pursuant to European Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free transfer of such data and pursuant to the current Italian legislation
Società per azioni Esercizi Aeroportuali S.E.A., having its registered office in Segrate (Milan) – 20090 – at the Milan-Linate Airport, ("Company") in providing the services offered on its websites processes personal data freely provided by the data subjects, pursuant to Articles 4, no. 7) and 24 of EU Regulation 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data ("Regulation"), as well as in accordance with the applicable Italian laws.
Processing of personal data means any operation or set of operations performed with or without the aid of automated processes and applied to personal data or sets of personal data, even if not recorded in a database, such as the collection, recording, organisation, structuring, storage, processing, selection, blocking, adaptation or alteration, retrieval, consultation, use, communication by transmission, dissemination or any other form of making available such data, as well as their comparison or interconnection, limitation, cancellation or destruction.
The Company will therefore proceed, pursuant to Articles 13 and 14 of the Regulation and the applicable Italian legislation, to the relevant processing for the purposes listed below, manually and/or with the support of computerised or telematic means.
1. Purpose and legal basis of processing
The data are acquired and processed in compliance with the rules established by the Regulation and the Italian legislation in force and may be processed for the following purposes with the data subject’s consent, either to implement the contract or because the law requires it:
- provision of the Service (hereinafter “Primary Purposes”)
- marketing (see section 3.2 below)
- user profiling (see section 3.3 below)
- communication/transfer of the data to third parties (see sections 3.2 and 3.3).
2. Communication and dissemination of personal data for the pursuit of the data-processing Primary Purposes.
The data may be disclosed to third parties when disclosure is required by law, including in the context of prevention/suppression of any illegal activity. With reference to article 13(1)(e) of the Regulation and the Italian legislation in force, the data may be communicated exclusively for the pursuit of the Primary Purposes to the Company's employees/collaborators/consultants, as well as to third-party companies on whose collaboration the Company relies in the pursuit of the Primary Purposes, the updated list of which is available at the Company's registered office.
The data will not be disseminated, or rather, the personal data will not be disclosed to the public or, in any case, to an indefinite number of subjects.
3. Mandatory or optional provision of data for the pursuit of the data processing purposes
3.1 Primary Purposes
The provision of data to the Company is mandatory only for data for which there is a regulatory obligation in this regard.
Any refusal to provide such mandatory data may force the Company to obtain them from third parties (where lawfully possible) or lead to failure to provide the Service. Any refusal to provide data for which there is no obligation to provide them under the law, but which are strictly functional to the provision of the Service, does not have any consequences in relation to ongoing relationships between the Company and data subject, except for the likely impossibility of carrying through with the operations related to such data or the impossibility of providing the Service.
3.2 Marketing Purposes
To proceed with the processing of the data for marketing purposes, it is mandatory to obtain a specific, separate, express, documented, prior and entirely optional consent from the data subject.
By giving consent to the processing of personal data for marketing purposes, the data subject specifically acknowledges the promotional, commercial and marketing purposes in the broad sense of the term of the processing (including the consequent management and administrative activities) and expressly authorises such processing, pursuant to art. 6(1)(a) of the Regulation and in compliance with current Italian legislation.
If the data subject does not intend to give consent to the processing of the data for marketing purposes, the consequence will be the impossibility for the Company to proceed with the related processing operations. Failure to give consent to the processing for marketing purposes will not result in any interference with and/or consequences on any other negotiation, contractual or other relationships with the user.
The data subject is free to give consent to the further communication/disclosure to third parties who in turn wish to process his/her data for marketing purposes. If the data subject does not intend to give consent to the communication of his/her data to third parties, the consequence will be that there will be no communication from the Company and the data will be processed only and exclusively by the Company, if the data subject has given consent to the processing of his/her data for marketing purposes.
3.3. User profiling purposes
It is possible that for marketing purposes and to improve the service, the Company may process so-called "profiling" data. For such processing and for the purposes of providing exhaustive information, reference is made to the definition set forth in Article 4(1)(4) of the Regulation: “‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements”.
In order to carry out user profiling, a specific and separate consent must be obtained from the data subject.
If the data subject does not intend to give consent to the processing of his/her data for profiling purposes, the consequence will be the impossibility for the Company to proceed with the relevant processing operations. The data subject is free to give consent to the processing of his/her data for marketing purposes and not to give it for further consent to the processing for profiling purposes and/or communication of the data to third parties who in turn want to proceed to the processing for profiling purposes. If the data subject does not intend to give consent to the processing for purposes of profiling and/or communication to third parties who in turn wish to proceed with the processing for profiling purposes, the consequence will be that there will be no profiling carried out by the Company and no communication to third parties and the data collected will be processed only and exclusively by the Company, if the data subject has given his/her consent to the processing of his/her data for marketing purposes. The data used for profiling purposes and the relative authorised profiles will not be disseminated.
