PRIVACY INFORMATION NOTICE
pursuant to Articles 13 and 14 of the Regulation (EU) 2016/679
Bag Express Srl (BagExpress), based in Corso Salvatore D’Amato, 108 80022 Arzano (NA), offers a service to MSC Cruises’ guests that consists of the collection of luggage, shipment of luggage to the port of embarkation, and, at the end of the cruise, collecting it back for home delivery.
This service is provided in collaboration with MSC Cruises S.A. (MSC Cruises), headquartered in Avenue Eugène-Pittard 40, Geneva, Switzerland, which provides the cruise details required by BagExpress to provide this service to cruise guests. Since this service requires the processing of information, including some personal information, about the users of the service, the personal data processing is carried out in accordance with the principles of the Regulation (EU) 2016/679 (the General Data Protection Regulation, hereafter “GDPR”).
MSC Cruises and BagExpress act as joint controllers for the processing of the personal data regarding the bag collection and delivery service, which is provided to you upon request.
For marketing activities, each entity acts as independent data controller and is responsible for the compliance with the relevant applicable privacy laws and regulations, including the collection and withdrawal of consent.
Categories of personal data processed
To provide the service to MSC Cruises’ guests, BagExpress requires the information below that is sent from MSC Cruises to BagExpress in order to provide the service:
- Last name
- First name
- Cabin number
- Ship code
- Ship name
- Embarkation date. Format: MMDDYYYY
- Embarkation time. Format: hhmm
- Embarkation port code
- Embarkation port name
- Disembarkation date. Format: MMDDYYYY
- Disembarkation time. Format: hhmm
- Disembarkation port code
Once this data is provided, BagExpress follows its internal process to finalize the order and operationalize the service.
Purpose and legal basis of Data Processing
MSC Cruises shares your personal data mentioned above with BagExpress since it is necessary for the luggage to be transported to you and enable a convenient and comfortable customer experience. The processing is necessary for the performance of the contract to which the guest is a party.
All other data processing activities, including marketing activities, are provided by the entities separately, as independent data controllers.
Do I have to give you my data?
In the context of the service (contractual relationship), you must provide the personal data that is necessary for the performance and fulfilment of the contract. Failure to provide the data would result in the impossibility to provide the service.
In the context of marketing activities, you can choose whether you want to receive marketing communications from MSC Cruises, BagExpress or both. This choice will not impact your ability to book and use the bag collection and delivery service.
MSC Cruises and BagExpress are each responsible for ensuring compliance with data retention and data minimisation in accordance with Article 5.1(e) GDPR.
Data subject rights
In accordance with articles 15-22 of the GDPR, the data subject has, at any time, the right to:
- Obtain access to his/her personal data;
- Request the rectification or deletion of personal data or the restriction of data processing;
- Oppose the treatment of personal data;
- Receive his/her personal data in a structured format of common use and readable by an automatic device;
- File a complaint with the relevant data protection authority (taking into account the place of residence of the data subject or the place of supplying of the services), in accordance with article 77 of GDPR, if he/she believes that the processing of personal data is in violation of the GDPR.
Notwithstanding the right of the data subject to oppose the processing of some or all of his/her personal data, the Data Controllers reserve the right to evaluate the request, which will not be accepted in case the legitimate reasons of the Data Controllers prevail over the rights and interests of the data subject.
You may exercise your rights provided by the GDPR in respect of and against each of the legal entities, as follows:
- To exercise your rights regarding the data processed by MSC Cruises, please use the webform available here: https://www.msccruises.com/dsrautomation/home/index/en-gb
- To exercise your rights regarding the data processed by BagExpress, please send a written request to Bag Express Srl Corso Salvatore D’Amato, 108 80022 Arzano (NA).
Data Protection Officer, contact details and further information…
MSC Cruises has appointed a Data Protection Officer (DPO), which can be reached at firstname.lastname@example.org. If you have any questions about this Privacy Notice and how we treat your data, please contact the Data Protection Officer at email@example.com or send a letter to MSC Cruises S.A., Avenue Eugène Pittard 40, 1206 Geneva (Switzerland)