Privacy Policy Notice

Information provided pursuant to Art. 13 of EU Reg. 2016/679 (hereinafter GDPR) and Legislative Decree 196/2003 “Personal Data Protection Code”, as amended by Legislative Decree 101/18 (hereinafter the Code)

A) GENERAL INFORMATION

Data subjects are informed of the following general points, which apply to all areas of processing:

  • all data of the persons with whom we deal are processed lawfully, fairly and transparently, in compliance with the general principles set out in Art. 5 of the GDPR;
  • specific security measures are observed to prevent data loss, unlawful or incorrect use and unauthorised access, pursuant to Art. 32 of the GDPR.

References and rights of data subjects

  • the Data Controller is the undersigned Organisation (Piacenza Calcio 1919 SSD a RL), in the person of its pro tempore legal representative. In order to ensure adequate support for data subjects, the Controller has appointed a DPO, who may be contacted (contact details: Galli Data Service Srl – 0523-7497066 – dpo@gallidataservice.com ) to exercise all the rights provided for by Arts. 15-21 of the GDPR (right of access, rectification, erasure, restriction, portability and objection), as well as to withdraw consent previously given; if their requests receive no reply, data subjects may lodge a complaint with the supervisory authority for the protection of personal data (GDPR – Art. 13, paragraph 2, letter d).

B) PROCESSING OF DATA RELATED TO THE OPERATION OF THIS WEBSITE

 Browsing data

The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected in order to be associated with identified data subjects, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users connecting to the site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and computer environment.

Purpose and legal basis of the processing
(GDPR – Art. 13, paragraph 1, letter c)
These data are used solely to obtain statistical information on the use of the site and to check that it is working correctly. The data could also be used to establish liability in the event of hypothetical computer crimes against the site (legitimate interests of the controller).

Scope of communication
(GDPR – Art. 13, paragraph 1, letters e, f)
The data may be processed exclusively by internal staff, duly authorised and instructed in the processing (GDPR – Art. 29), or by any persons responsible for maintaining the web platform (in which case appointed as external processors), and will not be disclosed to other parties, disseminated or transferred to non-EU countries. Only in the event of an investigation may they be made available to the competent authorities.

Data retention period
(GDPR – Art. 13, paragraph 2, letter a)
The data are normally stored for short periods of time, except for any extensions connected with investigative activities.

Provision of data
(GDPR – Art. 13, paragraph 2, letter f)
The data are not provided by the data subject but are acquired automatically by the site’s technological systems.

Specific services

Some sections of the site refer to specific services that are not managed directly through the site’s functionalities (e.g. schools project; information for disabled people); for further information, please see section C) of this notice.

Data provided voluntarily by the user (e.g. by using the email addresses in the contacts section)
The optional, explicit and voluntary sending of emails and/or ordinary post to the addresses given on this site, for example in the contacts section, entails the subsequent acquisition of the sender’s address, which is necessary to reply to requests, as well as of any other personal data included in the message. Should the sender submit their CV to apply for a job, they remain solely responsible for the relevance and accuracy of the data sent. Please note that any CVs not accompanied by authorisation to process the data will be deleted immediately.

 C) PROCESSING OF DATA RELATED TO RELATIONSHIPS ESTABLISHED WITH DATA SUBJECTS

C1) Customers and suppliers
Customers means: holders of stadium entry tickets (single tickets, season tickets), sponsors, other football clubs, and media holding radio and television rights;
Suppliers means: suppliers of goods or services and consultancy firms.

The organisation processes personal identification data of customers/suppliers (for example, first name, surname, company name, personal/tax details, address, telephone number, e-mail, bank and payment details) and of their operational contacts (first name, surname and contact details), obtained and used in the course of providing the services supplied.

Purposes and legal basis of processing
The data is processed in order to:

  • Sell tickets and season tickets to spectators (via a third-party software platform);
  • enter into contractual/professional relationships;
  • fulfil pre-contractual, contractual and tax obligations arising from existing relationships, and manage the necessary related communications;
  • fulfil obligations laid down by law, by a regulation, by EU legislation or by an order of the Authority;
  • pursue a legitimate interest and a right of the Controller (for example: the right of defence in legal proceedings, the protection of creditor positions; ordinary internal operational, management and accounting requirements).

Failure to provide the above data will make it impossible to establish a relationship with the Controller. The above purposes constitute, pursuant to Art. 6, points b, c, f, suitable legal bases for the lawfulness of processing. Should it be intended to carry out processing for different purposes, specific consent will be requested from the data subjects.

C2) Other data subjects: employees and collaborators, athletes, recipients of special projects, persons requesting accreditation and, more generally, all other stakeholders receive specific forms containing specific privacy notices with requests for consent.

Methods of processing
Personal data is processed by means of the operations listed in Art. 4 no. 2) GDPR, namely: collection, recording, organisation, storage, consultation, processing, modification, selection, retrieval, comparison, use, interconnection, restriction, communication, erasure and destruction of data. Personal data is processed both on paper and electronically and/or by automated means. The Controller will process personal data for the time necessary to fulfil the purposes for which it was collected and the related legal obligations.

Scope of processing
The data is processed by internal persons duly authorised and instructed pursuant to Art. 29 of the GDPR. It is also possible to request the scope of communication of personal data, obtaining precise information on any external parties acting as Processors or independent Controllers (Vivaticket, an independent controller that provides the software platform for the resale of tickets; consultants; technicians; banks; carriers; etc.).

D) POLICY UPDATES
Please note that this notice may be subject to periodic review, also in relation to the relevant legislation and case law. In the event of significant changes, appropriate notice will be given on the website home page for a reasonable period. Data subjects are in any case invited to consult this policy periodically.