Skip to content

Privacy notice pursuant to Articles 13 and 14 GDPR on Whistleblowing reports

SOCIETÀ SPORTIVA CALCIO NAPOLI S.p.A., with registered office in Naples, Via del Maio di Porto no. 9, 80133, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter “GDPR”), informs you that the personal data acquired in the management of the Whistleblowing reporting channels will be processed in compliance with privacy legislation.

1. Data Controller

SOCIETÀ SPORTIVA CALCIO NAPOLI S.p.A., with registered office in Naples, Via del Maio di Porto no. 9, 80133 (hereinafter also the “Controller”).

2. Data Protection Officer

In order to better protect the proper processing of the data subject's personal data, the Controller has appointed a Data Protection Officer (“DPO”), who can be contacted by writing to: dpo@sscn.com.

3. Data processed

In compliance with the principles of lawfulness, transparency and fairness, the Controller may process the following personal data of data subjects:

  1. personal details, such as first name and last name;

  2. contact details, such as e-mail address and/or telephone number;

  3. data that make it possible to qualify the relationship with the Controller;

  4. miscellaneous data, i.e. all types of data that may be provided by the whistleblower and/or the facilitator when making a report and, specifically, those entered on the web Platform http://wccweewknhsvomhgljbp2xl5dlv2tpgx5kohhlcil6i6cqtm7f7h6yqd.onion/#/ (opens in a new tab) or those collected by the persons in charge of handling the report during the investigation, including special categories of data under Article 9 GDPR and data relating to criminal convictions and offences under Article 10 GDPR.

Under Article 4 GDPR, the data subject is the identified or identifiable natural person to whom the personal data relate; in the specific context of this notice, the following are therefore considered “Data Subjects”: the whistleblower (the natural person who makes the report within their work context), the person concerned (the natural person mentioned in the report as the person to whom the breach is attributed or as a person otherwise involved in the breach reported or publicly disclosed), and the facilitator (the natural person who assists a whistleblower in the reporting process, operating within the same work context).

To this end, the data subject is informed that, for the purposes of handling reports, the Controller may process special categories of data under Article 9 GDPR, as well as data relating to criminal convictions and offences under Article 10 GDPR.

4. Purposes and legal basis of processing

The Controller will process the personal data of data subjects solely for the following purposes:

  1. the data under 3.c, 3.d and, where applicable, those under 3.a and 3.b may be processed for the purpose of receiving the report;

  2. the data under 3.a and 3.b may be processed to manage communications between the whistleblower and the persons handling the report;

  3. the data under 3.c, 3.d and, where applicable, those under 3.a and 3.b will be processed to conduct the investigation and to verify whether the report is well-founded.

  4. management of the resulting measures, including disciplinary measures.

The above processing is based on compliance with a legal obligation to which the Controller is subject under Article 6(1)(c) GDPR, pursuant to Legislative Decree no. 24/2023.

As regards the processing of special categories of data, the processing is lawful under Article 9(2)(b) GDPR, as it is necessary for carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law, as well as under Article 9(2)(g) GDPR, as it is necessary for reasons of substantial public interest on the basis of Article 2-sexies of Legislative Decree no. 196/2003.

Lastly, the processing of data relating to criminal convictions and offences that may become necessary following the report is based on the combined provisions of Article 10 GDPR and Article 2-octies of Legislative Decree no. 196/2003.

5. Processing methods and retention periods

The above processing will be carried out by the Controller in compliance with the principles of lawfulness, fairness and transparency.

As regards the retention of personal data, the principles of proportionality and data minimisation will be observed; the data will therefore be retained for the time strictly necessary to ascertain the facts reported and in any case no longer than 5 years from receipt of the report.

Where the report proves to be well-founded and a dispute arises in which the Controller is involved in any capacity, the personal data may be retained until that dispute is settled.

Also in compliance with the principle of data minimisation, all personal data not deemed useful for handling the report will be deleted.

6. Recipients of the data

The data processed will be made accessible only to internal persons authorised under Article 29 GDPR, or to suppliers duly appointed as data processors under Article 28 GDPR. The personal data processed may be disclosed to public bodies, to comply with legal obligations or to meet requests from the judicial or public security authorities.

In accordance with the reporting management procedure, and except where the whistleblower gives consent, data relating to their identity will not be disclosed to persons other than those handling the reports.

The data subject's personal data may be processed in any disciplinary proceedings against the reported person only where all of the following conditions are met:

  • the data subject has given consent;

  • the disciplinary offence came to light thanks to the data subject's report;

  • knowledge of the whistleblower's identity is indispensable to ensure the reported person's right of defence.

In such circumstances, where the whistleblower does not consent to the disclosure of their identity, to the detriment of the reported person's right of defence, the information may not be used for the purposes of the disciplinary proceedings.

Except in the cases set out in this notice, the data will not be further disclosed or disseminated.

7. Transfer of data

The personal data of data subjects will not be transferred to countries outside the EU. Should such a transfer become necessary, it will be carried out in compliance with one of the conditions set out in Chapter V of the GDPR.

8. Rights of data subjects and how to exercise them

As a data subject, you are entitled to exercise the rights set out in Article 15 et seq. of the GDPR, namely:

  1. the right to request from the controller access to personal data (Art. 15);

  2. the right to request from the controller the rectification and/or completion of inaccurate personal data concerning you (Art. 16);

  3. the right to request from the controller the erasure of your personal data (Art. 17);

  4. the right to request from the controller the restriction of processing (Art. 18);

  5. the right to data portability (Art. 20);

  6. the right to object to processing, i.e. to object at any time, on grounds relating to your particular situation, to the processing of data concerning you (Art. 21);

  7. rights in relation to automated decision-making, i.e. the right not to be subject to a decision based solely on automated processing of data without your explicit consent (Art. 22);

  8. the right to lodge a complaint with the supervisory authority (Art. 77), i.e. the right to apply to the Authority if you consider that the processing concerning you infringes the Regulation;

Please note that, pursuant to Article 2-undecies(1)(f) of the Privacy Code, requests made by any data subject may be refused in the cases provided for by applicable law. The data subject is hereby informed that refusal will be considered justified where the exercise of the above rights could cause actual and concrete harm to the confidentiality of the whistleblower's identity and/or to the conduct of the investigation following the report, or to the exercise of a right in court by the Controller and/or third parties, limited to that period of time.

In order not to compromise the secrecy of the defensive investigations arising from the report or the identity of the whistleblower, the rights referred to in the previous paragraph cannot be exercised through the usual channels; they may instead be exercised through the reporting channels provided for in the Whistleblowing Policy published on the SSC Napoli website.