Pursuant to article 13 of european regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and in compliance with the italian legislation in force.
Società per azioni Esercizi Aeroportuali S.E.A., having its registered office in Segrate (Milan) - 20054 - at the Milano-Linate Airport, ("Company") within the scope of the services offered ("Service(s)") and purchases made by users on the website www.milanairports-shop.com ("Site") processes personal data ("Personal Data") spontaneously provided by you to it, in its capacity as Data Controller, in accordance with the provisions of EU Regulation 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data ("Regulation"), as well as of Legislative Decree no. 196/2003 as subsequently modified by Legislative Decree 101/2018 ("Privacy Code" and jointly with the Regulations, the "Privacy Regulations").
Processing of Personal Data means any operation or set of operations, performed with or without the aid of automated processes and applied to Personal Data or sets of Personal Data, even if not recorded in a database, such as collection, registration, organization, structuring, storage, processing, selection, blocking, adaptation or modification, retrieval, consultation, use, communication by transmission, dissemination or any other form of provision, comparison or interconnection, restriction, erasure or destruction.
The Company will therefore proceed, in accordance with the Privacy Law, to process Personal Data for the purposes listed below by hand and/or with the support of computer or data transmission systems.
1. Purpose and legal basis of the processing
Personal Data are acquired and processed in accordance with the rules set out in the Privacy Policy for the following purposes:
(i) execution of obligations arising from contracts for the sale of Services on the Site and/or fulfilment, prior to the conclusion of such contracts, of specific requests made by you and/or fulfilment of legal obligations by the Company of administrative, tax and accounting nature, which are connected to purchases made on the Site ("Primary Purposes"). The legal basis will be the execution of the contract and of legal obligations;
(ii) marketing (see point 3.2 below). The legal basis will be the consent;
(iii) profiling (see point 3.3 below). The legal basis will be the consent;
(iv) transfer of data to third parties, commercial partners of the Company, whose names, products and/or services offered are indicated on the Site (see points 3.2 and 3.3 below - "Commercial Partners"). The legal basis will be the consent; and
(v) anonymization of Personal Data collected for sub (i), (ii) and (iii) purposes, for statistical purposes and further analysis. The legal basis will be the legitimate interest of the Company to proceed, after the anonymization of the personal data concerned, to further analysis/statistics in order to improve the provision of its services to users.
2. Disclosure and dissemination of Personal Data for the pursuit of the Primary Purposes of processing.
The Personal Data may be disclosed to third parties when the disclosure is required by law, including the scope of prevention/repression of any illegal activity. With reference to article 13, paragraph 1, letter (e) of the Regulations, Personal Data may be communicated exclusively for the pursuit of the Primary Purposes to employees/collaborators/consultants, as well as to the collaboration of third party companies which the Company uses for the pursuit of the Primary Purposes. The updated list of third party companies, appointed as external data processors pursuant to article 28 of the Regulations, is available at the Company's registered office.
In any case, except as provided for above, Personal Data will not be disclosed, specifically they will not be disclosed to the public or, in any case, to an indeterminate number of parties.
3. Mandatory or optional provision of Personal Data for pursuit of the purpose of processing
3.1 Primary Purposes
The provision of Personal Data to the Company is compulsory only for the Personal Data in the appropriate forms, without which it is not possible to proceed to the finalization of the purchase (such as name, surname, e-mail, state of residence, city of residence, postal code, address and street number and tax code or VAT number), necessary for the execution of the Primary Purposes and/or for which there are legal obligations to be fulfilled by the Company of administrative, tax and accounting nature, which are connected to the purchases made on the Site.
In particular, in order to complete an online purchase on the Site, it will be necessary to provide such mandatory Personal Data, as the failure, partial or incorrect provision, may make it impossible for the Company to perform the Services.
In any case, failure, partial or inaccurate provision of Personal Data not essential to the formalization of the purchase (i.e. mobile phone number) will not prevent the performance of the Services, referred to the Primary Purposes, in your favour.
