In accordance with Articles 13 and 14 of European Regulation No. 2016/679,
Please be informed that in order to provide stadium access accreditation to 100% disabled persons, Società Sportiva Calcio Napoli, Via del Maio di Porto N.9 – 80133 – Naples must obtain and process data regarding you that is categorised as “personal” and “sensitive” by Regulation EU 679/2016. This regulation states that any party processing “personal” and “sensitive” data must notify the interested party, whether this is a natural or legal person, regarding what data is being processed and regarding the nature of the data processing, which must always take place properly, lawfully and transparently, without prejudice to your privacy and other rights. In accordance with Regulation EU 2016/679, we provide you with the following information:
Nature of the data processed
The personal data provided by you is defined by law as “common” data (i.e. personal details and fiscal data) and “sensitive” data (i.e. data relating to your disability status). In processing such data, we will strictly adhere to the limitations and conditions imposed by Regulation EU 679/2016
Data Controller
As specified above, SSC Napoli will be the Data Controller. Data will be handled by staff appointed to do so, using electronic and/or paper means. Data processing operations may only be undertaken under the direction and according to the instructions of management staff. For requests relating to personal data processing, please contact the Legal and General Affairs Department – SSC Napoli S.p.A.- Via del Maio di Porto, 9 - 80133 Naples. The Data Protection Officer (DPO) at SSC Calcio Napoli Spa is present in the company organisational chart, which can be obtained by writing to [email protected]. The Data Protection Officer can be contacted at the following address: [email protected]
Purposes of data processing
Your personal data is processed:
Legal basis of data processing: in accordance with Article 6, Letter a) of Regulation EU 679/2016, the data subject has expressed their consent for the processing of their personal data for one or more specific purposes. Failure to provide consent to data processing will render it impossible for you to continue to participate in the initiative.
Methods of data processing
Your personal data is processed via the procedures set out in Article 3, Paragraph 2 of GDPR, specifically: collection, registration, organisation, storage and consultation. Your personal data is subject to print, electronic and/or automated processing operations.
Obligatory/optional nature of data provision and consequences of refusal
Società Sportiva Calcio Napoli does not use processed data for promotional campaigns, nor does it transfer such data to third parties for the creation of databases. As such, no consent is requested for data processing for the purposes of the relationship that has been established. Specific consent is only requested from interested parties in the event of any promotional activities.
Communication and publication of data
Without the need for explicit consent as per Article 6b and 6c of GDPR, the Data Controller may communicate your data for the purposes set out in Article 2a to the judicial authorities, to insurance companies for the provision of insurance services and to any parties to whom the Data Controller is legally required to communicate data for the aforementioned purposes. These parties will process data in their capacities as Autonomous Data Controllers. Your data will not be made public.
Transfer to third countries
Your personal data will not be transferred to third countries or international organisations.
Your rights
Data subjects have the right to obtain confirmation as to whether or not personal data regarding them exists, even whether this has not yet been recorded, and to receive a copy of the data in legible form. Data subjects have the right to obtain information regarding: the origin of the personal data; the purposes and methods of data processing; the logic applied in the event that data processing is carried out with the help of electronic means; the personal details of the Data Controller, the Data Processor and the representative appointed in accordance with Article 5, Point 2; the parties or categories of parties to whom sensitive personal data may be communicated or that could come into knowledge of it in their capacities as designated state representatives, Data Processors or persons in charge of data processing. Data subjects have the right to obtain: the update, rectification or, where applicable, the integration of the data; the erasure, anonymisation or block of data processed in a way that breaches the law, including data which is not required to be stored for the purposes for which the data was collected or subsequently processed; a declaration that the processes under a) and b), and the content thereof, have been communicated to the parties to whom data has been communicated or transferred, except in the case that fulfilment with such a request is impossible or requires the use of resources manifestly disproportionate to the need to protect the right in question. Data subjects have the right to wholly or partly oppose: the processing of personal data regarding them, even where this is pertinent to the purpose behind data collection, where legitimate reasons exist; the processing of personal data regarding them where the purpose is the sending of promotional or direct sales materials, or to complete market research or commercial correspondence activities. More specifically, data subjects can – at any time – ask the Data Controller for access to the personal data, request the rectification or erasure of the data, request the restriction of processing, oppose data processing or exercise their right to data portability. Data subjects have the right to withdraw their consent at any time, without prejudice to the lawfulness of data processing carried out on the basis of consent granted before this withdrawal. Data subjects also have the right to make a complaint to a supervisory body at the following address: [email protected].
Processes for exercising rights
Generally speaking, the processes for exercising all data subject rights are set out in Articles 11 and 12 of the Regulation. The deadline for responding to data subjects’ requests to exercise all of their rights (including the right to access) is one month, which can be extended to three months in particularly complex cases. The Data Controller must respond to the data subject within one month of a request being made, even in the event of a refusal. The response provided to the data subject must not only be “intelligible”, but it must also be concise, transparent and easily accessible, as well as using simple and clear language. The address to be used for queries and to exercise the rights set out in Article 14 of GDPR (including those regarding claims directed at third parties to whom data has been communicated based on specific consent provided by the data subject) is: SSC Napoli S.p.A.- Via del Maio di Porto, 9 - 80133 Naples, or email: [email protected].
