Last updated October 24, 2024

InterRail, LLC, a Massachusetts limited liability company through which Wandrian Ventures, Inc. operates in the sale of products and services, referred to in this Privacy Policy as “ItaliaPass”, “we,” “us,” or “our.” We are committed to respecting your privacy and protecting your personal information.  In support of our commitment, we developed this privacy policy (together with our Cookie Notice and Controls, collectively, “Privacy Policy”) in order to be transparent about how we collect, use, disclose and safeguard your (and/or the members of your group/traveling party’s) personal information submitted by you at https://italiapass.com/ (“Website”), as well as any other media form, media channel (including, without limitation, email), mobile website, mobile application, or call center, related or connected thereto our Website, regardless of whether they directly display or link to this Privacy Policy (individually, a “connected service”, and collectively, “connected services”).  

This Privacy Policy applies to the following:

• All connected services relating to ItaliaPass, including all information collected through our connected services.
• Information collected by us (or on our behalf) but excluding instances where your information is collected under a different Privacy Policy or notice made available to you at the time your information is collected.
• Information shared with us by third parties for our own use, as well as publicly available information collected by us.

The collection, use, and disclosure (collectively, “processing”) of information described in this Privacy Policy is controlled by ItaliaPass. Please read this Privacy Policy carefully before using the site or submitting any personal information.  If you have any questions or concerns about this Privacy Policy or our practices with regards to the information processed under this notice, please contact us using the contact information and methods provided under How To Contact Us below. By using the Website, you are accepting the practices described in this Privacy Policy. These practices may be changed from time to time, but any changes will be posted to our Website and we will take the appropriate steps to inform you consistently of the significance of the changes, and reserve the right to amend or make revisions to this Privacy Policy at any time and for any reason in its sole discretion. You can see the date the policy was last updated by looking at the “Last updated” date shown at the beginning of this Privacy Policy document. You are encouraged to review the Privacy Policy whenever you visit the site to make sure that you understand how any personal information you provide will be used. Your continued use of our services (including without limitation using our Website or submitting any personal information) after any changes to the Privacy Policy constitutes your consent to said changes.

Note: The privacy practices set forth in this Privacy Policy are for this Website only. If you link to or utilize other websites, you must review the privacy policies posted at those sites.

Information we process

We collect information that can be used to identify or contact a particular person (we refer to this type of data as “personal information”).  Personal information includes information that does not directly identify you by name or include your contact information, but which may be used to identify that a specific computer or device has accessed our connected services and which if combined with certain other information could be used to identify you.  We collect personal information when you provide it to us directly (e.g., when you submit a contact form through our connected services); when generated by your activity on our connected services (e.g., the amount of time spent on a particular page of our website); and when shared with us by our business partners (e.g., email marketing vendors or collected from other sources (e.g., publicly-available sources).

Information you give to us

We collect personal information that you provide to us such as name, address, contact information, passwords and security data, and payment information.  You may visit our connected services without you submitting any information about yourself.  However, we do collect personal information that you voluntarily provide to us when registering with us, expressing an interest in obtaining information about us, when engaging with us, or otherwise contacting us or utilizing our connected services.  This may include:

• Registering an account as one of our members, a family member of a member or a guest of a member.
• Requesting our communications.
• Participating at one of our events.
• Purchasing products or services from us.
• Participating in member profiles and directories, apps, message boards, chat rooms or other connected services where registration is required.
• Communicating by any other means with us.

The personal information that we collect depends on the context of your interactions with us, the choices you make and the products and features you use.  The personal information we collect can include the following:

• Name and contact data:  We may collect your first and last name, email address, postal address, phone number, and other similar contact data.
• Biographical data: We may collect your birthday, country of citizenship, name and contact data for your emergency contact.
• Credentials:  We may collect passwords, password hints, and similar security information used for authentication and account access.
• Photos:  We may collect profile photos and other pictures and videos you share with us.
• Social media handles and account information:  We may collect third-party social media handles and account information that you choose to share with us, such as LinkedIn, YouTube, Facebook, and Twitter account names and profile data.
• Event data: We may collect information regarding the events in which you participate.
• Health and insurance data: We may collect health information including physical and/or mental disabilities, pre-existing medical conditions, and dietary restrictions or allergies, in addition to information regarding insurance policies.
• Payment data: We may collect data necessary to process your payment if you make purchases or donations, such as your payment instrument number (such as a credit card number), and the security code associated with your payment instrument.  All payment data is stored by our payment processor, and you should review its privacy policies and contact the payment processor directly to respond to your questions. 

ALL PERSONAL INFORMATION THAT YOU PROVIDE TO US MUST BE TRUE, COMPLETE AND ACCURATE, AND YOU MUST NOTIFY US OF ANY CHANGES TO SUCH PERSONAL INFORMATION. 

Information we collect automatically

Some information – such as IP address and/or browser and device characteristics and device geolocation data – is collected automatically when you visit our connected services.

We use cookies and similar technologies on our connected services that automatically receive and track certain data about how you and other visitors interact with our connected services, preferences expressed, and settings chosen.  For example, we may collect information about your device (such as your device and browser type, operating system, IP address, mobile network carrier, and device and advertising identifiers), and your use of our connected services (such as access dates and times, online features or pages viewed, system activity and the third-party site or service you were using before interacting with our connected services). In some cases, we do this through the use of cookies, pixel tags, local storage, statistical identifiers, software development kits, and similar technologies that create and maintain unique identifiers.

