PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA
Users and Customers of the Sostravel web platform
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree No. 196 of 30 June 2003, as amended by Legislative Decree No. 101 of 10 August 2018 (“Privacy Code”)
Sostravel.com S.p.A. wishes to inform you, clearly and transparently, about how it processes the personal data of those who browse the website www.sostravel.com and its other online platforms (the “Web Platform”), register an Account, purchase or activate the Services, including through the Online Stores and the Points of Sale, or contact Customer Care. Capitalized terms have the meaning given to them in the General Terms and Conditions of the Services published on the Site.
1. Data Controller and Data Protection Officer
Data Controller is Sostravel.com S.p.A. (Tax Code and VAT No. 03624170126), with registered office at Viale Europa 98, 00144 Rome; certified e-mail (PEC): sostravel@pec.net; e-mail: privacy@sostravel.com.
The Data Controller has appointed a Data Protection Officer (DPO), Dr. Vincenzo Pacelli, who can be contacted at dpo@sostravel.com or by post at the Data Controller’s registered office.
2. What personal data we process
Depending on the Services and features used, we may process the following categories of data:
- Registration and Account data: first name, last name, date of birth, e-mail address, username and password (stored in encrypted form), and, where provided, telephone number and address.
- Purchase and payment data: Services purchased, activation codes (LLC code, QR code), purchase channel, receipts. Payment card data is processed directly by the payment service provider; Sostravel does not store the full card number.
- Travel and Baggage data (Lost Luggage Concierge Service): flight and itinerary, Baggage Tag, P.I.R., Delivery Location, information on the movements of the Baggage obtained through the SITA WorldTracer portal and from airport handlers, documentation relating to the Carrier Compensation.
- Data for the payment of the service guarantee amount: identity document, flight ticket, bank details (IBAN), signed Service Guarantee Form and Receipt Form.
- Data from communications with Customer Care: telephone number, content of telephone conversations, e-mails, SMS and WhatsApp messages, call recordings (see section 4).
- Data relating to the Dr. Travel Service: Sostravel processes only the data necessary for the sale and activation of the Service (name, Duration period, travel dates, language). Health data is processed solely by Net Medicare S.r.l. (see section 3.3).
- Data from the digital Travel Journal: flights and itineraries that the User chooses to record.
- Data for the Travel Booking Service: travelers’ data and, where required by the tourist service provider or by the legislation of the destination country, details of travel documents.
- Browsing data: IP address, browser and device type, access and usage logs of the Web Platform, data collected through cookies and similar tools, as described in the Cookie Policy.
Third-party data provided by the User. If the User provides data of other persons (for example travel companions or beneficiaries of a Service), the User declares that they have informed those persons and are entitled to provide such data; those persons may exercise the rights set out in section 9 (Art. 14 GDPR).
Minors. Registration is reserved for persons over the age of 18. Registration of a minor requires the prior authorization of the person exercising parental responsibility.
Special categories of data. Sostravel does not request data concerning health or other special categories of data (Art. 9 GDPR). You are asked not to provide such data to Customer Care: if this occurs, the data will be used solely to direct the request to the competent party and will not be retained for longer than strictly necessary.
