WEBSITE PRIVACY NOTICE

M-I Stadio S.r.l., with registered office in Piazzale Angelo Moratti snc, 20151 Milan (MI), (“M-I Stadio” or the “Company”), is committed to protecting the online privacy of users of its website: https://www.sansirostadium.com/.

This Privacy Notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”), to inform you about how your personal data (“Personal Data”) will be processed when using M-I Stadio’s website (the “Website”), whether by simply browsing or by using specific services made available through the Website.

In general, any Personal Data that you provide to M-I Stadio through the Website, or that is otherwise collected via the Website in the context of the services offered (the “Services”), as further described below, will be processed in accordance with the internationally recognized principles of lawfulness, fairness, transparency, purpose limitation, storage limitation, data minimization, accuracy, integrity, and confidentiality.

Identity and Contact Details of the Controller and the Data Protection Officer (DPO)

M-I Stadio, as identified above, acts as the Data Controller (“Controller”) with regard to the processing of your Personal Data carried out through the Website.

You may contact M-I Stadio:

• by ordinary mail, at the registered office indicated above;
• by e-mail, at: privacy@sansirostadium.com.

M-I Stadio, in its capacity as Controller, has appointed a Data Protection Officer (“DPO”), available for any inquiries concerning the processing of your Personal Data and the exercise of your rights as a data subject. The DPO can be contacted at: dpo@sansirostadium.com.

Categories and Sources of Personal Data Processed

In the context of your use of the Website (the “Processing”), M-I Stadio may process your Personal Data, which – depending on how you use the Services – may include identifiers such as your name, personal details, and/or contact information.

Your Personal Data may be collected either because you voluntarily provide it (e.g. by submitting a request), or automatically in the course of your use of the Website. The categories of Personal Data processed are as follows:

a. Browsing Data

The computer systems and software procedures used to operate the Website acquire certain Personal Data whose transmission is implicit in the use of Internet communication protocols. Such information, by its nature, could – through association and processing with data held by third parties – allow the identification of users.
This category of data includes IP addresses or domain names of the computers used to connect to the Website, the Uniform Resource Identifier (URI) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the response file, the numerical code indicating the status of the server response (successful, error, etc.), and other parameters related to the user’s operating system and IT environment.

These data are used solely for the purpose of obtaining statistical information on Website usage, verifying correct functioning, monitoring its proper functioning and correct navigation through the use of technical cookies and identifying anomalies and/or abuses, and are deleted immediately after processing. Except in cases where the data may be used to ascertain liability in the event of cybercrimes against the Website or third parties, such data do not persist for longer than strictly necessary and are periodically deleted.

b. Data Voluntarily Provided by the User and Data Concerning Third Parties

Unless otherwise specified in separate privacy notices provided for particular Services, this Privacy Notice also applies to Personal Data voluntarily entered by you into forms available on the Website, for example, the information request form in the “Museum&Tour” section or in the “Hold an event” section. These forms may require you to provide information such as your name, surname, e-mail address, and telephone number, together with the content of your request, which may also contain additional Personal Data.

You are kindly invited to include only Personal Data that are strictly necessary for the management of your request, and to avoid providing information that is irrelevant and/or that may fall under the special categories of data as defined in Article 9 GDPR (e.g. data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health-related data, or data concerning sex life or sexual orientation).

c. Cookies

Cookies are text files that websites visited by a user send to and store on the user’s computer or mobile device, to be retransmitted to the same websites during subsequent visits. Cookies enable a website to remember the user’s actions and preferences (such as login data, chosen language, font size, display settings, etc.), so that they do not have to be entered again when navigating between pages or returning to the website.

Cookies are therefore used to perform IT authentications, session monitoring, and to store information regarding the activities of users accessing a website. Cookies may also contain a unique identification code that allows tracking of user navigation within the Website for statistical purposes. Some operations could not be performed without the use of cookies, which are therefore technically necessary for the functioning of the Website.

No use is made of cookies for the profiling of data subjects, nor are any other tracking methods employed. Session cookies (non-persistent) are instead used, strictly limited to what is necessary to ensure the proper functioning of the Website and to allow safe and efficient navigation.

Purposes of Processing

M-I Stadio will process your Personal Data collected through the Website for the following purposes:

• Provision of the Services: to enable navigation of the Website, interaction with its contents, and the use of the Services provided by M-I Stadio, including the management of Website security.
• Handling of Requests: to manage and respond to specific requests submitted to M-I Stadio, such as requests sent via the forms in the “Museum&Tour” and “Hold an event” sections, or via the contact details provided in the “Useful Information” section of the Website.
• Compliance: to comply with any legal obligations to which the Controller is subject, pursuant to applicable laws, regulations, or EU legislation, or to respond to requests from public authorities.
• Abuse/Fraud: to detect, prevent, mitigate, and ascertain fraudulent or unlawful activities in connection with the services provided via the Website, as well as to protect the interests of M-I Stadio in judicial or extrajudicial proceedings.