PLEASE SEE OUR COOKIE NOTICE AND CONTROLS TO LEARN MORE ABOUT OUR USE OF COOKIES AND SIMILAR TECHNOLOGIES, THE TYPES OF DATA COLLECTED THROUGH THESE TECHNOLOGIES, AND YOUR CHOICES REGARDING THEIR USE ON OUR ONLINE SERVICES.

Information collected from other sources

We may obtain information about you from other sources, such as public databases, marketing partners, event organizers, as well as from other third parties.  Examples of the information we receive from other sources include social media profile information, and registration information submitted to third parties event sponsors and organizers.

Combining information

Where permitted by law, we may combine the personal information you provide to us through our connected services with information we collect through other connected services, information collected offline, and information provided to us by third parties.  Where permitted by law and feasible, we may also combine your personal information with data collected automatically through your use of our connected services, in which case we will treat any information that is combined or associated with your personal information as personal information for as long as it can reasonably be linked with your personal information.  We use this consolidated information to improve our connected services and product and service offerings, enhance our marketing and research activities, communicate information to you, and for any other legitimate purpose described in this Privacy Policy.

How we use your information

We process your information for a variety of legitimate business purposes described below, such as providing access to and securing your account, organizing and administering events, contacting you, and other operational purposes.

We use your personal information for a variety of legitimate business purposes, including the following:

• To facilitate account creation and logon process and administer user accounts.  We use your registration information and information collected automatically through cookies and similar technologies to create, administer, and provide you with access to your account.  In some cases, we process your information for these purposes pursuant to your consent.  In other cases, we process your information for these purposes in order to fulfill our obligations under an agreement with you.  In other cases, we process your information for these purposes based on our legitimate interest in providing members with a forum and mechanism to connect.
• To supplement account profiles and sharing.  If you choose to link your account with us to a third-party account such as your Google or Facebook account, we use the information you allowed us to collect from those third parties to supplement your profile information and to enable you to easily share information with others on the applicable third-party services.  In some cases, we process your information for these purposes pursuant to your consent.  In other cases, we process your information for these purposes based on our legitimate interest in enhancing our products and services.
• To send you marketing and promotional communications. We and/or our third-party marketing partners may use the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt-out of our marketing emails at any time by contacting us at support@italiapass.com (see Your Privacy Rights below).  In some cases, we process your information for these purposes pursuant to your consent.  In other cases, we process your information for these purposes based on our legitimate interest in direct marketing.
• To send administrative information to you. We may use your personal information to send you product, service and new feature information and/or information about changes to our terms, conditions, and policies.  In some cases, we process your information for these purposes in order to fulfill our obligations under an agreement with you.  In other cases, we process your information for these purposes based on our legitimate interest in providing you with relevant information about our products, services, and events.
• Administer events. We may use your information to administer events when you elect to participate in events.  In some cases, we process your information for these purposes pursuant to your consent.  In other cases, we process your information for these purposes in order to fulfill our obligations under an agreement with you, such as a registration agreement.  In other cases, we process your information for these purposes based on our legitimate interest in facilitating events.
• Request feedback. We may use your information to request feedback and to contact you about your use of our connected services.  In some cases, we process your information for these purposes pursuant to your consent.  In other cases, we process your information for these purposes based on our legitimate interest in product, service and event development.
• To protect our connected services. We may use your information as part of our efforts to keep our connected services safe and secure (for example, for fraud monitoring and prevention).  We process your information for these purposes based on our legitimate interest in preventing fraud and securing our connected services and information.
• To enforce our terms, conditions and policies.  In some cases, we process your information for these purposes in order to fulfill our obligations under an agreement with you, such as a registration agreement, or membership agreement.  In other cases, we process your information for these purposes based on our legitimate interest in ensuring network and information security and preventing fraud.  In other cases, we process your information for these purposes in order to comply with or enforce our rights under applicable law.
• To receive and issue payments.  In some cases, we process your information for these purposes in order to fulfill our obligations under an agreement with you.  In other cases, we process your information for these purposes based on our legitimate interest in debt collection and facilitating payments.
• To respond to legal requests and prevent harm.  If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.  In some cases, we process your information for these purposes based on our legitimate interest in complying with applicable laws and preventing harm.  In other cases, we process your information for these purposes in order to comply with or enforce our rights under applicable law.
• For the purposes identified in our Cookie Notice and Controls.  In some cases, we process your information for these purposes pursuant to your consent.  In other cases, we process your information for these purposes based on our legitimate interests in performing connected service analytics, product development, direct marketing, understanding user preferences, and securing our connected services.  In other cases, we process your information for these purposes in order to comply with or enforce our rights under applicable law.
• For other business purposes.  We may use your information for other business purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our ventures, products, services, marketing and your experience.  In some cases, we process your information for these purposes pursuant to your consent.  In other cases, we process your information for these purposes based on our legitimate interests in performing connected service analytics, product development, direct marketing, and understanding user preferences.

We may generate aggregate or de-identified data that does not contain your personally identifiable information.  We are not restricted in how we use or share such aggregated or de-identified data.

How we share your information

We share information with our affiliates, service providers, marketing partners, business partners, with other members or users of our connected services, in the event of a business transfer, and for legal purposes.

