Privacy Policy

S.S.C. NAPOLI S.p.A. website privacy notice

(pursuant to Articles 13 and 14 of Regulation (EU) no. 679/2016 (GDPR))

One of the main objectives of S.S.C. NAPOLI S.p.A. is to protect the privacy of users, who are invited to read this notice, provided pursuant to and for the purposes of Article 13 of EU Regulation 2016/679 on the protection of personal data, in which the methods for processing the personal data of users who visit this site are described.

This notice applies only to the website of S.S.C. NAPOLI S.p.A., which can be consulted through the web addresses www.sscnapoli.it, www.sscn.it, www.sscnapolispa.it, www.sscnapolicalcio.it, www.calcionapoli.it and store.sscnapoli.it and not to other websites that the user may visit via links contained therein.

Purposes of data processing

The processing of data by S.S.C. NAPOLI S.p.A. is specifically intended for the creation of a database to be used: (i) for statistical purposes, to acquire and assess data relating to access to the sites registered by S.S.C. NAPOLI S.p.A, and to carry out market research, (ii) for the purposes of marketing information and communication, such as sending newsletters and informative and promotional advertising material, relating to goods and/or services offered by S.S.C. NAPOLI S.p.A. and/or partners selected by the latter, (iii) for SSC Napoli competitions aimed at season ticket holders and registered users including fan engagement activities, (iv) for administrative and accounting purposes in relation to issuing invoices for purchases at sales points run by Calcio Napoli and the web store, (v) to conduct accreditation and/or ticket booking activities, (vi) for access to the Village and the pitch to attend training sessions. The processing may also be carried out with the aid of electronic means and will be conducted directly by S.S.C. NAPOLI S.p.A. with the collaboration of the persons appointed for this purpose and any external managers, appointed, where necessary, for specific operations.

Legal basis of the processing

Pursuant to Article 6(a) of EU Regulation 2016/679: the data subject has given consent to the processing of their personal data for one or more specific purposes. Pursuant to Article 6(f), the processing is necessary for the purposes of pursuing the legitimate interests of the data controller or a third party, provided that the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data do not prevail, in particular if the data subject is a child.

Data controller

The data controller is S.S.C. NAPOLI S.p.A., with registered office in Via del Maio di Porto, 9 - 80133 Naples, Italy. We remind you that you may contact us at any time and without formalities to exercise your rights set out below in accordance with Article 7 of the EU Regulation 2016/679. Requests should be addressed to the data controller - S.S.C. NAPOLI S.p.A. - Via del Maio di Porto, 9 - 80133 Naples, Italy.

Data protection officer

The data protection officer (DPO) can be contacted at the following email address: [email protected].

Persons or categories of persons authorised to process data

The data provided may be transmitted to third parties for the above-mentioned purposes; in particular, the data may be transmitted, insofar as competent:

1. to external subjects entrusted by S.S.C. NAPOLI S.p.A. with the distribution of sports publications and/or commercial promotions (such as sending newsletters and/or other promotional/advertising material) relating to goods and/or services offered by S.S.C. NAPOLI S.p.A. and/or by commercial partners selected by the latter;
2. to those responsible for installing or maintaining the IT system – or part thereof – used by S.S.C. NAPOLI S.p.A;
3. to persons entrusted with processing statistical data and/or market research relating to access to the sites registered by S.S.C. NAPOLI S.p.A. or to other sites which may be accessed through the aforesaid sites registered by S.S.C. NAPOLI S.p.A.;
4. for publication on the sscnapoli.it website in relation to initiatives implemented by S.S.C. NAPOLI S.p.A.

Data processed

Browsing data

The web server used by S.S.C. NAPOLI S.p.A., management of which is entrusted to third parties, automatically collects, for statistical purposes only, some personal data of which the transmission is embedded in the use of internet communication protocols. Such data includes the domain name of the visitor's internet provider and the IP address used to connect the PC to the network (internet protocol).

Cookies

When browsing the website, cookies may be automatically issued.

Data provided voluntarily by the user

The optional and voluntary sending of data through the e-mail system entails the subsequent acquisition of the sender's address, which is necessary to respond to the user's requests, as well as any other personal data that may be entered.

