IN ACCORDANCE WITH ARTICLES 13 AND 14 OF THE EUROPEAN REGULATION 2016/679 ON THE PROTECTION OF PHYSICAL PERSONS WITH REGARD TO THE PROCESSING OF PERSONAL DATA, AS WELL AS THE FREE CIRCULATION OF SUCH DATA, AND IN ACCORDANCE WITH CURRENT ITALIAN REGULATIONS.
Esercizi Aeroportuali S.E.A., a joint stock company with registered office in Segrate (Milan) – 20090 – at Milan Linate Airport, (the “Company”), as part of the services offered and the purchases made by users on the website www.viamilanoshop.it (“Service(s)”) processes the personal data freely provided by the persons concerned in accordance with articles 4, no. 7) and 24 of the EU Regulations 2016/679 of 27 April 2016 concerning the protection of physical persons with regard to the processing of the personal data (“Regulation”), as well as the current Italian regulations.
Processing personal data refers to any operation or series of operations, carried out with or without the aid of automated processes and applied to personal data or series of personal data, even if not registered on a databank, such as the collection, registration, organisation, structuring, retention, processing, selection, blockage, adaptation or modification, extraction, consultation, use, communication via transmission, dissemination or any other form of making them available, comparison or interconnection, limitation, deletion or destruction.
The Company shall therefore proceed, in accordance with articles 13 or 14 of the Regulation and the current Italian regulations, with the respective processing for the purposes listed below, manually and/or with the aid of computers or data transmission.
1. Purpose and legal basis of the processing
The data are acquired and processed in accordance with the provisions set out within the relevant Italian regulation and legislation for the following purposes:
(i) fulfillment of the obligations arising from the agreements for the Services and/or the fulfilling of specific requests by the owners (“Primary Purposes”)
(ii) marketing (see next section 3.2)
(iii) profiling (see next section 3.3)
(iv) transfer of the data to third parties (see next sections 3.2 and 3.3).
With specific reference to points (ii), (iii) and (iv) above, the legal fundament of the processing of the data is the consent by the owner.
2. Communication and dissemination of personal data for the pursuit of the Primary Purposes of the processing
The data may be communicated to third parties when that communication is obligatory by force of law, including in the sphere of prevention/suppression of any unlawful activities. With reference to article 13, paragraph 1, letter (e) of the Regulation and the current Italian regulations, the data may be communicated, solely for the pursuit of the Primary Purposes, to employees/collaborators/consultants, as well as to third-party companies, the collaboration of which the Company makes use of in the pursuit of the Primary Purposes. The updated list of the external data managers is available at the Company’s registered office.
The data shall not be disseminated, that is, personal data shall not be disclosed to the public or, in any event, to an indeterminate number of subjects.
3. Obligatory or voluntary basis of the granting of data for the pursuit of the purposes of the processing
3.1 Primary Purposes
The granting of the data to the Company is obligatory only for data for which there are legal obligations.
Any refusal to grant these obligatory data could force the Company to acquire them from third-party sources (where legally possible) or lead to the failure to implement the Service.
3.2 Marketing purposes
To proceed with the processing for marketing purposes, it is obligatory to acquire specific, separate, express, documented, prior and entirely optional consent.
By granting consent to the processing for marketing purposes, the person concerned specifically acknowledges the promotional, commercial and marketing purposes overall of the processing (including the consequent managerial and administrative activities) and expressly authorises the aforementioned processing in accordance with article 6, paragraph 1, letter (a) of the Regulation and in compliance with the current Italian regulations.
Should the person concerned not intend to give consent to the processing for marketing purposes, the consequence will be the impossibility for the Company to proceed with the respective processing. Failure to grant consent to the processing for marketing purposes shall not lead to any interference and/or consequence on any other negotiation or contractual relations, or of any other type, existing with the user.
The persons concerned is free to give consent to the additional communication to third parties who, in turn, wish to proceed with the processing for marketing purposes. Should the person concerned not give consent to the communication of their data to third parties, the consequence shall be that there shall not be any communication by the Company and the data shall be processed only and exclusively by the Company, should the person concerned have given the latter consent to processing for marketing purposes.
It is possible that, for marketing purposes and the improvement of the Services, the Company may proceed with the processing of so-called “profiling” data. For such processing, and for the purposes of complete information, reference is made to the definition referred to in article 4, paragraph 1, no. (4) of the Regulation: “any form of automated processing of personal data involving the use of such personal data in order to assess certain personal aspects regarding a physical person, in particular for analysing or predicting aspects concerning professional performance, economic situation, health, personal preferences, interests, reliability, conduct, location and movements of the aforementioned physical person".
In order to proceed with profiling processing, it is obligatory to acquire specific and separate consent.
Should the person concerned not intend to give consent to the processing for profiling purposes, the consequence will be the impossibility for the Company to proceed with the respective processing. The person concerned is free to give consent to the processing for marketing purposes and not to give it for the further consent to the processing for profiling purposes and/or communication to third parties that, in turn, wish to proceed with the processing for profiling purposes. Should the person concerned not give consent to the processing for profiling purposes and/or communication to third parties that, in turn, wish to proceed with the processing for profiling purposes, the consequence shall be that there shall not be any profiling and other communication to third parties by the Company and the data collected shall be processed only and exclusively by the Company, should the person concerned have given the latter consent to processing for marketing purposes. Data subject to profiling processing and the respective authorised profiles shall not be subject to any dissemination.
3.4 In any case, even where the person concerned has given consent to authorise the Company to pursue all the purposes mentioned in the points reported above, they shall in any event be free to revoke it at any time.
Notice is specifically and separately given, as required by article 21 of the Regulation, where applicable, that the person concerned has the right to object at any time to the processing of personal data that concern them for these purposes and that, should the person concerned object to the processing, the personal data shall no longer be subject to processing for these purposes.
4. Transfer of personal data to Countries that do not belong to the European Union
The data collected and processed are not transferred to companies or other entities outside community territory.
5. Data retention times
With reference to personal data processed for the pursuit of the Primary Purposes, they shall be retained in compliance with the principle of proportionality and as long as the purposes of the processing are being pursued, for a period of no longer than 10 years. With reference to the marketing and profiling purposes, for a period of 24 months and 12 months respectively.
6. Data Controller
The identity details of the Company that is the Data Controller are the following:
Esercizi Aeroportuali S.E.A., a joint stock company with registered office in Segrate (Milan) - 20090 - at Milan-Linate Airport.
7. Data Protection Officer (DPO)
It is possible to contact the Data Protection Officer, including for the exercise of the rights of the person concerned under articles 15-22 of the Regulation, by sending an email to the address firstname.lastname@example.org
8. Rights of the person concerned
With regard to the data processing, the person concerned may exercise the rights referred to in articles 15 to 22 of the European Regulation 2016/679, reproduced in limited form in attachment A to this information briefing.
The exercise of rights is not subject to any form of constraint and is free.
European Regulation on matters of the protection of personal data
Articles 15 to 22
In accordance with articles 15 to 22 of the European Regulation 2016/679, the person concerned has the right to obtain from the Data Controller the correction, supplementation or deletion (the so-called right to be forgotten) of their personal data; the right to obtain the limitation of the processing and the right to the portability of the data, the right of objection to the processing of personal data, including profiling, and finally, the right to complain to the Supervisory Authority.