We may share or otherwise disclosure your personal information with/to the categories of recipients identified below for the following purposes:

• ItaliaPass and our affiliates:  Any information collected by ItaliaPass will be shared with other Affiliates of ItaliaPass in order to jointly engage in the activities described in this Privacy Policy, and otherwise provide you with our travel-related products and services.  We may also share your information with our other affiliates, in which case we will require those affiliates to honor this Privacy Policy.  “Affiliates” include any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.  In some cases, we share your information for these purposes pursuant to your consent.  In other cases, we share your information for these purposes in order to fulfill our obligations under an agreement with you, such as a registration agreement, or membership agreement.  In other cases, we share your information for these purposes based on our legitimate interest in supporting our internal administrative operations.
• Vendors, consultants and other third-party service providers: We may share your data with third party vendors, service providers, contractors or agents who perform services for us or on our behalf and require access to such information to do provide such services.  Examples include payment processing, data analysis, email delivery, hosting services, customer service and marketing efforts. We may allow selected third parties to use tracking technology on the connected services, which will enable them to collect data about how you interact with the connected services over time. This information may be used to, among other things, analyze and track data, determine the popularity of certain content and better understand online activity.  In some cases, we share your information for these purposes pursuant to your consent.  In other cases, we share your information for these purposes in order to fulfill our obligations under an agreement with you.  In other cases, we share your information for these purposes based on our legitimate interest in supporting our operational activities.  Unless described in this Privacy Policy or at the time your information is collected, we do not share, sell, rent or trade any of your information with third parties for their promotional purposes.
• Third-party advertisers: We may use third-party advertising companies to serve ads when you visit our connected services. These companies may use information about your visits to our connected services and other websites that are contained in or generated by cookies and similar technologies in order to provide advertisements about goods and services of interest to you.  Please see our Cookie Notice and Controls below for additional information.  In some cases, we share your information for these purposes pursuant to your consent.  In other cases, we share your information for these purposes based on our legitimate interest in marketing and improving our products, services and events.
• Business partners: We may share your information with our business partners to offer you certain products, services or promotions.  If we offer products, services, events or content on a ‘co-branded’ basis, you may see both our logo and the logo of the co-branded partner.  To access, use, or participate in co-branded products, services, events or content, you may have to provide certain requested information which may be shared with our co-branded partners.  You should read the individual privacy policies and terms of use of our co-branded partners, as these may differ in some respects from this Privacy Policy.  Remember, you can always opt-out of sharing your information with a co-branded partner by choosing not to use or participate in the product, service, event, or content provided.  In some cases, we share your information for these purposes pursuant to your consent.  In other cases, we share your information for these purposes in order to fulfill our obligations under an agreement with you, such as a registration agreement, or membership agreement. In other cases, we share your information for these purposes based on our legitimate interest in promoting and facilitating our products, services and events.
• Other members and users: Your member profile information and posted content (if any) may be shared with other registered members through account directories, apps, message boards, chat rooms or other interactive connected services in which you participate.  In some cases, we share your information for these purposes pursuant to your consent.  In other cases, we share your information for these purposes in order to fulfill our obligations under an agreement with you, such as a registration agreement, or membership agreement.  In other cases, we share your information for these purposes based on our legitimate interest in providing members with a forum and mechanism to connect.
• Business transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.  We share your information for these purposes based on our legitimate interest or in order to comply with or enforce our rights under applicable law.
• Legal purposes: We may also disclose information we collect to legal counsel, law enforcement, and other appropriate authorities in special cases, including when we have a reason to believe that such disclosure is necessary to identify, contact, or bring a legal action against someone who may be causing injury to or interference with our rights and property or those of any other person; or when we believe that it is required by applicable laws, court orders, or government regulations.  We share your information for these purposes in order to comply with or enforce our rights under applicable law.
• Marketing: You agree that we may send marketing or advertising materials to you via email or mail, including but not limited to, newsletters, blog updates, travel developments, etc. If you do not wish to receive marketing materials from us or any company we are affiliated with, please Contact Us and submit a request to remove your personal information from our marketing list. Any personal information shared with our affiliates (including, without limitation, our host agency, if applicable) will be protected by and subject to this Privacy Policy as well as the privacy policies of our affiliates.  We also may share your information with other third-party suppliers who provide services for your booking(s) and their privacy policies apply to the information they receive from us.

Use of cookies and similar technologies

We may use cookies and other tracking technologies (like web beacons and pixels) to collect and store your information.  Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice and Controls.

International transfers

We may transfer, store, and process your information in, to, through or with countries other than your own. 

ItaliaPass and our servers are located in the United States and Italy. If you are engaging with us from outside those countries, please be aware that your information will be transferred to, stored, and processed by us in our facilities located in either the United States or Italy, and by those third parties with whom we may share your personal information, which third parties may be located in the United States or Italy or in other countries.  The level of protection for your information in such countries may not be the same as the level of protection in your country.

If you are a resident in the European Economic Area, then these countries may not have data protection or other laws as comprehensive as those in your country. We will however take all necessary measures to protect your personal information in accordance with this Privacy Policy and applicable law. In particular, we comply with the EU-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union to the United States and has certified its compliance with it. As such, we are committed to subjecting all personal information received from European Union (EU) member countries, in reliance on the Privacy Shield Framework, to the Framework’s applicable Principles. To learn more about the Privacy Shield Framework, visit the U.S. Department of Commerce’s Privacy Shield List.