3.4 In any case, even where the data subject has given his consent to authorise the Company to pursue all the purposes mentioned in the above points, he/she will still be free to revoke it at any time.
We specifically and separately inform you, as required by art. 21 of the Regulation, where applicable, that the data subject has the right to object at any time to the processing of personal data concerning him/her carried out for such purposes and that if the data subject objects to the processing, the personal data may no longer be processed for such purposes.
4. Transfer of personal data to countries outside the European Union.
The data collected and processed shall not be transferred to companies or other entities outside the European Community.
5. Data storage times
With reference to the personal data being processed, the same will be stored in accordance with the principle of proportionality and in any case, until the individual processing purposes have been pursued.
6. Data Controller
The identification details of the Company that acts as the Data Controller are provided below:
Società per Azioni Esercizi Aeroportuali S.E.A., having its registered office in Segrate (Milan) – 20090 – c/o Milan Linate Airport.
7. Data protection officer (DPO)
You can contact the Data Protection Officer, also for the exercise of your rights as data subject, as per Articles 15-22 of the Regulation, by sending an e-mail to email@example.com.
8. Rights of the data subject
In relation to the processing of personal data, the data subject is entitled to exercise the rights referred to in Articles 15 to 22 of European Regulation 2016/679, reproduced in reduced form in Attachment A to this statement.
The exercise of the rights is not subject to any formal constraint and is free of charge.
European Regulation on the protection of personal data Articles 15 to 22
Pursuant to Articles 15 to 22 of European Regulation 2016/679, the data subject has the right to obtain from the data controller the rectification, integration or erasure (the so-called “right to be forgotten”) of his or her personal data; the right to obtain the restriction of the processing and the right to data portability; the right to object to the processing of personal data, including profiling; and finally, the right to lodge a complaint with the Data Protection Authority.
1. Cookie disclosure
SEA only uses technical cookies on its websites. Technical cookies are those used merely to “transmit a communication on an electronic communication network or to the extent strictly necessary to the supplier of an information society service, specifically asked by the subscriber or user to supply said service” (see art. 122, paragraph 1, of Legislative Decree no. 196/2003).
They are not used for any further purpose and are normally installed directly by SEA.
The technical cookies used by SEA can be divided into the following subcategories:
• Navigation cookies, by means of which navigation preferences can be saved and the navigation experience of the User can be improved;
• Analytics cookies, by means of which statistical information on how users navigate the web can be gathered. This information shall be processed in an aggregated and anonymous form;
• Functionality cookies, also of third parties, used to activate specific features of this online space and necessary to provide the service or improve it.
These cookies do not require the prior consent of the data subject to be installed and used.
The personal data voluntarily provided by users will not be disclosed and may only be communicated to certain parties, such as third-party companies to which SEA may entrust specific activities and services tied with the management of the website, customer care activities and the sending of promotional and advertising messages.
The data may also be communicated to the competent Public Authorities in fulfilment of legal obligations.
With regard to the processing of the data collected, data subjects will have the right to exercise their rights of access, updating, rectification, integration or cancellation, and all other rights under Art. 7 of Legislative Decree no. 196/2003 by accessing their personal page of the website directly (if registered), sending the request by ordinary mail to the DPO responsible for handling exercise of the right of access to their personal data, identified in the Director of Legal and Corporate Affairs of SEA - Società p.A. Esercizi Aeroportuali – 20090 Segrate, Milan-Linate Airport, or to the e-mail address firstname.lastname@example.org.
Art. 7. Right to access personal data and other rights
1. A data subject shall have the right to obtain confirmation as to whether or not personal data concerning him/her exist, either registered or in the process of being recorded, and communication of said data in intelligible form.
2. A data subject shall have the right to be informed of:
a) the origin of the personal data;
b) the purposes and methods of processing;
c) the logic applied in the event of processing carried out with the help of electronic means;
d) the identification data concerning the data controller, data processors and the designated representative, pursuant to article 5, paragraph 2;
e) the entities or categories of entity to whom or which the personal data may be communicated and who or which may get to know said data in their capacity as designated representative(s) in the State's territory, data processor(s) or person(s) in charge of the processing.
3. A data subject shall have the right to obtain:
a) the updating, rectification or, when interested, integration of the data;
b) the cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed;
c) certification to the effect that the operations as per letters a) and b) have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected.
4. A data subject shall have the right to object, in whole or in part:
a) for legitimate reasons, to the processing of personal data concerning him/her, even if pertinent to the purpose of the collection;
b) to the processing of personal data concerning him/her, where it is carried out for the purpose of sending advertising materials or direct selling or else for the performance of marketing or commercial communication surveys.