in accordance with articles 13 and 14 of the European Regulation 2016/679 on the protection of physical persons with regard to the processing of personal data, as well as the free circulation of such data, and in accordance with current Italian regulations

Esercizi Aeroportuali S.E.A., a joint stock company with registered office in Segrate (Milan) – 20054 – at Milan Linate Airport, (the “Company”), as part of the services offered and the purchases made by users on the website www.clubsea.it (“Service(s)”), processes the personal data freely provided by the persons concerned in accordance with articles 4, no. 7) and 24 of the EU Regulation 2016/679 of 27 April 2016 concerning the protection of physical persons with regard to the processing of personal data (“Regulation”), as well as the current Italian regulations.

Processing personal data refers to any operation or series of operations, carried out with or without the aid of automated processes and applied to personal data or series of personal data, even if not registered on a databank, such as the collection, registration, organisation, structuring, retention, processing, selection, blockage, adaptation or modification, extraction, consultation, use, communication via transmission, dissemination or any other form of making them available, comparison or interconnection, limitation, deletion or destruction.

The Company shall therefore proceed, in accordance with articles 13 or 14 of the Regulation and the current Italian regulations, with the respective processing for the purposes listed below, manually and/or with the aid of computers or data transmission.

1. Purpose and legal basis of the processing

The data are acquired and processed in compliance with the rules set by the Regulation and by the current Italian regulations for the following purposes with the consent of the persons concerned.

• fulfilment of the obligations arising from the Services sales contracts on the website and/or the fulfilment, before the conclusion of the aforementioned contracts, of specific requests by the persons concerned (“Primary Purposes”)
• marketing (see subsequent point 3.2)
• profiling (see subsequent point 3.3)

2. Communication and dissemination of personal data for the pursuit of the Primary Purposes of the processing.

The data may be communicated to third parties when that communication is obligatory by force of law, including the sphere of prevention/suppression of any unlawful activities. With reference to article 13, paragraph 1, letter (e) of the Regulation and the current Italian regulations, the data may be communicated, solely for the pursuit of the Primary Purposes, to employees, collaborators and consultants, as well as to third-party companies, the collaboration of which the Company makes use of in pursuit of the Primary Purposes. The updated list of the external data managers is available at the Company’s registered office. The data shall not be disseminated, that is, personal data shall not be disclosed to the public or, in any event, to an indeterminate number of subjects.

3. Obligatory or voluntary nature of the granting of data for the pursuit of the purposes of the processing

3.1 Primary Purposes

The granting of the data to the Company is obligatory only for data for which there are legal, administrative, tax and accounting obligations connected to purchases made on the website. Any refusal to grant these mandatory data could force the Company to acquire them from third-party sources (where legally possible) or lead to the failure to implement the Service. To complete an online purchase, it will be necessary to provide the data marked with an asterisk on the appropriate registration form. Any refusal, partial or incorrect granting of these data will make it impossible for the Company to perform the services requested or the purchase to be completed. Any refusal, partial or incorrect granting of the data not marked with an asterisk shall not prevent the implementation of the services or purchase.

3.2 Marketing purposes

To proceed with the processing for marketing purposes, it is obligatory to acquire specific, separate, express, documented, prior and entirely optional consent. By granting consent to the processing for marketing purposes, the person concerned specifically acknowledges the promotional, commercial and marketing purposes overall of the processing (including the consequent managerial and administrative activities) and expressly authorises the aforementioned processing in accordance with article 6, paragraph 1, letter (a) of the Regulation and in compliance with the current Italian regulations. Should the person concerned not intend to give consent to the processing for marketing purposes, the consequence will be the impossibility for the Company to proceed with the respective processing. Failure to grant consent to the processing for marketing purposes shall not lead to any interference and/or consequence on any other negotiation or contractual relations, or of another type, existing with the user.

3.3 Profiling

It is possible that, for marketing purposes and the improvement of the Services, the Company may proceed with the processing of so-called “profiling” data. For such processing, and for the purposes of complete information, reference is made to the definition referred to in article 4, paragraph 1, no. (4) of the Regulation: “any form of automated processing of personal data involving the use of such personal data in order to assess certain personal aspects regarding a physical person, in particular for analysing or predicting aspects concerning professional performance, economic situation, health, personal preferences, interests, reliability, conduct, location and movements of the aforementioned physical person". In order to proceed with profiling processing, it is obligatory to acquire specific and separate consent. Should the person concerned not intend to give consent to the processing for profiling purposes, the consequence will be the impossibility for the Company to proceed with the respective processing. The person concerned is free to give consent to the processing for marketing purposes and not to give it for the further consent to the processing for profiling purposes. Should the person concerned not give consent to the processing for profiling purposes, the consequence will be that there will not be any profiling and the data collected shall be processed only and exclusively by the Company, should the person concerned have given the latter consent to processing for marketing purposes. Data subject to profiling processing and the respective authorised profiles shall not be subject to any dissemination.

3.4 In any case, even where the person concerned has given consent to authorise the Company to pursue all the purposes mentioned in the points reported above, they shall in any event be free to revoke it at any time. Notice is specifically and separately given, as required by article 21 of the Regulation, where applicable, that the person concerned has the right to object at any time to the processing of personal data that concern them for these purposes and that, should the person concerned object to the processing, the personal data shall no longer be subject to processing for these purposes.

4. Transfer of personal data to Countries that do not belong to the European Union.

The data collected and processed are not transferred to companies or other entities outside community territory.

5. Data retention times

With reference to personal data processed for the pursuit of the Primary Purposes, they shall be retained in compliance with the principle of proportionality and as long as the purposes of the processing are being pursued, for a period of no longer than 10 years. Moreover, in the case of interaction with the site through login or new purchase, this storage period will start from the latter interaction. It is understood that consent may be freely revoked in the manner set out in paragraph 7.

With reference to the marketing and profiling purposes, for a period of 24 months and 12 months respectively.

6. Data Controller

The identity details of the Company that is the Data Controller are the following: Esercizi Aeroportuali S.E.A., a joint stock company with registered office in Segrate (Milan) - 20054 - at Milan-Linate Airport

7. Data Protection Officer (DPO)

It is possible to contact the Data Protection Officer, including for the exercise of the rights of the person concerned under articles 15-22 of the Regulation, by sending an e-mail to the address privacy@seamilano.eu.

8. Rights of the person concerned

With regard to the data processing, the person concerned may exercise the rights referred to in articles 15 to 22 of the European Regulation 2016/679, reproduced in limited form in attachment A to this information briefing. The exercise of rights is not subject to any form of constraint and is free.

Attachment A
European Regulation on matters of the protection of personal data
Articles 15 to 22

In accordance with articles 15 to 22 of the European Regulation 2016/679, the person concerned has the right to obtain from the Data Controller the correction, supplementation or deletion (the so-called right to be forgotten) of their personal data; the right to obtain the limitation of the processing and the right to the portability of the data, the right of objection to the processing of personal data, including profiling, and finally, the right to complain to the Supervisory Authority.