ItaliaPass is responsible for the processing of personal information it receives, under the Privacy Shield Framework, and subsequently transfers to a third party acting as an agent on its behalf. With respect to personal information received or transferred pursuant to the Privacy Shield Framework, ItaliaPass is subject to the regulatory enforcement powers of the U.S. FTC. In certain situations, we may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. 

 In addition, we abide to the principles of, and comply with, the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF as set forth by the U.S. Department of Commerce regarding the collection, use and retention of personal data from the European Union member countries, the UK and Switzerland. In addition, we comply with the EU Data Protection Directive through adherence to the DPF principles and have been certified with the Department of Commerce adherence to these principles for all personal data received from the European Union, the UK and Switzerland. To learn more about these programs, and to view our certification, please visit https://www.dataprivacyframework.gov/s/. 

Links to third-party websites

We are not responsible for and do not endorse the content of third-party websites or resources available through our connected services. This Privacy Policy only applies to our connected services that link to this Privacy Policy.  However, our connected services may contain links to third-party sites or services.  We do not endorse and are not responsible for the content of third-party websites or resources, and our Privacy Policy does not apply to any sites that are not controlled by ItaliaPass, even if you access such sites via a link on our connected services.  You should review the privacy policies and terms of use of any third-party site before providing any information to the controller of such site.

Retention of your personal information

We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy unless otherwise required by law. We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements).  When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

How we protect your information

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process.  To the extent appropriate or required by applicable law, these security measures include the following:

• Access to personal information is limited to authorized employees and service providers who need access to perform the activities described in this Privacy Policy on our behalf.
• Personal information is pseudonymized where appropriate or required by law, and sensitive personal information transferred to or stored on any mobile device is encrypted using industry-accepted encryption solutions.
• Personnel engaged in the processing of personal information are informed of the confidential nature of personal information, receive appropriate training on their responsibilities, and are obligated pursuant to our policies to maintain the confidentiality of personal information.
• The effectiveness of our security measures are regularly tested, assessed, and evaluated to ensure the ongoing security of processing systems.
• Internet-connected databases containing personal information are monitored for unauthorized intrusions using network-based and/or host-based intrusion detection mechanisms.
• Service providers and other third parties engaged by us to process personal information on our behalf are contractually obligated to process personal information only on our documented instructions and must provide similar security measures as those used by us or as required under applicable law.

When our registration/order form asks users to enter sensitive information (such as credit card number), that information is compliant with the Payment Card Industry Data Security Standard (PCI DSS) which is a widely accepted set of policies and procedures intended to optimize the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information as well as the information is encrypted and protected with the best encryption software in the industry, SSL (Secure Sockets Layer). The site employs SSL via a digital certificate issued by Amazon.

Although we strive to provide reasonable and appropriate security for the personal information we process, no security system can prevent all potential security breaches.  In particular, email or forms sent using our connected services may not be secure.  You should take special care before deciding to send us information via email and the transmission of personal information to and from our connected services is at your own risk.  Further, if you create an account through our connected services, it is your responsibility to protect your access credentials from unauthorized access or use.

If you have any questions about the security at our website, you can send an email to support@italiapass.com.

Your privacy rights

You have the rights and choices regarding the processing of your information as described below.

Account information

If you would at any time like to review or change the information in your account or terminate your account, you can log into your account settings and update your user account.  Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases.  However, some information may be retained in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our Terms of Use and/or comply with legal requirements.

Cookies and similar technologies

You can manage and change your cookie preferences or delete cookies entirely as described in our Cookie Notice and Controls.

Changes in preference and opting out of email marketing

We comply with the CAN-SPAM Act of 2003 and do not spam or send misleading information. Should you wish to no longer receive communication from us, you have the option of unsubscribing by clicking “unsubscribe” in the bottom of the email we send to you or by contacting us using the details provided under How To Contact Us below. You will then be removed from the marketing email list – however, we will still need to send you service-related emails that are necessary for the administration and use of your account. As for third party websites, please contact them directly to unsubscribe and/or opt out from their communications. We are in compliance with the GDPR along with the email marketing service we use to collect your data.

Jurisdiction-specific rights

In some regions and jurisdictions (such as California and the European Economic Area), you may have certain additional rights under applicable data protection laws.  To the extent that relevant jurisdictions grant additional privacy rights to individuals, these rights are described separately under the applicable Supplemental Information and Rights section included with and incorporated in this Privacy Policy below.

Dispute resolution

In compliance with the DPF principles, we commit to resolve complaints about our collection or use of your personal information.  EU individuals with inquiries or complaints regarding our Privacy Shield policies should first contact us at support@italiapass.com to resolve any issues or complaints. We will respond to your complaint within 45 days. We would also like to notify you that you have the option of independent recourse free of charge on issues concerning your data at the following independent dispute resolution body based in the USA.  More information on this can be found at  https://www.jamsadr.com/dpf-dispute-resolution. 

Should you find that a claimed violation has not been resolved after having addressed your complaint to us or to the independent dispute resolution mechanism mentioned above, you have the possibility to invoke binding arbitration administered by the Privacy Shield Panel of the Department of Commerce. We have further committed to cooperate with EU data protection authorities (DPAs) with regard to unresolved DPF complaints concerning human resources data transferred from the EU in the context of the employment relationship. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please contact the EU DPAs for more information or to file a complaint.  The services of EU DPAs are provided at no cost to you. https://italiapass.com/ is subject to the investigative and enforcement powers of the FTC, the Department of Transportation or any other authorized statutory body concerning compliance with this privacy policy.  

