In accordance with the effort and care that RCS Sport S.p.A., RCS MediaGroup S.p.A. and SSD RCS Active Team a.r.l. (hereafter the Controllers) dedicate to the safeguard of personal data, we hereby inform you about the procedures, purposes and scope of communication and disclosure of your personal data and about your rights, in accordance with Article 13 of the GDPR.
1. CATEGORIES OF PERSONAL DATA PROCESSED BY THE DATA CONTROLLER
To offer you the services provided by their own Websites, the Controllers, in their capacity as Data Controllers, shall process some personal data necessary for the performance of the services.
These data can be provided implicitly by the instruments you use to access and use the services or they can be provided explicitly by you.
The controllers may process the following categories of personal data of the users:
- technical browsing data pertaining to the IP address, to the identifying codes of the devices employed by the user to utilise the website or the services, to the characteristics of the browser and to the access times;
- browsing data directed at profiling provided indirectly through utilisation of the service and obtained and analysed with the user’s consent;
- common identifying data provided by the user (e.g. name, surname, email, telephone number, etc.) for the utilization of the products and of the services;
2. PURPOSES AND LEGAL BASES OF THE PROCESSING
The data and the cookies received from you shall be processed by SSD Active Team a.r.l exclusively with methods and procedures necessary to allow you to participate in sports initiatives and receive communications relating thereto and by RCS Sport S.p.A. and RCS Mediagroup S.p.A. to send you newsletters.
Only with your express consent may your data be used to carry out statistical analyses, market surveys, promotional activities through social media and to send commercial information about the products and about the promotional initiatives of the Controllers. (Direct marketing purposes)
Also with your consent, the data may be used for purposes of profiling carried out automatically gathering information about the browsing you carry out when accessing and utilising the services and, by means of statistic correlation algorithm, they tie them to the same information coming from other users to identify the common traits and group together similar ones within interest classes. By assigning your browser to an interest class, your systems will necessarily be able to offer you contents that are closer to your tastes and will present advertisements that better meet your needs and better address the interests of the advertisers, reducing the level of interference with utilisation.
On the date you read this Disclosure, the Controllers use the profiling data to aggregate marketing profiles, to manage relations with advertisers and improve their campaigns, to infer patterns of utilisation of our products and services and to assist sales departments in the development of digital strategies (Profiling purposes)
Lastly, with your explicit consent, your data may be provided to other Companies operating in the publishing, financial, automotive insurance, energy, basic commodities, humanitarian and charitable organisations which may contact you as Controllers of autonomous initiatives – the updated list is at your disposal and it may be requested from the Data Processor at the address provided below – for statistical analyses, market surveys and transmission of commercial information about the products and promotional initiatives. (Third party marketing purposes).
Communications for market surveys or commercial information about the products and the promotional initiatives may be carried out by postal mailing, email, telemarketing, SMS, MMS.
We hereby inform you that some activities may be carried out through suppliers, specifically appointed as Data Processors, who may reside outside the European Union.
The legal bases of the purposes described above are the execution of your request as data subject and the consent you have expressed.
4. DISCLOSURE, COMMUNICATION AND PARTIES ACCESSING THE DATA
Your personal data shall not be disclosed, but they may be communicated when necessary for the performance of the service to third parties (as third party technical service providers, postal couriers, hosting providers, IT companies), appointed, if necessary, as Data Processors by the Controllers for the technical or organisational tasks that are instrumental for the performance of the services.
Access to the data is also allowed to categories of the Controllers appointees involved in the organisation for data processing (administrative, sales, marketing, customer service personnel, system administrators).
The updated list of Data processors may always be requested from the Data Controllers.
We shall retain the right to communicate the data to third parties if you have given your specific, optional consent.
5. TRANSFER OF DATA ABROAD
Your personal data shall be processed by the Data Controllers within the territory of the European Union.
If technical and/or operational issues make it necessary to rely on parties located outside the European Union, or if it becomes necessary to transfer some of the data gathered to technical systems and services managed in clouds and located outside the area of the European Union, the processing activities shall be regulated in accordance with the provisions of Chapter V of the Regulation and authorised on the basis of specific decisions by the European Union. Hence, all precautions necessary to assure the most comprehensive protection of personal data shall be adopted, basing said transfer: a) on decision of adequacy of the recipient third party countries expressed by the European Commission; b) on adequate guarantees expressed by the recipient third party in accordance with Article 46 of the Regulation; c) on the adoption of Corporate binding rules.
6. DURATION OF THE PROCESSING AND RETENTION OF PERSONAL DATA
In accordance with Article 5.1 e) of the GDPR, the Controllers shall process your data “for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject”.
The data provided by you shall be processed throughout the time of execution of the required services and shall be stored for the 12 following months for the completion of the administrative activities, as well as for the time necessary to fulfil legal obligations.
If you have authorised the profiling treatment, the anonymous data observed from time to time shall be erased 12 months after processing starts.
7. RIGHTS OF THE DATA SUBJECT
The Controllers hereby guarantee to you that you may exercise, at any time, the rights specified by Article 12 of the GDPR. In particular, you have the right:
- to know whether the Controllers hold and/or process personal data about you and to access them in full, also obtaining copies thereof (Article 15 Right of access by the data subject),
- to the rectification of inaccurate personal data or to the completion of incomplete personal data (Article 16 Right to rectification);
- to the erasure of personal data in the Controllers’ possession if one of the reasons specified by the GDPR applies (Right to erasure, Article 17);
- to ask the Controllers to limit processing only to some personal data, if one of the reasons specified by the Regulation (Article 18 Right to restriction of processing);
- to request and receive all your personal data processed by the Controllers, in a structured, commonly used and machine-readable format or to request transmission to another controller without hindrance (Article 20, Right to data portability);
- to object to all or part of the data processing for the purposes of transmitting advertising material and market surveys (“Consent”) (Article 21 Right to object)
- to object to all or part of the data processing in automatic or semiautomatic mode for profiling purposes (“Consent”)
These rights may be exercised by communication to the Data Controllers/Data Protection Officer whose addresses are indicated in the dedicated section of this disclosure.
Moreover, you always have the right to file a complaint with the Italian Authority for the Protection of Personal Data, at the address garante@gpdp.it or through the Website http://www.gpdp.it.
8. DATA PROTECTION OFFICER
The Controllers have identified and appointed a Data Protection Officer, in accordance with Article 37 of the GDPR, and has established an office for the management of requests pertaining to the privacy of their users and customers.
To exercise your guaranteed rights, you may contact us at the following addresses:
- Office of the Data Protection Officer and/or RCS Sport S.p.A. and/or RCS Mediagroup S.p.A. and/or SSD RCS Active Team a.r.l.- Via A. Rizzoli 8, 20132 Milan, Italy
- Privacy Data Protection Officer and/or RCS Sport S.p.A. and/or RCS Mediagroup S.p.A. and/or SSD RCS Active Team a.r.l..- Via A. Rizzoli 8, 20132 Milan, Italy
- or by sending an email to the address:privacy@rcsdigital.it
9. LATEST REVISION
This Privacy Disclosure is revised as at 15 May 2018
Previous version