Who is responsible

Tommaso De Rosa, an individual, publishes this website and is responsible for the personal information it handles.

Name: Tommaso De Rosa
Address: Viale Certosa 152, 20151 Milano (MI), Italy
Email: [email protected]

Person in charge of the protection of personal information: Tommaso De Rosa, [email protected]

This policy follows the principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and of Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25. Because the publisher is established in the European Union, the General Data Protection Regulation (GDPR) also applies.

What we collect and why

When you visit the site

Each time your browser loads a page, our servers and our network provider receive technical information: your IP address, the date and time, the address of the page requested (including what you typed in a search), the page you came from and a description of your browser and device. We use this information to deliver the pages, keep the site secure and fix problems, never to build a profile of you. Our servers record it in their logs.

Your location, only on request

The site uses your location only when you ask for stations near you, and your browser asks for your permission first. Your coordinates are then sent to our servers to find the nearest stations. We do not save them, apart from the server logs described above. Your browser reuses the saved coordinates for up to one hour, so it does not have to ask again. They remain on your device until a new location replaces them or you clear the site data.

Train alerts, if you turn them on

If you turn on notifications for a train, your browser gives us a subscription: an address at its push service and encryption keys. We store it with the language of the site, the train, the travel date and the delay that should trigger an alert, and use this information only to send you those alerts.

Visits from AI assistants

When you arrive by following a link in an AI assistant such as ChatGPT, Perplexity, Gemini or Claude, we record the assistant's name, the page you opened, a description of your browser and the time, without your IP address. We use these records to count visits from these services.

When you write to us

If you email us, we use your address and your message only to reply and to follow up on your request.

On your device

Your browser stores your language, theme, favourite trains and stations, recent searches, notification settings and a visit counter that decides when to suggest notifications. It also keeps recently loaded train information, map images and site files in its cache, so pages load faster. All of this stays on your device, not on our servers.

Audience measurement, only if you accept

If you accept it in the cookie banner, the site uses Google Analytics 4 to count visits and to see which pages and links are used, including clicks on links to book tickets. Google Analytics then receives the pages you view, the page you came from, your clicks on the site, an approximate location derived from your IP address, a description of your browser and device, and a random identifier stored in a cookie. We use it only to measure the audience and improve the site, never to show you ads: Google signals and ad personalization are turned off. If you do not accept, Google Analytics is not loaded and receives nothing.

Your cookie choice

When you accept or reject Google Analytics, your browser keeps your choice in a cookie, and our server records a random identifier, the choice, the time and a description of your browser. It does not record your IP address. This record shows which choice you made.

Read the cookie policy

What we do not do

Apart from the Omio links described below, the site shows no advertising, and it uses no outside error-reporting service. Google Analytics is its only audience-measurement tool, and it runs only if you accept it. We do not sell or rent your personal information, we do not use it for marketing and we make no automated decisions about you.

Links to Omio (affiliate links)

Some pages have links, marked “Ad”, to compare and book tickets on Omio. They are affiliate links: if you buy a ticket after clicking one, Omio pays us a commission, at no extra cost to you. The link takes you to Omio through Impact, the affiliate platform Omio uses. Impact records the click, and Impact and Omio may set cookies on their own sites to credit the purchase. We send them no personal information about you: the link only says that it comes from our site, which link on the page you clicked and which version of the link was shown. Once you leave our site, Omio's and Impact's privacy policies apply.

Who else receives information

We share information only with the providers below, which need it to run the site, or when the law requires it.

Cloudflare, Inc. (United States) delivers the site and protects it against attacks. It receives the connection information described above and is certified under the EU-U.S. Data Privacy Framework. Its privacy policy
CARTO (CartoDB Inc.) (United States) supplies the background map. When a page shows a map, your browser downloads the map images directly from this provider, which therefore receives your IP address and a description of your browser. It is certified under the EU-U.S. Data Privacy Framework. Its privacy policy
Google LLC (United States) provides Google Analytics, only if you accept it. It receives the measurement data described above and is certified under the EU-U.S. Data Privacy Framework. Its privacy policy
If you turn on alerts, the push service of the company that makes your browser (for example Google, Mozilla, Apple or Microsoft) carries them to your device in encrypted form.
Links to other sites, such as VIA Rail's, lead to services that have their own privacy policies.

Where your information is processed

The site is run from the European Union. Your information may therefore be processed outside your province and outside Canada: in the European Union and, through the providers above, in the United States and other countries. The laws of those countries may differ from Canadian law, and their courts and authorities may be able to obtain the information.

If you accept Google Analytics, Google processes the measurement data in the United States and other countries outside Canada.

Why we are allowed to use it

In Canada, we rely on your consent: implied for the technical information any website needs in order to work, and express for Google Analytics, your location and train alerts.

Under the GDPR, we rely on our legitimate interest in running a secure, working website for connection information and visits from AI assistants, on your consent for Google Analytics, your location and alerts, and on the need to answer you for emails. We keep the record of your cookie choice to meet our legal duty to prove consent.

You do not have to give us any information to read the site. Without your consent, Google Analytics is not loaded, and only the stations near you and the train alerts are unavailable.

How long we keep it

Server logs: kept in files of limited size. When the limit is reached, the oldest entries are deleted automatically. Our network provider keeps its own logs under its privacy policy.
Your location: not saved on our servers except in the logs. Coordinates saved on your device are reused for up to one hour and remain stored until a new location replaces them or you clear the site data.
Train alerts: deleted 7 days after the travel date. The subscription is deleted as soon as you turn notifications off on the site, or when the push service reports that it is no longer valid.
Visits from AI assistants: kept for statistics, with no set deletion date. They contain no IP address and no identifier.
Emails: as long as needed to answer and follow up on your request.
On your device: the theme cookie lasts up to one year, the language cookie until you close the browser and an administrator's login cookie up to 24 hours. Other saved settings stay until you delete them.
Google Analytics: Google keeps the measurement data for the period set in our Google Analytics account, at most 14 months. The _ga cookies on your device last up to 2 years, unless you withdraw your consent, which deletes them.
Record of your cookie choice: deleted after 3 years. The cookie that remembers your choice on your device lasts 1 year.

How we protect it

Connections to the site are encrypted (HTTPS), and access to the servers and databases is restricted to the publisher.

Your rights and choices

You can ask us what personal information we hold about you and how we use it, and ask us to correct it, delete it, send you a copy in a common format or stop using it. Where we rely on your consent, you can withdraw it at any time; this does not affect what was done before.

To refuse Google Analytics, choose Reject in the cookie banner. To withdraw your consent later, use “Manage cookies” at the bottom of every page: Google Analytics stops and its cookies are deleted. Refusing changes nothing else on the site.

To make a request, write to [email protected]. We reply within 30 days. We may ask for details that help us find your information, such as the train and date of an alert.

On the site, you can remove favourites and recent searches. In your browser, you can clear this site's cookies and stored data and change its location and notification permissions.

Complaints

If you are not satisfied with our answer, you can contact a data protection authority:

Garante per la protezione dei dati personali (Italy), the lead authority, where the publisher is established
Office of the Privacy Commissioner of Canada
Commission d'accès à l'information du Québec, for residents of Quebec

You can also contact the data protection authority where you live.

Changes to this policy

If we change how we handle personal information, we will update this page and its effective date.

Privacy policy