Controls for do-not-track features

Our connected services do not respond to “do not track” requests or signals at this time. Certain web browsers may allow you to enable a “do not track” option that sends signals to the websites you visit indicating that you do not want your online activities tracked.  Right now, there is no industry standard for how companies should respond to “do not track” signals, although one may be adopted in the future.  If we do so in the future, we will modify this Privacy Policy accordingly.  More information about “do not track” is contained in our Cookie Notice and Controls below.

Important information regarding minors

Our connected services are intended for general audiences.  We are in compliance with the requirements of the Federal Trade Commission’s Children's Online Privacy Protection Act (COPPA), and as such we do not knowingly collect any personal information from children under the age of 13 through our connected services, except after obtaining verifiable parental consent or as otherwise permitted under applicable law.

IF YOU ARE NOT OLD ENOUGH TO FORM LEGALLY BINDING OBLIGATIONS IN YOUR APPLICABLE JURISDICTION, PLEASE TALK TO YOUR PARENTS OR GUARDIANS BEFORE USING OUR ONLINE SERVICES OR PROVIDING YOUR NAME OR OTHER PERSONAL INFORMATION TO ITALIAPASS.  YOU CANNOT SUBMIT INFORMATION TO OUR ONLINE SERVICES WITHOUT YOUR PARENT’S OR GUARDIAN’S PERMISSION.  If the parent or guardian of a child believes that their child has provided us with personal information without permission, the parent or guardian should contact us using the details provided under How To Contact Us below to request access to the information and deletion of such information where required. For more information regarding protecting children’s privacy online visit https://www.ftc.gov/business-guidance/privacy-security/childrens-privacy .

Supplemental information

To the extent that certain jurisdictions require us to disclose additional information regarding our processing activities or grant additional privacy rights to individuals, such jurisdictions and the respective Supplemental Information and Rights section of this Privacy Policy describing these additional requirements/rights are identified below.

How to contact us

If you have any questions or comments about this Privacy Policy, or to submit a request or otherwise exercise your privacy rights under this Privacy Policy, please contact (or submit your request to) our Privacy Officer using the contact information below.

E-mail: privacy@interrail.com 

Phone: 1 (877) 375-7245

Cookie notice and controls

Our connected services use cookies and similar technologies to help us understand how you interact with our products and connected services, to improve your experience, and to allow you to use certain features made available through our connected services (such as sharing content via social networks or other communications channels).  

This Cookie Notice describes how cookies and similar technologies are used with our connected services, as well as your choices regarding the use of cookies on our services and the tools available to you to exercise your preferences.  For more information regarding the collection and use of information via our connected services, please read our Privacy Policy

Overview of cookies and similar technologies

A cookie is a small text file that a website saves on your computer or mobile device when you visit the site, either for the duration of your visit (a session cookie) or for repeat visits (a persistent cookie).  Session cookies are deleted from your computer or device once you leave the connected service.  Persistent cookies remain on your device and are sent back to the originating website on subsequent visits (or to another website that recognizes the cookie) to notify the website of your previous online activity.  Cookies on this connected service may be delivered by ItaliaPass (a first-party cookie) or a third-party (a third-party cookie) and may also be set in association with emails you receive from us.  Cookies help us enhance your experience when using our connected services.  They also help us understand how people use our connected services (such as which pages or features are most popular) so that we can better serve our users and members.

In addition to cookies, we may also use other similar technologies with our connected services, such as pixel tags (also known as clear GIFs, web beacons, pixels, or web bugs), local storage, statistical identifiers, and software development kits.  Pixel tags are small blocks of code installed on a website that allow a third party to deliver its third-party cookies when a visitor goes to the website and are generally used by third parties to monitor and track user activity on a website.  Local storage (such as HTML 5) allows a website to store and retrieve data on an individual’s device with no expiration date.  Statistical identifiers refer to identifiers created using certain device and server data.  Collectively, this information makes a user’s browser or device sufficiently distinct for a website to reasonably determine that it is encountering the same browser or device over time and used for the same purposes as cookies.  Software development kits (also called SDKs) function like third-party cookies and pixel tags but operate in the mobile app environment where cookies and pixel tags do not function as effectively.  Instead of using cookies and pixels tags, an app developer can install pieces of code provided by third parties (such as analytics providers) in its mobile app in order for the third parties to monitor and analyze the use and performance of the mobile app.

These technologies enable us and our partners to recognize when someone has visited our connected services or opened an email, allowing us to do things such as monitor the traffic patterns of users from one page within our website to another, understand whether a visitor has come to our website from an online advertisement displayed on a third-party site or in an email, and measure and improve the performance of our connected services.  In many instances, these technologies are reliant on cookies to function properly, and so disabling or declining cookies will also disable their functioning.

Cookies used with our online services

Like most websites, we use certain cookies and similar technologies with our connected services that allow us to collect various information that does not (on its own) identify any particular individual.  This helps us identify visitors who return to our connected services, informs us of things such as how many users visited our connected services, the services, web pages and features accessed, and whether there were any technical problems in loading pages or navigating through our connected services. By collecting this information, we learn what parts of our connected services are the most interesting or valuable to our users and members and can monitor overall interest in our products and services.  It also lets us spot technical problems with our connected services so we can address them right away and helps us upgrade our services and improve our offerings for our users and members.