3.2 Direct marketing purposes
In order to proceed with the processing for marketing purposes, it is mandatory to acquire specific, separate, express, documented, prior and entirely optional consent.
By giving your consent to the processing of data for marketing purposes, you specifically acknowledge the promotional, commercial and marketing purposes in the broad sense of the term of the processing (including the consequent management and administrative activities) and authorise, with your consent, such processing pursuant to the Privacy Law and in particular Article 6, paragraph 1, letter (a) of the Regulations. Specifically, if you give your consent to processing for the purposes in question, the Company may send you commercial communications through the use of automated systems, e.g. e-mail, SMS, telephone, chat or social media.
Where you do not intend to give consent to processing for marketing purposes, the consequence will be the impossibility for the Company to proceed with the relevant processing. In any case, failure to give your consent to the processing of your Personal Data for marketing purposes will not result in any interference with and/or consequences on any other contractual, negotiation or other relationship with you, including the performance of the Services referred to in the Primary Purposes.
In addition, you are free to give your specific consent, for the communication to the Business Partners which want to proceed in turn to the processing for their own marketing purposes, completely separate from those pursued by the Company. In particular, if you give your consent to the communication for the purposes in question, these third parties may send you commercial communications by mail, e-mail, SMS, telephone, chat or social media. Where You do not intend to give Your consent for such communications, the Company will not make any communication to third parties and Your Personal Data will be processed solely and exclusively by the Company for the purposes set out in sub art. 1 and for which You have authorised the Company for such purposes.
3.3. Profiling
It is possible that in order to improve the marketing purposes and/or the Services, the Company may process Your Personal Data for the purpose of "profiling". For this processing, and for the purposes of complete information, reference is made to the definition of profiling pursuant to art. 4 no. (4) of the Regulations, namely: "any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements".
Pursuant to the Privacy Law, for the pursuit of this profiling purpose, it is mandatory to obtain a specific and separate consent with respect to the consent requested, and which may have been given by you, for marketing purposes. Therefore, if you do not intend to give your consent to the processing of your Personal Data for profiling purposes, the Company will not be able to proceed with the relevant processing.
3.4 In any case, even where you have given your consent to authorise the Company to pursue all the purposes mentioned in the above points, you will remain free to withdraw it at any time.
In particular, You have the right to withdraw your consent (opt-out) to the processing of Your Personal Data for direct marketing purposes referred to in paragraph 3.2, carried out through the use of automated systems, e.g. e-mail, SMS.
4. Communication of Personal Data to Countries outside the European Union.
Personal Data collected is not processed outside the European Economic Area.
5. Time of retention of Personal Data
With reference to the Personal Data processed for the pursuit of the Primary Purposes, they will be stored in compliance with the principle of proportionality and until the purposes of the processing have been achieved, in any case, for a period not exceeding 10 years from their collection.
With reference to marketing and profiling purposes, Personal Data will be kept for a period of 24 months and 12 months respectively from the collection of your consent, subject to transformation into an anonymous form that does not allow, even indirectly or by linking other databases, to identify the data subject.
In any case, the Personal Data which does not need to be retained in relation to the purposes for which it has been processed, and in any case upon expiry of the aforementioned retention periods, shall be deleted or transformed into anonymous form by the Company, also through third parties which, in this case, shall have the status of data processors.
6. Data controller
The identification details of the data controller company for your Personal Data are as follows:
Società per azioni Esercizi Aeroportuali S.E.A., with registered office in Segrate (Milan) - 20054 - at Milan-Linate Airport.
7. Data Protection Officer (DPO)
It is possible to contact the Data Protection Officer, also for the exercise of the rights of data subjects pursuant to articles 15-22 of the Regulation, by sending an email to: privacy@seamilano.eu .