3. For what purposes and on what legal basis
3.1 Purposes that are necessary and based on legal obligations or legitimate interests
| Purpose | Legal basis | Provision of data |
|---|---|---|
| Registration and management of the Account | Performance of a contract (Art. 6(1)(b) GDPR) | Necessary: without the data, the Account cannot be created |
| Sale, activation and provision of the Services (Lost Luggage Concierge, Dr. Travel, Travel Booking, free services) | Performance of a contract (Art. 6(1)(b)) | Necessary to provide the requested Service |
| Tracing of the Baggage and Active Tracking, including through SITA WorldTracer and airport handlers | Performance of a contract (Art. 6(1)(b)) | Necessary |
| Management of the Procedure and payment of the service guarantee amount | Performance of a contract (Art. 6(1)(b)) | Necessary: without the required documents, the claim cannot be settled |
| Checks on anomalies and prevention of fraud or abuse (e.g. duplicate purchases, limit on the number of events in a three-year period) | Data Controller’s legitimate interest in preventing fraud (Art. 6(1)(f)) | Necessary |
| Assistance through Customer Care, handling of requests and complaints, recording of calls | Performance of a contract (Art. 6(1)(b)); legitimate interest in documenting requests and ensuring the quality of the service (Art. 6(1)(f)) | Necessary to receive assistance |
| Legal compliance (accounting, tax, Consumer Code, tourism legislation), requests from authorities | Legal obligation (Art. 6(1)(c)) | Mandatory |
| Security of the Web Platform and prevention of unauthorized access | Legitimate interest (Art. 6(1)(f)) | Necessary |
| Establishment, exercise or defense of a legal claim in court or out of court | Legitimate interest (Art. 6(1)(f)) | Necessary |
| Sending to the Customer’s e-mail address communications about services similar to those purchased (“soft spam”) | Art. 130(4) of the Privacy Code; legitimate interest (Art. 6(1)(f)) | The Customer may object at any time, including by using the link included in every message |
3.2 Purposes based on consent (optional)
| Purpose | Legal basis | Provision of data |
|---|---|---|
| Sending promotional communications and newsletters about Sostravel products and services by e-mail, SMS, WhatsApp, telephone with an operator or notifications | Consent (Art. 6(1)(a) GDPR; Art. 130 of the Privacy Code) | Optional: failure to consent does not affect the Services |
| Profiling: analysis of preferences and use of the Web Platform in order to send personalized communications | Consent (Art. 6(1)(a)) | Optional: failure to consent does not limit access to the Web Platform or to the Services |
| Non-technical cookies and tracking tools | Consent (Art. 122 of the Privacy Code) | Optional, manageable through the banner and the Cookie Policy |
Consent may be withdrawn at any time, without affecting the lawfulness of the processing carried out before its withdrawal (Art. 7(3) GDPR).
3.3 Dr. Travel Service and partner services
The Dr. Travel Service is provided by Net Medicare S.r.l., which acts as independent controller of the processing of Patients’ data, including health data collected on its own platform and during Televisits. Sostravel, as reseller, communicates to Net Medicare only the data necessary to activate the Service purchased (Art. 6(1)(b) GDPR) and has no access to medical records. Net Medicare’s privacy notice is available on the partner’s website.
When the User chooses to use the services of third-party partners accessible from the Web Platform (for example, flight compensation claims through AirHelp or insurance coverage at preferential rates), the data is collected directly by the partner, which processes it as an independent controller in accordance with its own privacy notice. Sostravel communicates to the partner only the data that may be necessary to recognize the agreement requested by the User.
4. Customer Care
Customer Care is managed exclusively by operators of Sostravel or of Contact Center companies acting on its behalf as processors (Art. 28 GDPR). It can be reached by telephone, e-mail and WhatsApp at the contact details indicated in the General Terms and Conditions.
- Data processed. Telephone number, content of the request and of the correspondence, case data and, for telephone calls, the related recording.
- Call recording. At the beginning of the call, the User is informed that the conversation may be recorded. The recording serves to document the reports received, in particular the notification of the Baggage Non-Delivery from which the terms of the Service begin to run, and to verify the quality of the service (legitimate interest, Art. 6(1)(f) GDPR). The User may object and use e-mail instead.
- No automated decision-making. Requests and claims, including the recognition of the service guarantee amount, are reviewed by Sostravel staff. No decisions are made based solely on automated processing within the meaning of Art. 22 GDPR.
5. How we process data
Data is processed mainly by electronic means and, to a limited extent, on paper, by authorized and trained personnel (Art. 29 GDPR and Art. 2-quaterdecies of the Privacy Code). Sostravel adopts technical and organizational measures appropriate to the risk (Art. 32 GDPR), including access control, encryption of passwords and communications, backups and periodic verification of the measures. Sostravel will never ask the User to disclose their password.
6. How long we retain data
| Category of data | Retention period |
|---|---|
| Account data | For the duration of the Account. In the event of inactivity for 24 months, the Account is closed, subject to prior notice by e-mail, and the data is deleted, except for data that must be retained for the other purposes indicated in the table |
| Contractual, accounting and tax data (purchases, payments, invoices) | 10 years (Art. 2220 of the Italian Civil Code and tax legislation) |
| Lost Luggage Concierge claims and service guarantee amount, including documents and IBAN | 10 years from the closure of the claim, ordinary limitation period (Art. 2946 of the Italian Civil Code) |
| Recordings of calls to Customer Care | 6 months from the call, unless there are ongoing disputes |
| E-mails, SMS and WhatsApp messages with Customer Care | For the duration of the case and thereafter in accordance with the terms applicable to the case to which they relate |
| Data from the digital Travel Journal | Until deletion by the User or closure of the Account |
| Data for promotional purposes | 24 months from consent or from the last interaction, unless withdrawn earlier |
| Data for profiling purposes | 12 months from collection, unless withdrawn earlier |
| Cookies and tracking tools | As indicated in the Cookie Policy |
Once these periods have elapsed, the data is deleted or anonymized, unless retention is necessary to defend a legal claim or to comply with requests from authorities.
