Privacy Policy

Alicost SpA processes the personal data of its Customers and Passengers in compliance with Regulation (EU) 2016/679 (GDPR) and Legislative Decree no. 196 of 30 June 2003 (Privacy Code), as amended, as well as the principles of confidentiality that inspire the Company’s activities. Pursuant to Articles 13 and 14 of the GDPR and Article 13 of the Privacy Code, Alicost SpA provides some information on the use of personal data.

Data controller

The data controller is Alicost SpA with registered office at Via Sopramuro, 2 84011 – Amalfi (SA).

Alicost SpA has appointed the person indicated below as Data Controller (Data Processor):

  • Lauro Holding Srl, with headquarters in Via del Governo Vecchio n. 3, Rome (RM), Lazio, Italy

for automated data processing and profiling activities for commercial and marketing purposes.

Please note that the complete and constantly updated list of the aforementioned entities to whom data may be disclosed in their capacity as Data Processors may be requested using one of the communication channels made available by the Company for the exercise of data subjects’ rights, indicated below.

Purpose and legal basis of the processing

During ticket booking and sales, during boarding, and during the ferry journey, Alicost SpA acquires and processes the data of both the Customer (the ticket purchaser who signs the transport contract) and the Passenger (i.e., all natural persons to whom the ticket refers who board the ferry).

The processing of the personal data acquired occurs for the following distinct purposes and based on the different relevant legal bases of processing:

  • Management of pre-contractual phases, performance of business activities, and management of relationships established with all interested parties; this processing is necessary for the conclusion and execution of the contract to which the interested party is a party.
  • Fulfillment of obligations under laws, regulations, EU legislation, and provisions issued by competent authorities and supervisory and control bodies (in particular, laws regarding security and counterterrorism; regulations regarding administrative obligations, etc.). In this case, the legal basis for the processing is the need to fulfill a legal obligation.

Additionally, Alicost SpA collects customers’ personal data to conduct market research and for marketing and commercial information purposes, offering personalized services and promotions based on customer preferences. In this case, explicit consent will be requested from the interested party.

Categories of data acquired and processing methods

The personal data processed for the purposes of booking and purchasing tickets and checking passengers on board, as well as pursuant to Directive 18/06/1998, no. 41 implemented by Ministerial Decree 13/10/1999, are collected by Alicost SpA directly from the interested party and/or from third parties (Customer) and fall into the following categories:

  • personal data (name and surname, gender, age or date of birth, nationality);
  • contact details (telephone number, email, etc.);
  • data relating to the passenger’s health (falling within the “special categories of data” referred to in art. 9 of the GDPR and the corresponding articles of Legislative Decree no. 196/2003).

Nature of data provision

  • Mandatory data: personal data and data relating to the passenger’s nationality.

This personal data is strictly necessary for providing the service, acquired and processed for booking and purchasing tickets, and for passenger acceptance on board.

This data is essential for establishing and maintaining the relationship, also pursuant to applicable laws and regulations; therefore, any refusal by the interested party to provide and process this data objectively makes it impossible for Alicost SpA to provide the aforementioned services. For further information, please also refer to the “Conditions of Carriage” published at the following link on the Alicost SpA website: http://www.alicost.it/

  • Optional data: data relating to the passenger’s health status (e.g., any disabilities).

Providing this data is optional and does not prevent Alicost SpA from providing the transport service to the passenger.

However, failure to provide and process this type of data could compromise the quality of the service provided by Alicost SpA, as any necessary assistance and care cannot be guaranteed.

  • Optional data: contact data collected for promotional and commercial purposes, marketing, market research, etc.

The provision and processing of this data, which occurs only with the express consent of the Customer, is optional and does not impact the service provided by Alicost SpA to the passenger.

Processing based on the data subject’s consent

To process certain data, Alicost SpA requires the explicit consent of the interested party:

  • Processing of special data (data relating to the passenger’s health, etc.)

The processing of data relating to the passenger’s health (or any other sensitive data pursuant to Article 9 of the GDPR) is carried out only with the data subject’s consent and exclusively for the fulfillment of contractual obligations and in compliance with applicable laws and regulations.