8. Rights of the interested party
In relation to the processing of Personal Data, you are entitled to exercise your rights set out in Articles 15 to 22 of the Regulations, reproduced in reduced form in Annex A to this privacy policy. You may exercise these rights by sending your request to the Data Protection Officer at the following address privacy@seamilano.eu or by ordinary mail addressed to the Data Protection Officer - 20054 Segrate (Milan), at Milan Linate Airport.
Exercising of such rights is not subject to any formal restriction and is free of charge.
9. In case of registration to the Site and transactions through e-commerce
If you decide to register on the Site ("Registration") and carry out transactions through the e-commerce service, this policy will apply (see sub-points 1 - 8 above) with the following changes. Therefore, in case of Registration and transaction, to supplement and partially modify the privacy policy:
(i) The Company will process your Personal Data for the following purposes:
(a) allow you to access the Services in an easier way, in particular for the purposes of possible transactions through e-commerce that you have requested: for example, you will not have to manually fill out the form referred to in paragraph 3.1 which will be automatically filled with your Personal Data, without prejudice to the possibility of modifying them ("Primary Purposes of Registration"). The legal basis will be the execution of the contract and of legal obligations;
(b) marketing (see point 3.2). The legal basis will be the consent;
(c) profiling (see point 3.3). The legal basis will be the consent; and
(d) anonymization of Personal Data collected for sub (a), (b) and (c) purposes, for statistical purposes and further analysis. The legal basis will be the legitimate interest of the Company to proceed, after the anonymization of the personal data concerned, to further analysis/statistics in order to improve the provision of its services to users.
We specify that your Personal Data will not be communicated to the Company's Commercial Partners.
(ii) The Company will process the following Personal Data, marked with an asterisk in the appropriate form , the provision of which is mandatory for the performance of the Primary Purposes of Registration: name, surname, e-mail, password, state of residence, city of residence, address and street number. Such Personal Data are necessary for the completion of the Registration, therefore, failure, partial or inaccurate provision of such Personal Data, may result in the impossibility to complete the Registration.
In addition, the Company will process further Personal Data that is not essential for the completion of the Registration, the provision of which is optional, such as telephone number and gender. Failure, partial or inaccurate provision of such Personal Data will not prevent the finalization of the Registration.
With reference to the compulsory or non-compulsory provision of Personal Data and the consequences in the event of failure, partial or inaccurate provision in relation to the purposes referred to in points (b) marketing and (c) profiling, refer to the provisions of point 3 of the privacy policy for the relevant purposes.
(iii) The Personal Data processed by the Company for Registration purposes is for retained for 10 years from (a) Registration in case of inactivity of the user, in fact in case of no access to the private area or purchase; or (b) the last interaction of the user with the Site through login or new purchase. This is without prejudice to any specific legal obligations.
With regard to the retention of Personal Data for the purposes referred to in points (b) marketing and (c) profiling, refer to the provisions of point 5 of the privacy policy for such purposes.
10. In case of joining the ViaMilano Program
If you decide to join the ViaMilano loyalty program ("Program"), the conditions of which are described in the ViaMilano Program Regulations available at this link www.milanomalpensa-airport.com/en/airport/fidelity-card/rules , this privacy policy ( see sub points 1 - 8 above) will apply with the following modifications. Therefore, in case of joining to the Program, as an integration and partial modification of the privacy policy:
(i) The Company will process your Personal Data for the following purposes:
(a) manage your participation in the Program, to award you with prizes and other benefits related to your participation in the Program and to the ownership of the card, as well as to provide you with related services, in accordance with the terms and conditions of the ViaMilano Program Regulations, also by sending you notices of new products, initiatives and promotions reserved to members, which are the subject of the Program ("Primary Purposes of the Program"). The legal basis will be the execution of the contract and of legal obligations;
(b) marketing (see point 3.2). The legal basis will be the consent;
(c) profiling (see point 3.3). The legal basis will be the consent; and
(d) anonymization of Personal Data collected for sub (a), (b) and (c) purposes, for statistical purposes and further analysis. The legal basis will be the legitimate interest of the Company to proceed, after the anonymization of the personal data concerned, to further analysis/statistics in order to improve the provision of its services to users.