Specific security measures are implemented to prevent data loss, unlawful or improper use, and unauthorized access.

Legal Bases for Processing

The legal bases relied upon by M-I Stadio to process your Personal Data for the purposes identified above are the following:

• Provision of the Services: the processing is necessary for the performance of a contract to which you are a party or for the execution of pre-contractual measures taken at your request, pursuant to Article 6(1)(b) GDPR. Although the provision of Personal Data for this purpose is voluntary, failure to provide it would make it impossible to activate the requested services.
• Handling of Requests: the processing is necessary for the performance of a contract to which you are a party or for the execution of pre-contractual measures taken at your request, pursuant to Article 6(1)(b) GDPR. Although the provision of Personal Data for this purpose is voluntary, failure to provide it would make it impossible to manage your requests.
• Compliance: the processing is necessary to comply with legal obligations to which M-I Stadio is subject, pursuant to Article 6(1)(c) GDPR. When you provide Personal Data to M-I Stadio, such data must be processed in accordance with applicable law, which may involve their storage and communication to authorities for accounting, tax, or other legal obligations.
• Abuse/Fraud: the processing is necessary for the purposes of the legitimate interests pursued by M-I Stadio, pursuant to Article 6(1)(f) GDPR, consisting in the prevention and detection of fraudulent or abusive activities in connection with the Website, as well as the protection of its rights and interests in judicial or extrajudicial proceedings.

Categories of Recipients of Personal Data

Your Personal Data may be shared with the following categories of recipients (the “Recipients”):

• parties acting as data processors, such as: individuals, companies, or professional firms providing assistance and consultancy to M-I Stadio in accounting, administrative, legal, tax, financial, or debt collection matters relating to the Services; hosting providers; parties entrusted with technical maintenance activities;
• individuals authorized by M-I Stadio to process Personal Data, who are subject to confidentiality obligations or a suitable legal duty of confidentiality (e.g. personnel involved in the management of the Website);
• entities, bodies, or authorities to which it is mandatory to communicate your Personal Data for purposes of Compliance, Abuse or Fraud prevention, or pursuant to orders issued by authorities.

Transfer of Personal Data

With regard to the possible transfer of Personal Data to third countries, M-I Stadio ensures that such processing will take place in compliance with applicable data protection law.

Transfers will be carried out by adopting appropriate safeguards, such as adequacy decisions, Standard Contractual Clauses approved by the European Commission, or other safeguards considered adequate.

Further information is available upon request by writing to the Controller at: privacy@sansirostadium.com.

Retention Period of Personal Data

Personal Data processed for the Provision of the Services and Handling of Requests will be retained by M-I Stadio only for as long as strictly necessary to achieve those purposes. Since such Personal Data are processed to provide you with the Services, M-I Stadio may retain them for a longer period where necessary to protect its interests from potential claims relating to the Services.

Personal Data processed for Compliance will be retained by M-I Stadio for the period required by specific legal obligations or applicable legislation.

Personal Data processed for the prevention of Abuse/Fraud will be retained by M-I Stadio for as long as strictly necessary to achieve that purpose, and in any case until such time as M-I Stadio is required to retain them to protect itself in judicial or extrajudicial proceedings or to disclose them to the competent authorities.

Data Subject Rights

As a data subject, you may, at any time and where the relevant legal requirements are met, exercise the following rights against M-I Stadio:

• Access: obtain access to your Personal Data (and/or a copy thereof) and further information about the ongoing processing;
• Rectification: request the rectification or updating of your Personal Data if incomplete or outdated;
• Erasure: request the erasure of your Personal Data from M-I Stadio’s databases where you consider the processing unnecessary or unlawful;
• Restriction: request the restriction of processing of your Personal Data where you believe such data to be inaccurate, unnecessary, unlawfully processed, or where you have objected to their processing;
• Portability: exercise your right to data portability, i.e. to obtain in a structured, commonly used, and machine-readable format a copy of the Personal Data provided to M-I Stadio concerning you, or to request their transmission to another controller;
• Objection: object to the processing of your Personal Data based on grounds relating to your particular situation, which you believe should prevent M-I Stadio from processing your data;
• Withdrawal of Consent: withdraw your consent to the processing of your Personal Data, where consent has been given, without prejudice to the lawfulness of processing based on consent before its withdrawal.

You may exercise the above rights by writing to M-I Stadio at: privacy@sansirostadium.com.

In any case, you always have the right to lodge a complaint with the competent Supervisory Authority or appeal to the Judicial Authority if you believe that the processing of your Personal Data violates applicable law.