Data requested from the user

For competitions, season ticket holders will be asked for: their fidelity card number, section, row and seat, first name, surname, date of birth, email and tax code.

Optional provision of data

With the sole exception of browsing data, for the reasons set out above, the user is free to provide or not to provide personal data.

Failure to provide such data will not prevent them from browsing the site.

Data processing methods

Personal data is processed, including via computerised tools, for the time strictly necessary to achieve the purposes for which it was collected, in compliance with the provisions contained in EU Regulation 2016/679, respecting in particular the rules of lawfulness, propriety, relevance and non-excess.

Specific security measures are observed to prevent not only unauthorised access, but also their loss and illicit or incorrect use.

This is without prejudice to the right of S.S.C. NAPOLI S.p.A. to use the data collected to ascertain responsibility in the event of cybercrimes to the detriment of the site.

Data processing location

The processing operations connected to the services take place at the aforementioned offices of the data controller and are carried out only by technical personnel of the office authorised to process the data. If necessary, the data connected to the service may be processed by staff at the company in charge of technological maintenance of the site, (external data processor pursuant to Article 28 of EU Regulation 2016/679), at the registered office of the data controller and at the registered office of the provider hosting the site – IQUII S.r.l., Viale dell'Esperanto, 71, 0014, Rome, Italy – and are handled by the staff appointed by the data controller and the provider, or by any persons in charge of occasional maintenance operations.

Except as indicated in this notice, no data is transmitted or disseminated.

Rights of data subjects

In relation to the processing operations described in this notice, as a data subject you may, under the conditions set out in the GDPR, exercise the rights set out in Articles 15 to 21 of the GDPR and, in particular, the following rights:

• Right of access - Article 15 GDPR: right to obtain confirmation as to whether or not personal data concerning you are being processed and, where that is the case, access to the personal data, including a copy thereof.

• Right to rectification - Article 16 GDPR: the right to obtain, without undue delay, rectification of inaccurate personal data concerning you and/or completion of incomplete personal data;

• Right to erasure ('right to be forgotten') - Article 17 GDPR: the right to obtain, without undue delay, the erasure of personal data concerning you.

• Right to restriction of processing - Article 18 GDPR: the right to obtain restriction of processing, when:

1. the data subject contests the accuracy of personal data, for a period enabling the controller to verify the accuracy of the personal data;
2. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
3. the personal data are required by the data subject for the establishment, exercise or defence of legal claims;
4. the data subject has objected to the processing pursuant to Article 21 GDPR, pending the verification whether the legitimate grounds of the controller override those of the data subject.

• Right to data portability - Article 20 GDPR: the right to receive the personal data concerning you, which you have provided to the data controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, where the processing is based on consent and is carried out by automated means. In addition, the right to have your personal data transmitted directly by the bank to another controller if this is technically feasible;

• Right to object - Article 21 GDPR: the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on the lawful condition of legitimate interest or the performance of a task carried out in the public interest or in the exercise of official authority, including profiling, unless there are legitimate grounds for the controller to continue the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Furthermore, the right to object at any time to the processing of personal data where they are processed for direct marketing purposes, including profiling, to the extent that it is related to such direct marketing.

The above-mentioned rights may be exercised with the data controller by contacting the points of contact described above.

The exercise of your rights as a data subject is free of charge in accordance with Article 12 GDPR. However, in the case of requests that are manifestly unfounded or excessive, including due to their repetitiveness, the data controller may charge you a reasonable contribution to expenses, in light of the administrative costs incurred in handling your request, or refuse to honour your request.

• RIGHT TO WITHDRAW:

You have the right to withdraw your consent at any time. Withdrawal of consent shall not affect the lawfulness of the processing based on the consent before the withdrawal.

• RIGHT OF COMPLAINT:

The data subject has the right to lodge a complaint with the Italian Data Protection Authority, Piazza Venezia no. 11, IT-00187, email: [email protected].

Requests to this effect should be addressed to the data controller or the data processor at the following email address: [email protected].