We specify that your Personal Data will not be communicated to the Company's Commercial Partners.
(ii) Should you only join the Program (without registering on the Site), the Company will only process the following Personal Data, the provision of which is compulsory for the execution of the Primary Purposes of the Program: name, surname, e-mail. Otherwise, in the event that you register on the Site and join the Program, the Company will collect such Personal Data from the form provided for registration on the Site. Such Personal Data is necessary for the full participation of the member in the Program and for the related initiatives, as well as for the fulfilment of legal obligations, therefore, failure, partial or inaccurate provision of such Personal Data may make it impossible for the Company and third party service providers under the Program to fully implement the Program or to properly carry out the obligations arising therefrom.
With reference to the compulsory or non-compulsory provision of Personal Data and the consequences in the event of failure, partial or incorrect provision of the data, in relation to the purposes referred to in points (b) marketing and (c) profiling, refer to the provisions of point 3 of the privacy policy for the relevant purposes.
(iii) With respect to Personal Data processed by the Company in pursuit of the Primary Purposes of the Program, such Personal Data is processed for the entire duration of the Program. In any case, joining the Program and the consequent and relevant processing of Personal Data is automatically renewed every year, except for requests for erasure from the Program according to the procedure indicated in the Program Regulations. In this case, the Personal Data will be erased, except for those related to the processing necessary for the Company to comply with tax/accounting or legal obligations.
With regard to the retention of Personal Data referred to in points (b) marketing and (c) profiling, refer to the provisions of point 5 of the privacy policy for such purposes.
Attachment A
European regulation on the protection of personal data
Articles 15 to 22
Pursuant to Articles 15 to 22 of European Regulation 2016/679, you have the right to obtain from the data controller the rectification, integration or erasure (so-called right to be forgotten) of your Personal Data; the right to obtain the limitation of the processing and the right to data portability, the right to object to the processing of Personal Data, including profiling and, finally, the right to lodge a complaint with the Guarantor Authority.
Società per azioni Esercizi Aeroportuali S.E.A., having its registered office in Segrate (Milan) - 20054 - at the Milano-Linate Airport, ("Company") within the scope of the services offered ("Service(s)") and purchases made by users on the website www.milanairports-shop.com ("Site") processes personal data ("Personal Data") spontaneously provided by you to it, in its capacity as Data Controller, in accordance with the provisions of EU Regulation 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data ("Regulation"), as well as of Legislative Decree no. 196/2003 as subsequently modified by Legislative Decree 101/2018 ("Privacy Code" and jointly with the Regulations, the "Privacy Regulations").
Processing of Personal Data means any operation or set of operations, performed with or without the aid of automated processes and applied to Personal Data or sets of Personal Data, even if not recorded in a database, such as collection, registration, organization, structuring, storage, processing, selection, blocking, adaptation or modification, retrieval, consultation, use, communication by transmission, dissemination or any other form of provision, comparison or interconnection, restriction, erasure or destruction.
The Company will therefore proceed, in accordance with the Privacy Law, to process Personal Data for the purposes listed below by hand and/or with the support of computer or data transmission systems.
1. Purpose and legal basis of the processing
Personal Data are acquired and processed in accordance with the rules set out in the Privacy Policy for the following purposes:
(i) execution of obligations arising from contracts for the sale of Services on the Site and/or fulfilment, prior to the conclusion of such contracts, of specific requests made by you and/or fulfilment of legal obligations by the Company of administrative, tax and accounting nature, which are connected to purchases made on the Site ("Primary Purposes"). The legal basis will be the execution of the contract and of legal obligations;
(ii) marketing (see point 3.2 below). The legal basis will be the consent;
(iii) profiling (see point 3.3 below). The legal basis will be the consent;
(iv) transfer of data to third parties, commercial partners of the Company, whose names, products and/or services offered are indicated on the Site (see points 3.2 and 3.3 below - "Commercial Partners"). The legal basis will be the consent; and
(v) anonymization of Personal Data collected for sub (i), (ii) and (iii) purposes, for statistical purposes and further analysis. The legal basis will be the legitimate interest of the Company to proceed, after the anonymization of the personal data concerned, to further analysis/statistics in order to improve the provision of its services to users.
