PLAY&GO 

Information regarding the processing of personal data

Pursuant to Article 13 of the EU Regulation No. 2016/679 (GDPR), and in general in compliance with the principle of transparency set forth in that Regulation, below we provide information regarding the processing of personal data in the context of the Play&Go application (hereinafter “App”).

The App allows tracking of trips made in integrated, multimodal mobility (e.g., bus, train, bicycle, walking, carpooling, and combinations these).

It is worth pointing out that the App can be used also in the context of sustainable mobility campaigns to award points and prizes based on the trips correctly tracked by participants. In order to allow the implementation of these campaigns, it is necessary to collect and process the information related to the tracking of trips made via the App.

This information must therefore be considered supplementary to that which will be made available upon joining the various sustainable mobility campaigns proposed over time through the Play&Go App.

1. PURPOSE OF PROCESSING

The processing of personal data takes place within the App and will have the following purposes:

• register users and allow the use of the App;
• ensure the proper functioning of the App;
• enable the performance, documentation and improvement of the App’s activities;
• track and validate trips through the App;
• provide for scientific, historical and statistical research purposes.

2. OBLIGATION TO PROVIDE DATA

The legal basis for processing is the explicit consent upon first use of the App.

All purposes of processing are related to the use of the App. Although there is no obligation to provide the data, failure to do so will result in the impossibility of proceeding with access to the App and thus using it. With reference to geolocation, it should be noted that failure to consent to tracking could jeopardize the validation of trips.

3. TYPE OF DATA PROCESSED

The following categories of data may be processed for the requirement of the App: 

• master data and contact data;
• geolocation data (data on the user’s position detected in real time, based on the GPS present on the mobile device on which the App is installed, during the tracking of a trip); 
• behavior data (mode of travel, number of kilometers covered).

The user’s public profile data (Google, Facebook, Apple, Smart Community) may be used to personalize the App.

The user’s e-mail address is also used as a means to uniquely identify the user within the Smart Community systems.

4. METHODS OF DATA PROCESSING

The processing will be carried out:

• by means of the App and the use of manual and automated systems;
• by individuals authorized and trained to perform such tasks, in accordance with the law; 
• with the use of appropriate measures to ensure the confidentiality of data and prevent access to them by unauthorized third parties;
• in contexts that do not undermine the personal dignity and decorum of the data subject, ensuring due care to guarantee confidentiality in their use.

You can consult all the technical and organizational measures adopted by FBK to ensure proportionality and necessity of the processing and prevent illegitimate access, unwanted modification, disappearance and explicit violations of personal data at the following link bit.ly/MisureFBK.

No automated decision making process is involved nor any profiling activity.

5. DURATION OF DATA PROCESSING

The data will be retained until receipt of the user’s request for deletion and in any case for a period not exceeding the one necessary to fulfill the obligations or tasks referred to in point 1, and in any case to pursue the specific purposes indicated therein, with gradual deletion of data attributable to the specific purposes gradually no longer being pursued.

In some cases, data might be retained even after the account is closed, such as in backups or in the Disaster Recovery system or, in aggregated and anonymized form, if they were used for scientific research purposes.

The data will be retained until the user requests its deletion and, in any case, for a period not exceeding  the one necessary to fulfill the obligations or tasks referred to in point 1, and in any case to pursue the specific purposes indicated therein. The deletion of the data will occur gradually, based on the exhaustion of the individual purposes for which they were collected.

In some cases, the data may also be retained after the account is closed, for example in backups or in the Disaster Recovery system or, in aggregate and anonymous form, for scientific research purposes.

6. DISCLOSURE OF DATA

The data collected and processed may be disclosed exclusively for the above specified purposes and in aggregate form, to Public Administrations (for example as promoters of sustainable mobility initiatives).

Personal data are not subject to dissemination.

For the exclusive purposes of scientific dissemination of statistical and/or scientific results (e.g., through publication of scientific articles, participation in conferences, etc.), data may be disseminated in anonymous and aggregate form and always in a manner that does not make the Data Subject identifiable.

7. PLACE OF DATA PROCESSING

The activity of processing personal data takes place on the territory of the European Union, or with the help of IT tools involving processing in countries for which the European Commission has taken a decision on the adequacy of the protection of personal data or, failing that, through the signing with the provider of Standard Contractual Clauses (SCC) of data protection adopted by the European Commission.

8. RIGHTS OF THE DATA SUBJECT

The Data Subject has the right to ask the Data Controller at any time to exercise the rights set forth in Articles 15 et seq. of the GDPR and, in particular to :

• request confirmation of the existence or non-existence of his/her personal data and request access to it;
• obtain information about the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be communicated and, when possible, the storage period;
• obtain rectification and deletion of data;
• obtain the restriction of processing; 
• object to the processing at any time.

He or she also has the right to revoke the consent at any time without affecting the lawfulness of processing based on consent given before revocation. 

To exercise the above rights you can write to: privacy@fbk.eu. 

This is without prejudice to the right to send a complaint to the Data Protection Authority.

9. DATA CONTROLLER

The data controller for the processing of personal data is the Bruno Kessler Foundation, based in Trento, Italy, via Santa Croce, 77 – +39.0461.314.621-227 – segr.presidenza@fbk.eu

10. CONTACT DETAILS OF THE DATA PROTECTION OFFICER 

The Data Controller has designated a Data Protection Officer (DPO) pursuant to Article 37 of the GDPR, who can be contacted through the following channels: +39.0461.314.370 – privacy@fbk.eu.

11. CHANGES TO THIS INFORMATION

The Data Controller reserves the right to make, if necessary, appropriate changes to this Privacy Policy – currently updated to May 16, 2025 – giving the widest visibility to the Interested Parties.