by the user letting him free to use all the ATM Milano app's functions. The location services, when allowed by the user, are active only when the app is active. The locations are not stored by ATM Group and are managed by the following maps services:
- Google for Android (read their policy https://policies.google.com/privacy?hl=en&gl=ZZ)
- Apple for iOs (read their policy https://www.apple.com/uk/privacy/)
- Windows for Windows (read their policy https://privacy.microsoft.com/)

Personal data protection office: protezionedatipersonali@atm.it
Personal Data Protection Supervisor: rpd@atm.it