2. Disclosure and dissemination of Personal Data for the pursuit of the Primary Purposes of processing.
The Personal Data may be disclosed to third parties when the disclosure is required by law, including the scope of prevention/repression of any illegal activity. With reference to article 13, paragraph 1, letter (e) of the Regulations, Personal Data may be communicated exclusively for the pursuit of the Primary Purposes to employees/collaborators/consultants, as well as to the collaboration of third party companies which the Company uses for the pursuit of the Primary Purposes. The updated list of third party companies, appointed as external data processors pursuant to article 28 of the Regulations, is available at the Company's registered office.
In any case, except as provided for above, Personal Data will not be disclosed, specifically they will not be disclosed to the public or, in any case, to an indeterminate number of parties.
3. Mandatory or optional provision of Personal Data for pursuit of the purpose of processing
3.1 Primary Purposes
The provision of Personal Data to the Company is compulsory only for the Personal Data in the appropriate forms, without which it is not possible to proceed to the finalization of the purchase (such as name, surname, e-mail, state of residence, city of residence, postal code, address and street number and tax code or VAT number), necessary for the execution of the Primary Purposes and/or for which there are legal obligations to be fulfilled by the Company of administrative, tax and accounting nature, which are connected to the purchases made on the Site.
In particular, in order to complete an online purchase on the Site, it will be necessary to provide such mandatory Personal Data, as the failure, partial or incorrect provision, may make it impossible for the Company to perform the Services.
In any case, failure, partial or inaccurate provision of Personal Data not essential to the formalization of the purchase (i.e. mobile phone number) will not prevent the performance of the Services, referred to the Primary Purposes, in your favour.
3.2 Direct marketing purposes
In order to proceed with the processing for marketing purposes, it is mandatory to acquire specific, separate, express, documented, prior and entirely optional consent.
By giving your consent to the processing of data for marketing purposes, you specifically acknowledge the promotional, commercial and marketing purposes in the broad sense of the term of the processing (including the consequent management and administrative activities) and authorise, with your consent, such processing pursuant to the Privacy Law and in particular Article 6, paragraph 1, letter (a) of the Regulations. Specifically, if you give your consent to processing for the purposes in question, the Company may send you commercial communications through the use of automated systems, e.g. e-mail, SMS, telephone, chat or social media.
Where you do not intend to give consent to processing for marketing purposes, the consequence will be the impossibility for the Company to proceed with the relevant processing. In any case, failure to give your consent to the processing of your Personal Data for marketing purposes will not result in any interference with and/or consequences on any other contractual, negotiation or other relationship with you, including the performance of the Services referred to in the Primary Purposes.
In addition, you are free to give your specific consent, for the communication to the Business Partners which want to proceed in turn to the processing for their own marketing purposes, completely separate from those pursued by the Company. In particular, if you give your consent to the communication for the purposes in question, these third parties may send you commercial communications by mail, e-mail, SMS, telephone, chat or social media. Where You do not intend to give Your consent for such communications, the Company will not make any communication to third parties and Your Personal Data will be processed solely and exclusively by the Company for the purposes set out in sub art. 1 and for which You have authorised the Company for such purposes.
3.3. Profiling
It is possible that in order to improve the marketing purposes and/or the Services, the Company may process Your Personal Data for the purpose of "profiling". For this processing, and for the purposes of complete information, reference is made to the definition of profiling pursuant to art. 4 no. (4) of the Regulations, namely: "any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements".
Pursuant to the Privacy Law, for the pursuit of this profiling purpose, it is mandatory to obtain a specific and separate consent with respect to the consent requested, and which may have been given by you, for marketing purposes. Therefore, if you do not intend to give your consent to the processing of your Personal Data for profiling purposes, the Company will not be able to proceed with the relevant processing.