7. To whom we disclose data
Data is not disseminated. It may be disclosed, to the extent necessary for the purposes indicated, to:
- processors (Art. 28 GDPR) acting on behalf of Sostravel: hosting, cloud and IT service providers, operators of the Web Platform, Contact Center companies, providers of e-mail, SMS and messaging services, consultants;
- independent controllers: Net Medicare S.r.l. (Dr. Travel Service); airlines, airport handlers and SITA (WorldTracer) for the tracing of the Baggage; payment service providers and banks; providers of the tourist services booked through the Travel Booking Service; partners chosen by the User (section 3.3); authorized resellers and Points of Sale, for purchases made through those channels; professionals (lawyers, accountants, auditors);
- public and judicial authorities, where provided for by law.
The updated list of processors may be requested using the contact details indicated in section 10.
8. Transfers of data outside the European Economic Area
Some data may be transferred outside the European Economic Area, in particular:
- to Contact Center service providers based in third countries, including Moldova;
- to technology providers (for example cloud, e-mail and messaging services), where established or operating outside the EEA;
- to airlines and handlers at the destination airport, when the Baggage is lost in a third country.
Transfers take place on the basis of an adequacy decision of the European Commission (Art. 45 GDPR), including, for certified U.S. companies, the EU-U.S. Data Privacy Framework; failing that, on the basis of the standard contractual clauses approved by Implementing Decision (EU) 2021/914 and of any supplementary measures identified following a transfer impact assessment (Art. 46 GDPR). Transfers to airlines and handlers that are necessary to trace and redeliver the Baggage are based on the necessity of performing the contract concluded with the Customer (Art. 49(1)(b) GDPR). A copy of the safeguards adopted may be requested using the contact details indicated in section 10.
9. Data subject rights
The data subject may exercise at any time, free of charge, the rights provided for in Articles 15-22 GDPR:
- access to their data and to information on the processing (Art. 15);
- rectification of inaccurate data and completion of incomplete data (Art. 16);
- erasure of data, in the cases provided for (Art. 17);
- restriction of processing (Art. 18);
- portability: to receive the data provided in a structured, commonly used and machine-readable format, or to have it transmitted to another controller (Art. 20);
- objection to processing based on legitimate interest, on grounds relating to their particular situation, and in any case to processing for direct marketing purposes, including related profiling (Art. 21);
- not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect them (Art. 22);
- withdraw consent at any time (Art. 7(3)).
Sostravel responds without undue delay and in any case within one month of receipt of the request; this period may be extended by two months in the case of complex or numerous requests, in which case a reasoned notice will be given within the first month (Art. 12(3) GDPR). For medical records relating to the Dr. Travel Service, requests must be addressed to Net Medicare; Sostravel Customer Care may in any case forward them.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it), or with the supervisory authority of the Member State where they reside or work (Art. 77 GDPR), and to seek a judicial remedy (Art. 79 GDPR).
10. How to exercise your rights
Requests may be sent to:
- Sostravel.com S.p.A., Viale Europa 98, 00144 Rome; e-mail privacy@sostravel.com; PEC sostravel@pec.net;
- Data Protection Officer: dpo@sostravel.com.
It may be necessary to verify the identity of the requester. The data subject may be represented by a delegate holding a written proxy and a copy of their own identity document.
11. Cookies and third-party links
For information on the cookies and other tracking tools used on the Web Platform and on the management of the related preferences, please refer to the Cookie Policy. The Web Platform may contain links to third-party websites (for example Net Medicare, AirHelp, insurance partners), to which their respective privacy notices apply.
12. Updates to this notice
This notice was updated in November 2026 and replaces the version of 31 July 2023. It may be amended in connection with the evolution of the Services, of the tools used to provide them and of the applicable legislation. In the event of significant changes, notice will be given on the Web Platform and, where appropriate, by e-mail to registered Users.