The types of information typically collected through cookies and similar technologies include IP address (which is used to infer approximate location); Internet service provider; browser type and settings; device information (for example, type of device, operating system, device manufacturer); referring/exiting URL; request/response date and time; clickstream data; device ID or advertising ID; and your name, email address and password if you are logging into your account. We may use Google Analytics cookies to collect information about how visitors use our connected services.  These cookies collect information in the aggregate to give us insight into how our connected services are being used.  We anonymize IP addresses in Google Analytics, and the anonymized data is transmitted to and stored by Google on servers in the United States.  Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. 

We use these two cookies, Cookie Types: has_js, drupal.js – to optimize what a visitor sees based on if a visitor’s browser has support for JavaScript or not; ico – This is used solely to track whether or not the cookie usage policy has been communicated to you.

For an overview of these Google Analytics cookies, please visit: https://support.google.com/analytics/answer/6004245.  

You may install a Google Analytics Opt-out Browser Add-on by going here: https://tools.google.com/dlpage/gaoptout.

Geolocation information

Depending on the connected services and your computer or device permissions, we may collect information about your device’s approximate (for example, country or zip code) or precise location.  Various technologies may be used to collect this location information, such as IP addresses, GPS, and other sensors that may provide information on nearby devices, Wi-Fi access points, and cell towers.  We will only collect your computer’s or device’s precise location with your consent.  In addition, some photos or other content you place within the connected services (such as your profile picture or competition videos) may contain recorded location information. Location information is used to measure and improve the performance of our connected services and to optimize your experience.

How to manage and disable cookies

You can manage and change your cookie preferences or delete cookies entirely as discussed below.

Website and/or browser settings

Our website may feature a pop-up or other means to allow you to opt out of certain cookies. Browser settings allow you to choose whether or not to accept cookies or limit certain cookies.  Most browsers also provide functionality that lets you review and erase cookies.  To disable cookies through your browser, follow the instructions usually located within the “Help,” “Tools” or “Edit” menus in your browser.  If you need additional assistance, information on how to manage a disabled cookies on commonly used bowsers is available in this guide.  If you use our connected services without changing your browser settings, we will assume that you are ok to receive all cookies on the connected services.  Please be aware that if cookies are disabled, not all features of our connected services may operate as intended.  Also, please note that disabling a cookie or category of cookies does not delete the cookie from your browser unless manually completed through your browser function.

Cookies used for personalized advertising

If you would prefer that we not sell or share information that may be used to help determine which advertisements to serve you, opt-out by clicking the applicable “OPT-OUT” button, which can be found on most of our connected services. You may also opt- out or change your behavioral advertising cookie preferences by visiting the opt-out page for the Digital Advertising Alliance (U.S. residents and those not in the EU or Canada), the European Interactive Digital Advertising Alliance (European residents), or the Digital Advertising Alliance of Canada (Canadian residents).

Flash cookies

Flash cookies cannot be changed by browser settings.  If you do not want Flash cookies stored on your computer, you can adjust the settings of your Flash player to block Flash cookies storage using the tools contained in the Website Storage Settings Panel.  You can also control Flash Cookies by going to the Global Storage Settings Panel and following the instructions (which may include instructions that explain, for example, how to delete existing Flash cookies, how to prevent Flash LSOs from being placed on your computer without your being asked, and (for Flash Player 8 and later) how to block Flash cookies that are not being delivered by the operator of the page you are on at the time).  Please note that setting the Flash Player to restrict or limit acceptance of Flash cookies may reduce or impede the functionality of some Flash applications, including, potentially, Flash applications used in connection with our services or online content.

Mobile devices

Your mobile operating system may let you opt out from having your information collected or used for interest-based advertising on mobile devices.  You should refer to the instructions provided by your mobile device’s manufacturer, but this functionality is usually available in the “Settings” section of your device.

Do not track (DNT)

Certain web browsers may allow you to enable a “do not track” option that sends signals to the websites you visit indicating that you do not want your online activities tracked.  This is different from blocking cookies as browsers with the “do not track” option selected may still accept cookies.  Right now, there is no industry standard for how companies should respond to “do not track” signals, although one may be adopted in the future.  We do not respond to “do not track” signals at this time.  If we do so in the future, we will modify this Cookie Notice accordingly. More information about “do not track” is available at www.allaboutdnt.com.

Cookie notice changes

We may update this Cookie Notice from time to time.  Any changes will be posted on this page with an updated revision date.  If we make any material changes, we will provide notice through the connected service or by other means.

Questions/concerns regarding Privacy Policy and/or Cookie Notice and Policy 

Should you have any questions or concerns about our cookie policy or our privacy practices, please contact InterRail, LLC’s Privacy Officer by email at privacy@interrail.com; by telephone at (800) 877-375-7245; or by mail at PO BOX 428, Franklin, MA 02038, USA. All submissions should be directed to the attention of the Privacy Officer.