  • Processing of personal data for promotional and commercial purposes, marketing, market research, etc.

The Customer will always have the right to express his/her consent with reference to processing for marketing and commercial information purposes, market research, and service offers, without failure to provide such consent or its revocation affecting the provision of the service covered by the contract.

In each of these cases, the Data Controller provides the interested party with tools that allow them to withdraw their consent as easily as they gave it.

The methods for withdrawing consent are explained in the same way as the interested party gives their consent to the processing of their data.

In relation to the indicated commercial and marketing purposes, data processing is carried out primarily automatically and will be carried out in a manner that guarantees the security and confidentiality of the interested party.

Dissemination and communication of the interested party’s data

Alicost SpA does not disclose or share passengers’ personal data with third parties, except when necessary to comply with legal obligations, administrative requirements, or orders from public authorities.

The personal data collected from Customers may be accessed by Alicost SpA’s operational and commercial staff, as well as the external Data Processors mentioned above, in carrying out their assigned tasks.

Retention of personal data

  • Data acquired for the provision of the service:

This data will be processed for the entire duration of the contract stipulated with the Customer/Passenger.

This data will also be archived, in paper or electronic format, in compliance with applicable regulations regarding document retention (e.g., for tax and accounting purposes) and/or to protect the parties’ rights in the event of legal disputes. Electronic/digital data is stored on systems located within the European Union.

  • Data acquired for marketing and commercial purposes:

Data provided for direct marketing purposes (e.g., newsletters) will be processed for 24 months, or until the interested party withdraws their consent.

Furthermore, data processed for profiling purposes will be retained for 12 months, or until the interested party withdraws their consent.

Transfer of personal data abroad

Alicost SpA does not transfer passenger data outside the European Union.

Rights of the interested party

Pursuant to Articles 15 to 20 of the GDPR and the corresponding articles of the Privacy Code, data subjects have the right to obtain, at any time:

  • confirmation of whether or not personal data concerning them is being processed and access to their data, including information regarding:
    • the purpose of the processing;
    • the categories of personal data being processed;
    • the recipients to whom the data are or will be communicated;
    • the possible transfer of data outside the European Union and the existence of the related guarantees;
    • the data retention period or the criteria used to determine it;
    • the right to rectification and erasure of data, to limitation and to object to processing;
    • the right to lodge a complaint with the supervisory authority;
    • the origin of the data, if the data;
    • the existence of an automated decision-making process.
  • a copy of the personal data undergoing processing, where this does not infringe the rights and freedoms of others;
  • the rectification of inaccurate personal data;
  • the deletion of personal data concerning them;
  • the revocation of the consent provided;
  • the limitation of the processing of your personal data;
  • personal data provided in a structured, commonly used and machine-readable format, including for the purpose of transmission to another data controller.

Furthermore, pursuant to Articles 21 and 22 of the GDPR and the corresponding articles of the Privacy Code, interested parties have the right to:

  • object at any time, for legitimate reasons relating to their situation, to the processing of data concerning them and necessary for the performance of tasks carried out in the public interest or for the pursuit of the legitimate interest of the data controller;
  • not be subject to a decision based solely on automated processing which may have legal effects concerning you or significantly affect you.

To exercise their rights or to obtain information regarding the processing of their data, interested parties can contact Alicost SpA using one of the following methods:

  • via postal service to the following address: Alicost SpA Via Sopramuro, 2 84011 Amalfi (SA)
  • via email: dpo@alicost.com

Right to lodge a complaint with the Supervisory Authority

Pursuant to Article 77 of the GDPR and the corresponding articles of the Privacy Code, the data subject has the right to lodge a complaint with the Supervisory Authority if he or she believes that the processing of his or her personal data violates any of the provisions of the GDPR or the Privacy Code.

Payment data for tickets purchased online at www.alilauro.it cannot be acquired or processed in any way by Alicost SpA, as the transaction is managed by Banca Sella’s servers.

Rev. 1 of 24.02.2025