Notice on the processing of personal data of users of the PitStop platform
pursuant to Article 13 of Regulation (EU) 2016/679 (the "GDPR")
This is an English translation provided for convenience. In case of discrepancy, the Italian version prevails.
Version 1.0 of 29 October 2026
1. Controller and data protection officer
The controller is Sokom S.r.l. ("Sokom"), with registered office at Via Camporcioni Est 18, int. 1-2-3, 51019 Ponte Buggianese (PT), VAT number 01798020473, certified email (PEC) sokom@pec.it.
Sokom has designated a data protection officer, who may be contacted at dpo@sokom.it.
2. Scope of this notice
The PitStop platform (pitstop.interporti.it, the "Platform") allows drivers (the "Users") to book parking services at the interports that use it. The processing of personal data is divided between two controllers:
- a) Sokom, as operator of the Platform, for the data relating to the User's account: registration, authentication, profile, vehicle list, billing data and security of the Platform. This notice refers to such processing;
- b) each interport, as seller of the parking service, for the data relating to bookings, payments, invoicing and access through the gates, including automatic number plate recognition. Such processing is described in the interport's privacy notice, available on the interport's page of the Platform. In respect of such processing, Sokom acts as processor on behalf of the interport, pursuant to Article 28 GDPR.
Section 11 concerns the interport staff who access the management panel and the contact persons of Sokom's customers.
3. Categories of personal data processed
| Category | Data | Source |
|---|---|---|
| Account data | First name, last name, email address, telephone number (optional), driver code, password (stored exclusively in hashed form), preference regarding email notifications | The User, at registration and when updating the profile |
| Two-factor authentication data | Selected method (code sent by email or authenticator application) and the related secret, stored in encrypted form | The User, during configuration |
| Vehicle list | Number plates and any descriptions of the vehicles used | The User, directly or when making a booking with a new number plate |
| Billing data | Type of invoice holder (natural person or entity holding a VAT number), first name and last name or company name, tax code (codice fiscale), VAT number, address, country, certified email (PEC), recipient code (codice destinatario) | The User, in the profile |
| Technical and security data | IP address, date and time of operations on the account and of login attempts, session tokens and the date of their last use | The User's device, during use of the Platform |
The Platform does not require special categories of personal data referred to in Article 9 GDPR or personal data relating to criminal convictions and offences. The User shall not enter such data, or unnecessary data of third parties, in free-text fields.
4. Purposes and legal bases of the processing
| Purpose | Legal basis | Categories of data |
|---|---|---|
| a) Registration and management of the account, two-factor authentication, recovery of credentials | Performance of a contract to which the User is party (Terms of Use of the Platform), Article 6(1)(b) GDPR | Account, authentication and technical data |
| b) Keeping the vehicle list and the billing data, for their use at each interport | Performance of a contract, Article 6(1)(b) GDPR | Vehicle list, billing data |
| c) Making available to the selected interport, at the time of booking, the data necessary for the parking service | Performance of a contract, at the User's request, Article 6(1)(b) GDPR | First name, last name, email, telephone, driver code, number plates indicated in the booking, billing data |
| d) Sending service communications relating to the account (verification codes, recovery links, security alerts) | Performance of a contract, Article 6(1)(b) GDPR | Email, first name |
| e) Security of the Platform: prevention of unauthorised access and fraud, limitation of attempts, reconstruction of events | Legitimate interest of the controller in the security of its systems, Article 6(1)(f) and Recital 49 GDPR | Technical and security data |
| f) Handling of support requests and of requests to exercise rights | Performance of a contract and compliance with legal obligations, Article 6(1)(b) and (c) GDPR | Contact data and content of the request |
The data are not processed for marketing or profiling purposes and are not disclosed to third parties.
5. Nature of the provision of data
The provision of first name, last name, email address and password is necessary for registration. Two-factor authentication is mandatory for all accounts and, without it, the Platform does not allow bookings to be made. The provision of billing data is necessary in order to book, as every parking service is invoiced. The telephone number is optional.
6. Automated individual decision-making
For the purposes described, Sokom does not take decisions based solely on automated processing within the meaning of Article 22 GDPR. The automatic assignment of the parking space and the decision to open the barrier are carried out on behalf of the interport and are described in its privacy notice.
7. Recipients of the data
The data may be disclosed:
- a) to Sokom personnel authorised to process them and bound by confidentiality, within the limits of their respective duties;
- b) to the interports at which the User makes a booking, limited to the data referred to in Section 4, letter c). The interports process such data as independent controllers for the management of the parking service, invoicing and access. Each interport accesses the User's data only where a booking has been made with it;
- c) to the competent authorities, in the cases provided for by law.
The Platform, including the email service, is hosted on infrastructure operated directly by Sokom in Italy. Sokom does not engage external providers that process account data on its behalf.
Payments are made on the page of the interport's payment service provider; Sokom does not collect payment instrument data.
8. Transfer of data to third countries
Account data are processed in Italy and are not transferred outside the European Economic Area.
To display the car park map, the User's browser downloads resources from a third party, which receives the IP address of the device, as with any web request, without any account data:
| Resource | Party | Location and safeguards |
|---|---|---|
| Map tiles of the car park map | OpenStreetMap Foundation | United Kingdom, a country covered by an adequacy decision of the European Commission |
This party does not set cookies on behalf of Sokom. Reference is made to the cookie policy.
9. Retention period
| Data | Period |
|---|---|
| Account data, vehicle list, billing data | For the duration of the account. Upon closure at the User's request, or automatically after 24 months without logins or bookings following 30 days' prior notice by email, the data are erased within 30 days |
| Session tokens | 30 days from creation, or until logout |
| Verification codes and recovery links | From 15 minutes to 1 hour, then erased |
| Log of operations and login attempts | 12 months |
| Server technical logs | 12 weeks, on a rolling basis |
| Backup copies | 30 days, on a rolling basis; erased data are also deleted from backups within that period |
| Support requests | 24 months from the closure of the request |
The closure of the account does not entail the erasure of data relating to bookings already made, including invoices, which remain retained by the interports in accordance with their respective privacy notices and legal obligations.
10. Rights of the data subject
The User may at any time exercise the rights under Articles 15 to 22 GDPR: access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interest. Part of the data can be modified directly in the profile; for other requests the User may write to dpo@sokom.it from the email address associated with the account. Sokom responds within one month of receipt of the request, which may be extended in the cases provided for by Article 12(3) GDPR.
Requests concerning data on bookings and access through the gates are to be addressed to the interport concerned; if received by Sokom, they are forwarded to the interport.
The User also has the right to lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority) (www.garanteprivacy.it) or with the supervisory authority of the Member State in which the User resides or works.
11. Interport staff and contact persons of customers
- a) Interport staff who access the management panel receive the privacy notice from their employer, which is the controller of the related access data and of the operations logged. Sokom processes such data as processor, with the same security measures.
- b) The data of the contact persons of Sokom's customers (signatories, administrative and operational contacts) are processed for the management of the contractual relationship and for compliance with tax obligations, pursuant to Article 6(1)(b) and (c) GDPR. They are retained for the term of the contract; accounting records are retained for 10 years pursuant to Article 2220 of the Italian Civil Code.
12. Changes
Material changes to this notice are communicated to Users by email or through the Platform before they take effect. The current version is always available on the Platform.