Privacy Policy
Privacy Notice
pursuant to Articles 13 and 14 of EU Regulation 2016/679 — GDPR
This notice describes how Autoservizi Locatelli / Airpullman A.T.I., with registered office at Via Furietti 17, 24126 Bergamo BG, P.IVA 03222320164, processes the personal data of users who browse and use the website www.orioshuttle.com.
This notice applies exclusively to the website indicated above and not to any other websites that the user may access via links on this site.
1. Data Controller
The Data Controller is:
Autoservizi Locatelli / Airpullman A.T.I.
Via Furietti 17
24126 Bergamo BG – Italia
P.IVA 03222320164
Telephone: +39 035 319366
Email: comunicazione@orioshuttle.com
2. Data Protection Officer — DPO
Members of the A.T.I. may each have appointed their own Data Protection Officer, in accordance with their respective corporate organisation and applicable obligations.
For information regarding the Data Protection Officer that may have been appointed by each company, the data subject may contact the Controller at the contact details set out in this notice or consult the privacy notices published on the institutional websites of the individual companies.
Any requests relating to the exercise of data subject rights may be sent to:
or to the various privacy contact details indicated by the individual companies belonging to the A.T.I.
3. Types of data processed
During browsing and use of the website, the following categories of personal data may be processed.
a) Browsing data
The computer systems and software procedures used to operate the website acquire, in the course of normal operation, certain data whose transmission is implicit in the use of Internet communication protocols.
This category includes, by way of example:
- IP address
- type of browser used
- operating system
- name of the internet service provider
- date and time of access
- pages visited
- referring and exit page
- other parameters relating to the user’s device and IT environment
Such data are used to ensure the proper functioning of the website, obtain anonymous or aggregated statistical information on use of the site, and guarantee the security of systems.
b) Data voluntarily provided by the user
The optional, explicit and voluntary submission of personal data via contact forms, information requests, bookings, newsletter subscriptions or other services entails the collection of the data provided by the user.
Such data may include, by way of example:
- first and last name
- email address
- telephone number
- data relating to the request submitted
- any data freely entered by the user in text fields
- data necessary for the management of bookings, purchases, payments or requested services
c) Cookies and other tracking tools
The website may use technical cookies and, subject to the user’s consent where required by applicable law, analytics cookies, marketing cookies, profiling cookies or other third-party tracking tools.
Technical cookies are necessary for the proper functioning of the website and do not require the user’s consent.
For analytics cookies not assimilated to technical cookies, for marketing cookies and for other non-essential tracking tools, processing is carried out only with the user’s prior consent, expressed via the dedicated banner or preference management panel.
The user may change or withdraw the preferences expressed at any time via the cookie management panel available on the website.
For further information on the cookies used, their respective purposes, retention periods and third parties involved, please refer to the specific Cookie Policy published on the website and managed by the appointed technical provider.
4. Purposes and legal bases of processing
Personal data will be processed for the following purposes:
| Purpose | Legal basis |
|---|---|
| To enable browsing and the proper functioning of the website | Legitimate interest of the Controller and technical necessity of the service |
| To ensure website security, prevent fraud, abuse or unauthorised access | Legitimate interest of the Controller |
| To respond to information requests submitted by the user | Performance of pre-contractual measures or response to the data subject’s request |
| To manage bookings, purchases, payments and requested services | Performance of a contract or pre-contractual measures |
| To comply with tax, accounting, administrative or legal obligations | Legal obligation |
| To send newsletters or promotional communications, where requested | Consent of the data subject |
| To carry out marketing, remarketing or online profiling activities via cookies or similar tools | Consent of the data subject |
| To establish, exercise or defend a right in court | Legitimate interest of the Controller |
Where consent is required, it is optional and may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.
5. Nature of data provision
Provision of browsing data is necessary to enable the website to function.
Provision of data requested in online forms is optional; however, failure to provide data marked as mandatory may prevent the Controller from responding to the request or providing the requested service.
Provision of consent for marketing, newsletter, profiling or non-technical cookie purposes is always optional.
6. Methods of processing
Personal data are processed using IT, electronic and, where necessary, paper-based means, with logic strictly related to the purposes stated.
The Controller adopts appropriate technical and organisational measures to ensure the security, confidentiality, integrity and availability of personal data.
Data will not be subject to automated decision-making processes, unless otherwise indicated to the user in a specific notice.
7. Disclosure of data to third parties
Personal data may be disclosed, to the extent strictly necessary for the purposes set out above, to the following categories of recipients:
- authorised personnel of the Controller
- providers of IT, hosting, maintenance and website security services
- payment service providers
- administrative, tax, legal and accounting consultants
- banks
- companies managing newsletter or email communication platforms
- providers of booking, sales or customer support services
- public, administrative or judicial authorities, where required by law
Such parties may act, as the case may be, as data processors, independent controllers or persons authorised to process data.
An up-to-date list of data processors may be requested by writing to:
8. Transfer of data outside the European Economic Area
Personal data will be processed predominantly within the European Economic Area.
Where, for technical or organisational reasons, it becomes necessary to transfer personal data to countries outside the European Economic Area, the transfer will take place in compliance with Articles 44 et seq. of the GDPR, on the basis of adequacy decisions, standard contractual clauses or other safeguards provided for by applicable law.
9. Data retention period
Personal data will be retained for the time strictly necessary to achieve the purposes for which they were collected and, thereafter, for any period required by law or to protect the Controller’s rights.
Indicatively:
| Category of data | Retention period |
|---|---|
| Browsing data and technical logs | For the time necessary for security and website operation, subject to further requirements for the investigation of unlawful conduct |
| Information requests | For the time necessary to handle the request and for any subsequent organisational or defensive requirements |
| Data relating to bookings, purchases, payments or services | For the period necessary to perform the service and for applicable tax, accounting and civil law obligations |
| Newsletter data | Until consent is withdrawn or deletion is requested |
| Data processed for marketing | Until consent is withdrawn or for the different period indicated in the specific notice |
| Cookies | As indicated in the Cookie Policy and in the preference management panel |
10. Rights of the data subject
The data subject may exercise, where provided by law, the following rights:
- right of access to personal data
- right to rectification
- right to erasure
- right to restriction of processing
- right to object
- right to data portability
- right to withdraw consent given
- right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali)
To exercise their rights, the data subject may contact the Controller at the following contact details:
Email: comunicazione@orioshuttle.com
Telephone: +39 035 319366
Address: Autoservizi Locatelli / Airpullman A.T.I., Via Furietti 17, 24126 Bergamo BG
The Controller will respond to requests within the time limits provided by applicable law.
11. Complaint to the Data Protection Authority
A data subject who considers that the processing of their personal data violates applicable law has the right to lodge a complaint with the:
Garante per la protezione dei dati personali
Piazza Venezia 11
00187 Roma
Website: www.garanteprivacy.it
12. Cookie Policy
The technical Cookie Policy, including the up-to-date list of cookies actually installed, their respective purposes, retention periods and third parties involved, is prepared and updated by the party responsible for the technical management of the website.
The user may consult the Cookie Policy published on the website and manage their preferences at any time via the dedicated consent management panel.
13. Changes to this notice
The Controller reserves the right to amend or update this notice at any time, including following regulatory, technical or organisational changes.
Users are invited to consult this page periodically to check for any updates.
Last updated: 19/05/2026