3.4 In any case, even where you have given your consent to authorise the Company to pursue all the purposes mentioned in the above points, you will remain free to withdraw it at any time.
In particular, You have the right to withdraw your consent (opt-out) to the processing of Your Personal Data for direct marketing purposes referred to in paragraph 3.2, carried out through the use of automated systems, e.g. e-mail, SMS.
4. Communication of Personal Data to Countries outside the European Union.
Personal Data collected is not processed outside the European Economic Area.
5. Time of retention of Personal Data
With reference to the Personal Data processed for the pursuit of the Primary Purposes, they will be stored in compliance with the principle of proportionality and until the purposes of the processing have been achieved, in any case, for a period not exceeding 10 years from their collection.
With reference to marketing and profiling purposes, Personal Data will be kept for a period of 24 months and 12 months respectively from the collection of your consent, subject to transformation into an anonymous form that does not allow, even indirectly or by linking other databases, to identify the data subject.
In any case, the Personal Data which does not need to be retained in relation to the purposes for which it has been processed, and in any case upon expiry of the aforementioned retention periods, shall be deleted or transformed into anonymous form by the Company, also through third parties which, in this case, shall have the status of data processors.
6. Data controller
The identification details of the data controller company for your Personal Data are as follows:
Società per azioni Esercizi Aeroportuali S.E.A., with registered office in Segrate (Milan) - 20054 - at Milan-Linate Airport.
7. Data Protection Officer (DPO)
It is possible to contact the Data Protection Officer, also for the exercise of the rights of data subjects pursuant to articles 15-22 of the Regulation, by sending an email to: privacy@seamilano.eu .
8. Rights of the interested party
In relation to the processing of Personal Data, you are entitled to exercise your rights set out in Articles 15 to 22 of the Regulations, reproduced in reduced form in Annex A to this privacy policy. You may exercise these rights by sending your request to the Data Protection Officer at the following address privacy@seamilano.eu or by ordinary mail addressed to the Data Protection Officer - 20054 Segrate (Milan), at Milan Linate Airport.
Exercising of such rights is not subject to any formal restriction and is free of charge.
9. In case of registration to the Site and transactions through e-commerce
If you decide to register on the Site ("Registration") and carry out transactions through the e-commerce service, this policy will apply (see sub-points 1 - 8 above) with the following changes. Therefore, in case of Registration and transaction, to supplement and partially modify the privacy policy:
(i) The Company will process your Personal Data for the following purposes:
(a) allow you to access the Services in an easier way, in particular for the purposes of possible transactions through e-commerce that you have requested: for example, you will not have to manually fill out the form referred to in paragraph 3.1 which will be automatically filled with your Personal Data, without prejudice to the possibility of modifying them ("Primary Purposes of Registration"). The legal basis will be the execution of the contract and of legal obligations;
(b) marketing (see point 3.2). The legal basis will be the consent;
(c) profiling (see point 3.3). The legal basis will be the consent; and
(d) anonymization of Personal Data collected for sub (a), (b) and (c) purposes, for statistical purposes and further analysis. The legal basis will be the legitimate interest of the Company to proceed, after the anonymization of the personal data concerned, to further analysis/statistics in order to improve the provision of its services to users.
We specify that your Personal Data will not be communicated to the Company's Commercial Partners.
(ii) The Company will process the following Personal Data, marked with an asterisk in the appropriate form , the provision of which is mandatory for the performance of the Primary Purposes of Registration: name, surname, e-mail, password, state of residence, city of residence, address and street number. Such Personal Data are necessary for the completion of the Registration, therefore, failure, partial or inaccurate provision of such Personal Data, may result in the impossibility to complete the Registration.
In addition, the Company will process further Personal Data that is not essential for the completion of the Registration, the provision of which is optional, such as telephone number and gender. Failure, partial or inaccurate provision of such Personal Data will not prevent the finalization of the Registration.
