INFORMATION NOTICE

pursuant to European Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as applicable Italian legislation

Società per azioni Esercizi Aeroportuali S.E.A., with registered office in Segrate (Milan) – 20054 – at Milan-Linate Airport (“Company”) processes personal data freely provided by data subjects in the course of providing services on its websites, pursuant to Articles 4, no. 7) and 24 of EU Regulation 2016/679 of 27 April 2016 concerning the protection of natural persons with regard to the processing of personal data (“Regulation”), and in compliance with applicable Italian legislation.

Personal data processing refers to any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, whether or not recorded in a database, such as collection, recording, organization, structuring, storage, processing, selection, blocking, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, comparison or interconnection, restriction, erasure or destruction.

The Company will therefore process personal data pursuant to Articles 13 and 14 of the Regulation and applicable Italian law, for the purposes set out below, either manually or using IT or telematic tools.

1. Purposes and legal basis for processing

Data is acquired and processed in compliance with the rules set out in the Regulation and applicable Italian legislation and may be processed for the following purposes, based on the data subject’s consent, to perform a contract, or as required by law:

-   provision of the Service (hereinafter “Primary Purposes”)
-   marketing (see point 3.2 below)
-   profiling (see point 3.3 below)
-   communication/disclosure of data to third parties (see points 3.2 and 3.3 below)

2. Communication and disclosure of personal data for the pursuit of the Primary Purposes of processing

Data may be disclosed to third parties when required by law, including for the prevention/repression of illegal activities. In accordance with Article 13, paragraph 1, letter (e) of the Regulation and Italian legislation, data may be disclosed exclusively for the pursuit of Primary Purposes to employees/associates/consultants of the Company, and to third-party companies whose cooperation the Company uses for the pursuit of Primary Purposes. An updated list of such companies is available at the Company's registered office.

Data will not be disseminated, i.e., personal data will not be made public or disclosed to an indefinite number of recipients.

3. Mandatory or optional nature of data provision for the purposes of processing

3.1 Primary Purposes

Providing data to the Company is mandatory only for those data required by law.

Refusal to provide such mandatory data may force the Company to obtain them from third parties (where legally permitted), or may result in the inability to provide the Service. Refusal to provide data that is not legally required but necessary for the performance of the Service will not affect ongoing relationships, except that it may make it impossible to proceed with operations related to such data or to provide the Service.

3.2 Marketing Purposes

To process data for marketing purposes, specific, separate, explicit, documented, prior, and entirely optional consent is required.

By providing consent to processing for marketing purposes, the data subject expressly acknowledges the promotional, commercial, and general marketing purposes of the processing (including related administrative and management activities) and explicitly authorizes such processing pursuant to Art. 6, paragraph 1, letter (a) of the Regulation and in accordance with Italian law.

If the data subject does not provide consent for processing for marketing purposes, the Company will not carry out such processing. Refusal to provide consent for marketing purposes will have no impact on any other ongoing business, contractual or other relationships with the user.

The data subject is free to consent to further communication/disclosure to third parties wishing to carry out processing for marketing purposes. If the data subject does not consent to such third-party disclosure, the Company will not communicate any data, and data will be processed solely by the Company, provided that consent has been given for marketing purposes.

3.3 Profiling Purposes

For marketing and service improvement purposes, the Company may process so-called “profiling” data. For these purposes, reference is made to the definition in Art. 4, paragraph 1, no. (4) of the Regulation: “any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.”

Specific and separate consent is required for profiling activities.

If the data subject does not provide consent for profiling purposes, the Company will not carry out such processing. The data subject may give consent for marketing purposes without consenting to profiling and/or third-party disclosures for profiling. If the data subject refuses consent for profiling and/or third-party disclosure for profiling, the Company will not conduct profiling or third-party communication, and collected data will be processed only by the Company, provided that marketing consent was given. Profiling data and resulting profiles will not be disseminated.

In any case, even where consent has been given for all of the above-mentioned purposes, the data subject remains free to revoke it at any time.

The data subject is specifically and separately informed, as required by Art. 21 of the Regulation, where applicable, that they have the right to object at any time to the processing of their personal data for such purposes, and if they do so, such processing shall no longer occur.

4. Transfer of personal data to non-EU countries

The data collected and processed is not transferred to companies or other entities outside the European Union.

5. Data retention period

Personal data processed will be retained in accordance with the principle of proportionality and in any case until the individual processing purposes have been fulfilled.

6. Data Controller

The identifying details of the data controller are as follows:

Società per azioni Esercizi Aeroportuali S.E.A., with registered office in Segrate (Milan) – 20054 – at Milan-Linate Airport.

7. Data Protection Officer (DPO)

The Data Protection Officer can be contacted, including for exercising data subjects' rights under Articles 15-22 of the Regulation, by email at privacy@seamilano.eu 

8. Data subject rights

With regard to data processing, the data subject may exercise the rights set out in Articles 15 to 22 of European Regulation 2016/679, summarized in Annex A of this notice.

The exercise of these rights is not subject to any formal constraint and is free of charge.

Annex A

European Regulation on the protection of personal data Articles 15 to 22

Pursuant to Articles 15 to 22 of European Regulation 2016/679, the data subject has the right to obtain from the data controller the rectification, integration, or erasure (so-called right to be forgotten) of their personal data; the right to restrict processing; the right to data portability; the right to object to the processing of personal data, including profiling; and finally, the right to lodge a complaint with the Supervisory Authority.

Right of access to personal data and other rights

1. The data subject has the right to obtain confirmation as to whether or not personal data concerning them exists, even if not yet recorded, and to receive such data in an intelligible form.

2. The data subject has the right to be informed of:

a) the source of the personal data;
b) the purposes and methods of processing;
c) the logic applied in case of processing carried out with the aid of electronic tools;
d) the identification details of the data controller, data processors, and the designated representative pursuant to Article 5, paragraph 2;
e) the entities or categories of entities to whom the personal data may be disclosed or who may become aware of it as designated representatives in the territory of the State, processors, or persons in charge of the processing.

3. The data subject has the right to obtain:

a) the updating, rectification or, where interested, integration of the data;
b) the erasure, anonymization or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which it was collected or subsequently processed;
c) certification that the operations under letters a) and b) have been notified, also regarding their content, to the entities to whom the data was disclosed or disseminated, unless this proves impossible or involves a disproportionate effort compared to the protected right.

4. The data subject has the right to object, in whole or in part:

a) for legitimate reasons to the processing of personal data concerning them, even if relevant to the purpose of the collection;
b) to the processing of personal data concerning them for the purpose of sending advertising materials or direct selling or for carrying out market research or commercial communication.