Privacy
pursuant to Articles 13 and 14 of European Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and in compliance with the Italian legislation in force
Società per azioni Esercizi Aeroportuali (S.E.A.), with its registered office in Segrate (Milan) - 20054 - at Milan-Linate Airport, (the “Company”) within the scope of the services offered and purchases made by users on the website www.clubsea.it (the “Service”) processes personal data freely provided by the data subjects pursuant to Articles 4, no. 7 and 24 of the EU Regulation 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data (the “Regulation”), as well as the Italian legislation in force.
Processing of personal data means any operation or set of operations, performed with or without the aid of automated processes and applied to personal data or sets of personal data, even if not recorded in a database, such as collection, registration, organization, structuring, storage, processing, selection, blocking, adaptation or modification, retrieval, consultation, use, communication by transmission, dissemination or any other form of provision, comparison or interconnection, restriction, erasure or destruction.
The Company will therefore proceed, pursuant to Articles 13 and 14 of the Regulation and the Italian legislation in force, to the carry out the relevant processing for the purposes listed below either manually and/or with the support of computerised or telematic means.
1. Purpose and legal basis for processing data
The data is acquired and processed in compliance with the rules set out in the Regulation and in the Italian legislation in force for the following purposes with the consent of the data subject:
- the performance of obligations arising from contracts of sale of the Services on the Website and/or fulfilment, prior to the conclusion of the aforementioned contracts, of specific requests by the data subjects (“Primary Purposes”)
- marketing (see point 3.2 below).
- profiling (see point 3.3 below).
2. Disclosure and dissemination of personal data for the pursuit of the Primary Purposes of the processing.
The data may be disclosed to third parties when the disclosure is required by law, including the scope of prevention/repression of any illegal activity. With reference to Article 13(1)(e) of the Regulation and the Italian legislation in force, the data may be disclosed exclusively for the pursuit of the Primary Purposes to Company employees/collaborators/consultants, as well as to third-party companies whose cooperation the Company uses for the pursuit of the Primary Purposes. The updated list of external processors is available at the Company's registered office. The data will not be disclosed, specifically personal data will not be disclosed to the public or, in any case, to an indeterminate number of parties.
3. Compulsory or optional provision of data for the pursuit of processing purposes
3.1 Primary Purposes
The provision of data to the Company is compulsory only for data where there are legal, administrative, fiscal and accounting obligations in connection with purchases made on the website. Any refusal to provide such compulsory data may force the Company to obtain it from third-party sources (where lawfully possible) or may result in the Service not being provided. To complete an online purchase, it will be necessary to provide the data marked with an asterisk on the registration form. The failure, partial or incorrect provision of such data will make it impossible for the Company to provide the services requested or complete the purchase. The failure, partial or incorrect provision of data not marked with an asterisk will not prevent the performance of services or purchase.
3.2 Marketing purposes
In order to proceed with the processing for marketing purposes, it is mandatory to acquire specific, separate, express, documented, prior and entirely optional consent. By giving consent to the processing for marketing purposes, the data subject specifically acknowledges the promotional, commercial and marketing purposes in the broad sense of the processing (including the subsequent management and administrative activities) and expressly authorises such processing pursuant to Article 6(1)(a) of the Regulation and in accordance with the Italian legislation in force. Where the data subject does not intend to give consent to the processing for marketing purposes, it will make it impossible for the Company to proceed with the relevant processing. Failure to give consent to processing for marketing purposes will not result in any interference and/or consequences on other possible negotiation, contractual or other relationships with the user.
3.3 Profiling
It is possible that for marketing and service improvement purposes, the Company may process so-called profiling data. For this processing, and for the purposes of complete information, reference is made to the definition in Article 4, paragraph 1, no. (4) of the Regulation: "any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements". In order to proceed with the profiling, specific and separate consent must be obtained. Where the data subject does not intend to give consent to the processing for profiling purposes, it will make it impossible for the Company to proceed with the relevant processing. The data subject is free to consent to processing for marketing purposes and not to consent to further processing for profiling purposes. Where the data subject does not wish to consent to processing for profiling purposes, the consequence will be that there will be no profiling carried out by Company and the data collected will be processed solely and exclusively by the Company where the data subject has consented to the Company's processing for marketing purposes. Data subject to profiling and authorised profiles will not be disseminated.
3.4
In any case, even where the data subject has given their consent to authorise the Company to pursue all the purposes mentioned in the above points, they will remain free to withdraw it at any time. It should be specifically and separately stated, as required by Article 21 of the Regulation, where applicable, that the data subject has the right to object at any time to the processing of personal data concerning them carried out for these purposes, and that if the data subject objects to the processing, the personal data may no longer be processed for these purposes.
4. Transfer of personal data to countries outside the European Union.
The data collected and processed shall not be transferred to companies or other entities outside the EU territory.
5. Data retention period
With reference to the personal data processed for the pursuit of the Primary Purposes, they will be stored in compliance with the principle of proportionality and until the purposes of the processing have been achieved, in any case, for a period not exceeding 10 years. Moreover, in the case of interaction with the site through login or new purchase, this storage period will start from the latter interaction. It is understood that consent may be freely revoked according to the procedures set out in art. 7 below. With regard to marketing and profiling purposes, said data will be kept for 24 months and 12 months respectively.
6. Data controller
The identification details of the data controller company are as follows: Società per azioni Esercizi Aeroportuali (S.E.A.), with its registered office in Segrate (Milan) - 20054 - at Milan-Linate Airport.
7. Data Protection Officer (DPO)
It is possible for data subjects to contact the Data Protection Officer to exercise their pursuant to Articles 15-22 of the Regulation by sending an email to: privacy@seamilano.eu .
8. Rights of the interested party
In relation to the processing of data, the data subject is entitled to exercise the rights set out in Articles 15 to 22 of European Regulation 2016/679, reproduced in reduced form in Annex A to this privacy policy. Exercising of such rights is not subject to any formal restriction and is free of charge.
Annex A
European Data Protection Regulation
Articles 15 to 22
Pursuant to Articles 15 to 22 of European Regulation 2016/679, the data subject has the right to obtain from the data controller the rectification, integration or erasure (so-called right to be forgotten) of his/her personal data; the right to obtain the limitation of the processing and the right to data portability, the right to object to the processing of personal data, including profiling and, finally, the right to lodge a complaint with the Guarantor Authority.