With reference to the compulsory or non-compulsory provision of Personal Data and the consequences in the event of failure, partial or inaccurate provision in relation to the purposes referred to in points (b) marketing and (c) profiling, refer to the provisions of point 3 of the privacy policy for the relevant purposes.
(iii) The Personal Data processed by the Company for Registration purposes is for retained for 10 years from (a) Registration in case of inactivity of the user, in fact in case of no access to the private area or purchase; or (b) the last interaction of the user with the Site through login or new purchase. This is without prejudice to any specific legal obligations.
With regard to the retention of Personal Data for the purposes referred to in points (b) marketing and (c) profiling, refer to the provisions of point 5 of the privacy policy for such purposes.
10. In case of joining the ViaMilano Program
If you decide to join the ViaMilano loyalty program ("Program"), the conditions of which are described in the ViaMilano Program Regulations available at this link www.milanomalpensa-airport.com/en/airport/fidelity-card/rules , this privacy policy ( see sub points 1 - 8 above) will apply with the following modifications. Therefore, in case of joining to the Program, as an integration and partial modification of the privacy policy:
(i) The Company will process your Personal Data for the following purposes:
(a) manage your participation in the Program, to award you with prizes and other benefits related to your participation in the Program and to the ownership of the card, as well as to provide you with related services, in accordance with the terms and conditions of the ViaMilano Program Regulations, also by sending you notices of new products, initiatives and promotions reserved to members, which are the subject of the Program ("Primary Purposes of the Program"). The legal basis will be the execution of the contract and of legal obligations;
(b) marketing (see point 3.2). The legal basis will be the consent;
(c) profiling (see point 3.3). The legal basis will be the consent; and
(d) anonymization of Personal Data collected for sub (a), (b) and (c) purposes, for statistical purposes and further analysis. The legal basis will be the legitimate interest of the Company to proceed, after the anonymization of the personal data concerned, to further analysis/statistics in order to improve the provision of its services to users.
We specify that your Personal Data will not be communicated to the Company's Commercial Partners.
(ii) Should you only join the Program (without registering on the Site), the Company will only process the following Personal Data, the provision of which is compulsory for the execution of the Primary Purposes of the Program: name, surname, e-mail. Otherwise, in the event that you register on the Site and join the Program, the Company will collect such Personal Data from the form provided for registration on the Site. Such Personal Data is necessary for the full participation of the member in the Program and for the related initiatives, as well as for the fulfilment of legal obligations, therefore, failure, partial or inaccurate provision of such Personal Data may make it impossible for the Company and third party service providers under the Program to fully implement the Program or to properly carry out the obligations arising therefrom.
With reference to the compulsory or non-compulsory provision of Personal Data and the consequences in the event of failure, partial or incorrect provision of the data, in relation to the purposes referred to in points (b) marketing and (c) profiling, refer to the provisions of point 3 of the privacy policy for the relevant purposes.
(iii) With respect to Personal Data processed by the Company in pursuit of the Primary Purposes of the Program, such Personal Data is processed for the entire duration of the Program. In any case, joining the Program and the consequent and relevant processing of Personal Data is automatically renewed every year, except for requests for erasure from the Program according to the procedure indicated in the Program Regulations. In this case, the Personal Data will be erased, except for those related to the processing necessary for the Company to comply with tax/accounting or legal obligations.
With regard to the retention of Personal Data referred to in points (b) marketing and (c) profiling, refer to the provisions of point 5 of the privacy policy for such purposes.
Attachment A
European regulation on the protection of personal data
Articles 15 to 22
Pursuant to Articles 15 to 22 of European Regulation 2016/679, you have the right to obtain from the data controller the rectification, integration or erasure (so-called right to be forgotten) of your Personal Data; the right to obtain the limitation of the processing and the right to data portability, the right to object to the processing of Personal Data, including profiling and, finally, the right to lodge a complaint with the Guarantor Authority.