Supplemental information and rights 

for CALIFORNIA RESIDENTS

If you are a California resident, the following additional information and rights apply to you subject to the California Consumer Privacy Act (CCPA) with respect to ItaliaPass’ collection, use, and disclosure of personal information about you.  For purposes of this section, “personal information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer or household.  “Personal information” does not include publicly available information or information that is deidentified or in the aggregate.

Collection, use, and disclosure of personal information

Categories of personal information collected

ItaliaPass has collected the following categories of personal information about California consumers in the preceding 12 months:

• Identifiers, such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, telephone number, account name, Social Security Number, driver’s license number or state identification card number, passport number, or other similar identifiers.
• Other identifiers or consumer information, such as physical characteristics or description, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
• Characteristics of protected classifications under California or federal law, such as race, color, sex, age (40 and older), religion, national origin, disability, citizenship status, genetic information, marital status, sexual orientation and identity, political affiliations or activities, military or veteran status, medical condition, or status as a victim of domestic violence, assault, or stalking.
• Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.
• Geolocation data.
• Audio, electronic, visual, thermal, olfactory, or similar information.
• Professional or employment-related information.
• Inferences drawn from any of the information identified above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

ItaliaPass uses these categories of personal information for the purposes described under How We Use Your Information above.

Categories of personal information disclosed for business purposes

ItaliaPass has disclosed for a business purpose the following categories of personal information about California consumers in the preceding 12 months:

• Identifiers, such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, telephone number, account name, Social Security Number, driver’s license number or state identification card number, passport number, or other similar identifiers.
• Other identifiers or consumer information, such as physical characteristics or description, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
• Characteristics of protected classifications under California or federal law, such as race, color, sex, age (40 and older), religion, national origin, disability, citizenship status, genetic information, marital status, sexual orientation and identity, political affiliations or activities, military or veteran status, medical condition, or status as a victim of domestic violence, assault, or stalking.
• Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.
• Geolocation data.
• Audio, electronic, visual, thermal, olfactory, or similar information.
• Professional or employment-related information.
• Inferences drawn from any of the information identified above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

“Business purposes” include the use of personal information as reasonably necessary and proportionate for operational purposes, such as performing services on our behalf (e.g., maintaining or servicing accounts, providing customer service, processing orders, verifying member information, processing payments, or providing marketing or analytic services), auditing related to a current interaction with you and concurrent transactions, detecting and protecting against security incidents, debugging to identify and repair errors, conducting research, and undertaking activities to verify or maintain the quality or safety of our products and services.

Categories of personal information sold

ItaliaPass has not sold personal information about California consumers in the preceding 12 months.

Your privacy rights under California law

In addition to the rights described under Your Privacy Rights above, California residents also have the rights described below.

Right to notice and access

You have the right to request that ItaliaPass disclose additional information regarding our collection and use of your personal information, including the following:

• The categories of personal information we have collected about you.
• The categories of sources from which personal information is collected.
• The purpose for collecting or selling personal information.
• The categories of third parties with whom we share personal information.

In addition, you have the right to request access to the specific pieces of personal information we have collected about you.  To request this additional information or to access your personal information, please submit a request to ItaliaPass using one of the methods described under How to Exercise Your California Privacy Rights below.

Right to deletion of personal information

You have the right to request that ItaliaPass delete any personal information about you which we have collected from you.  To request deletion of your personal information, please submit your request to ItaliaPass using one of the methods described under How to Exercise Your California Privacy Rights below.  Please be aware that such a request does not ensure complete or comprehensive deletion of your personal information and that there may be circumstances in which the law does not require or allow deletion even if requested.

Right to transparency regarding disclosure or sale of personal information

You have the right to request that ItaliaPass disclose additional information regarding the disclosure or sale of your personal information, including the following:

• The categories of personal information that ItaliaPass disclosed about you for a business purpose.
• The categories of personal information that ItaliaPass sold about you and the categories of third parties to whom the personal information was sold (by category or categories of personal information for each third party to whom the personal information was sold).

In addition, you have the right to request information regarding the disclosure of your personal information by ItaliaPass to third parties for the third parties’ direct marketing purposes.

To request additional information regarding the disclosure and sale of your personal information (as applicable), or to opt-out of the disclosure of your personal information to third parties for their direct marketing purposes, please submit your request to ItaliaPass by using one of the methods described under How to Exercise Your California Privacy Rights below.

Right to opt-out of the sale or sharing of personal information

ItaliaPass generally does not sell your personal information, and only shares your personal information with necessary suppliers and vendors in connection with the travel products and services being provided to you. If ItaliaPass sells your personal information to third parties, you can opt-out of the sale of your personal information at any time by submitting a request to ItaliaPass using one of the methods described under Do Not Sell or Share My Personal Information below.

Do not sell or share my personal information

You have the right to opt-out of the sale or sharing of your personal information. Once we receive and confirm a verifiable consumer request from you, we will stop selling or sharing your personal information. To exercise your right to opt-out, please contact us via phone or email at support@italiapass.com.

Rights of children

Notwithstanding anything else contained in this Privacy Policy, ItaliaPass will not sell the personal information of individuals if ItaliaPass has actual knowledge that the individual is less than 16 years of age, unless the individual, in the case of individuals between 13 and 16 years of age, or the individual’s parent or guardian, in the case of individuals who are less than 13 years of age, has affirmatively authorized the sale of the individua’s personal information (the “right to opt-in”).

