EXTENDED INFORMATION ON THE PROCESSING OF PERSONAL DATA
VIA VIDEO SURVEILLANCE SYSTEM AND ACCESS CONTROLLER (CCTV)
pursuant to art. 13 and 14 of European Regulation no. 2016/679 (GDPR)
Tiburtina Bus Srl, as Data Controller, issues this extended information notice to transparently illustrate the methods, purposes, and retention periods of personal data processed through the integrated video surveillance and vehicle access control system installed at the bus station terminal.
1. DATA CONTROLLER
The Data Controller is Tiburtina Bus Srl, with registered office in Rome, Largo G. Mazzoni snc, Tax Code and VAT number: 04944131004, email: info@tibusroma.it.
2. DATA PROTECTION OFFICER (DPO/RPD)
The Data Protection Officer is Dr. Fulvio Pirone, who can be contacted directly for privacy issues or to exercise your rights at the dedicated email address: dpo@tibusroma.it.
3. TYPE OF DATA PROCESSED AND CATEGORIES OF INTERESTED PARTIES
The system acquires data relating to the following categories of data subjects who transit, stop, or operate in the external and movement areas of the Terminal:
Data subjects: Passengers, drivers, and on-board staff of partner bus companies, company employees, contractor staff, suppliers, visitors, and third parties.
Data processed: Video images (recordings and real-time streams) and car/vehicle license plates detected at access points.
Minimization note: The system processes only common data. The intentional collection of sensitive data (Article 9 GDPR) or the profiling of individuals is strictly excluded. Any sensitive details (e.g., motor disabilities visible in the footage) are intercepted entirely accidentally and are not stored or processed for specific purposes.
4. PURPOSE OF THE PROCESSING AND LEGAL BASIS Data processing pursues three distinct macro-purposes, each anchored to a specific legal basis:
A) Subsidiary security and asset protection: Prevention and repression of vandalism, theft, assaults, damage to structures, and acts of terrorism within the logistics hub.
Legal basis: The legitimate interest of the Data Controller (Art. 6, par. 1, letter f, GDPR), supported by the positive outcome of the formal Data Protection Impact Assessment (DPIA No. 1) and by Art. 9.2.f for the protection of rights in court.
B) Management of traffic and logistics of the bus station: Planning, dynamic assignment of bus platforms/parking spaces and monitoring of compliance with the internal bus station regulations.
Legal basis: The execution of contractual and pre-contractual measures agreed with partner carriers (Art. 6, par. 1, letter b, GDPR).
C) Emergency management and first aid: Timely activation of public rescue services and operational intervention in the event of accidents, illnesses, or incidents in the traffic area.
Legal basis: The protection of the vital interests of natural persons (Art. 6, par. 1, letter d, and Art. 9, par. 2, letter c, GDPR).
5. PROCESSING METHODS AND SECURITY MEASURES (PRIVACY BY DESIGN)
The processing is based on the principles of correctness, lawfulness and strict minimization:
Control Room Isolation: Control Room personnel have "Live Only " access profiles . They can only view real-time images for traffic and immediate security reasons, with no logical option for historical searches (playback) or downloads.
High playback privileges: Access to the recording history and the extraction of intermediate videos are reserved exclusively for the formally designated Internal Privacy Representative, via protected Master credentials.
Physical and IT measures: The central hardware (NVR/DVR) is housed in a locked, armored rack cabinet in a secure technical room. The video surveillance network is completely isolated on a dedicated VLAN and protected by perimeter firewalls managed by the external IT maintenance and automation company, formally designated as the Data Controller pursuant to Art. 28 of the GDPR.
Employment Relations (Workers’ Statute): The system is installed in full compliance with Article 4 of Law No. 300/1970 and subsequent amendments. The cameras focus solely on external areas, transit areas, and access points for the exclusive purposes of security, asset protection, and logistics management described in this policy. The use of systems for remote monitoring of personnel work activities is strictly prohibited.
6. CATEGORIES OF DATA RECIPIENTS
Personal data will not be disclosed to the public. Images and transit information may only be shared with:
External Data Processors (Art. 28 GDPR): IT companies that maintain automation and access control software and companies entrusted with subsidiary surveillance and live monitoring services for the operations room.
Independent Owners: Judicial Authorities and Law Enforcement Agencies (State Police, Carabinieri, Guardia di Finanza) following a formal investigative request; Insurance Companies for the sole settlement and management of claims occurring at the Terminal.
7. DATA RETENTION PERIOD
Regular image retention: Given the strategic nature of public transport infrastructure and passenger flows, CCTV images are retained for a maximum of 7 days, after which the system automatically and irreversibly overwrites the footage.
Extraordinary export for private individuals (Blocking Request): In the event of a formal request to exercise rights or a temporary blocking request submitted by private individuals (e.g., following a theft or accident), the relevant frames are isolated before being overwritten and stored in a separate encrypted archive for up to 45 days. After this period has elapsed without a formal seizure order or request for acquisition by law enforcement, the extracted images are permanently destroyed.
Logistics transit data (license plates/timetables): They are stored in the management software for a period of 10 years from the termination of the contractual relationship with the carrier for accounting and legal protection purposes, after which the personal data are completely anonymized for purely statistical purposes.
8. RIGHTS OF THE INTERESTED PARTIES
At any time, the subjects filmed can exercise the rights provided for in Articles 15, 16, 18 and 21 of the GDPR:
The right to request access to images relating to them from the Data Controller (access is permitted only if the image is still present in the systems and upon precise indication of the day, time and physical features/clothing to allow for certain identification).
Right to request restriction of processing.
Right to object to processing for legitimate reasons.
Requests can be sent directly to the DPO’s email address: dpo@tibusroma.it. Data subjects also have the right to lodge a formal complaint with the Italian Data Protection Authority pursuant to Article 77 of the GDPR (more information at www.garanteprivacy.it).