Right to removal of content posted publicly by minors

If you are a California resident under the age of 18, and a registered user of any connected services where this Privacy Policy is posted, you may request and obtain removal of content or information you have publicly posted.  To make such a request, please use one of the methods described under How to Exercise Your California Privacy Rights below and include a detailed description of the specific content or information to be removed.  Please be aware that such a request does not ensure complete or comprehensive removal of the content or information you have posted and that there may be circumstances in which the law does not require or allow removal even if requested.

Right not to be subject to discrimination

ItaliaPass will not and cannot discriminate against you for exercising any of your rights described above, such as by denying you goods or services or by providing you with a different level of goods or services.  However, we can charge a different price or rate, or provide a different level or quality of goods or services, if that difference is reasonably related to the value provided to you by your personal information.  In addition, we may offer financial incentives, including payments to you as compensation, for the collection, sale, or non-deletion of your personal information.  If we offer you any such financial incentives, we will first notify you of the applicable incentives and will only include you into a financial incentive program with your prior opt-in consent (which may be revoked by you at any time).

How to exercise your California privacy rights

To exercise any of your California privacy rights described above—including to request additional information regarding our collection and use of your personal information, to request access to your personal information, to request that we delete your personal information, to request additional information regarding the disclosure and sale of your personal information, or to opt-out of the disclosure of your personal information to third parties for their direct marketing purposes—please submit your request to ItaliaPass using one of the methods provided under How To Contact Us above.

Supplemental information and rights

for EUROPEAN RESIDENTS

If you reside in Europe or your personal information is otherwise covered by the European Union’s General Data Protection Regulation (GDPR) or U.K. Data Protection Act (collectively, “European Privacy Regulations”), the following additional information and rights apply to you with respect to ItaliaPass’ collection, use, and disclosure of personal information.  For purposes of this section, “personal information” means any information that identifies an individual or for which there is a reasonable basis to believe the information can be used to identify an individual.  “Personal information” does not include publicly available information or information that is deidentified or in the aggregate.

Controller | European representative

The processing of personal information collected by ItaliaPass is governed by this Privacy Policy, and ItaliaPass is the “controller” of such information. To contact us concerning our processing of your personal information, please email support@italiapass.com.

Your European privacy rights

In addition to the rights described under Your Privacy Rights above, you have various additional rights with respect to the collection, use, transfer, and processing of your personal information, as described below.  We reserve the right to limit these rights at any time where permitted under applicable law, including where your identity cannot be reasonably verified by ItaliaPass or to the extent your rights adversely affect the rights and freedoms of others.  To exercise any of the rights below, please submit your request to ItaliaPass. You have the right to obtain confirmation as to whether or not your personal information is being processed by ItaliaPass.  Where we are processing your personal information, you have the right to access the data and to obtain certain information about the processing of such data.

Right to rectification

You have the right to obtain rectification of any personal information that is inaccurate or incomplete, including by means of providing a supplementary statement.

Right to erasure

You have the right to have your personal information erased where one of the following applies:

• Your personal information is no longer necessary with regards to the purposes for which it was collected.
• You withdraw your consent (where the processing is based on such consent).
• You object to the processing where such processing is based on ItaliaPass’ (or a third party’s) legitimate interest and there are no overriding legitimate grounds for the processing.
• Your personal information must be erased in order to comply with a legal obligation under applicable law. 

However, this right to erasure will not apply to the extent the processing is necessary for:

• Compliance with a legal obligation which requires processing by applicable; or
• Archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, to the extent permitted under applicable law.

Right to restriction of processing

You have the right to restrict the processing of your personal information where one of the following applies:

• The accuracy of the personal information is contested.
• The processing is unlawful and you oppose the erasure of your personal information and request the restriction of its use instead. 
• ItaliaPass no longer needs the personal information for the purposes of the processing, but it is required by you for the establishment, exercise or defense of legal claims.
• Where the processing is based on ItaliaPass’ (or a third party’s) legitimate interest and you have objected to processing (as described immediately below).

Right to object

You have the right to object (on grounds relating to your particular situation) at any time to the processing of your personal information for direct marketing purposes or where the processing is based on ItaliaPass’ (or a third party’s) legitimate interest.  When objecting to processing based on our legitimate interest, ItaliaPass will no longer process your personal information unless ItaliaPass demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise, or defense of legal claims.

Right to withdraw consent

Where the processing of your personal information is based on your consent, you have the right to withdraw such consent at any time, without affecting the lawfulness of processing based on consent before such withdrawal.

Right to data portability

You have the right to receive your personal information, which you have provided to ItaliaPass, in a structured, commonly used and machine-readable format, and have the right to transmit such data to another entity without hindrance from ItaliaPass, where each of the following conditions are met:

• Your request does not adversely affect the rights of others;
• Your request does not adversely affect ItaliaPass’ rights (including intellectual property rights);
• The processing is based on your consent or the performance of a contract to which you are a party; and
• The processing is carried out by automated means.

Right not to be subject to solely automated decisions

You have the right not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects concerning you or similarly significantly affects you, unless permitted under applicable law.

Right to submit a complaint to supervisory authorities

You have the right to lodge a complaint with an applicable data protection authority.  If you reside in Europe, you have the right to lodge such a complaint in the European country of your habitual residence, place of work, or place of an alleged infringement if you consider that the processing of your personal information infringes applicable European Privacy Regulations.  A list of all European supervisory authorities and their respective contact information is available here.