Information notice pursuant to art. 13 of the Regulation (EU) 2016/679 (GDPR)
According to art. 13 GDPR we provide you with the due information concerning the processing of your personal data collected with the Sporting Club registration form.
1. DATA CONTROLLER
pursuant to art. 4 and art. 24 of the GDPR, is Villa d’Este S.p.A., Via Regina, 40, 22012 Cernobbio (Como), as represented by the pro-tempore legal representative (hereinafter referred to as “Controller”). You can contact the Controller at any time at the following contacts: fax +39 031 348873; email: privacy@villadeste.it ; telephone number: 031-3481.
2. PURPOSES
The personal data provided will be processed in accordance to the requirements for the lawfulness of processing pursuant to art. 6 of the GDPR for the following purposes:
a) contractual, administrative and accounting purposes related to the Controller’s obligations for the management of the relationships with the Sporting Club associates (creation of the membership card, invoices management, payments, protection of credit positions, registration of tournaments/competitions); the legal basis for the processing is the compliance with contractual and legal obligations pursuant to art. 6(1) point (b) and (c) of the GDPR;
b) medical certificates collection in order to manage insurance policies for third parties’ civil liability in case of possible claims; the legal basis for the processing is your consent pursuant to art. 9(2) point (a) of the GDPR;
c) with reference to the e-mail address provided by the client within the registration, for direct marketing purposes, subscription to our newsletter, direct sales and promotion of products or services of the Controller similar to those already purchased by client (so-called soft spam); the legal basis for the processing is, pursuant to art. 6(1) point (f) of the GDPR, the Controller’s legitimate interest of carrying out marketing activities towards its clients.
3. RECIPIENTS
The personal data provided will be communicated to the employees or collaborators of the Controller who will process the data as persons in charge of the processing acting under the authority of the controller. Your personal data may be communicated to companies contractually involved with the Controller and in particular to third parties belonging to the following categories: – entities that provide services for the management of the information system used by Controller and the telecommunication networks (including e-mail, newsletter and website); – firms or companies which provide assistance and counselling; – insurance companies; – competent authorities who enforce the law and/or regulations promulgated by public bodies, upon request. The above mentioned subjects will act as Data Processor or may carry out their processing activities as independent Data Controllers. The list of appointed Data Processors is constantly updated and it is available at Controller’s headquarters.
4. DATA RETENTION
According to the provisions set forth in art. 5(1) point (e) of GDPR, collected personal data shall be kept in a form which permits identification of data subjects for a period not exceeding the purposes for which the personal data were collected and subsequently processed. In particular: – with reference to the data processed for contractual / administrative / accounting purposes, as well as for the management of insurance policies, the data retention period will be 10 years or the different data retention period required by law; – for direct marketing purposes (subscription to our newsletter) your data will be processed until you unsubscribe from the mailing list.
5. NATURE OF DATA PROVISION AND REFUSAL
The data provision for purpose a) is necessary; your refusal will entail the impossibility to provide Sporting Club services. The data provision for the purpose b) is optional; your refusal will entail the impossibility to provide Sporting Club services. The data provision for the purpose c) is optional and in case of objection your data will not be used for marketing purposes.
6. TRANSFERS OF PERSONAL DATA TO THIRD COUNTRIES
The personal will be transferred outside the European Union if you give the consent to the purpose c) , according to art. 45 GDPR (Privacy Shield). In this case, the data subject may obtain a copy of the conditions on which the transfer is based, referring to the Controller’s contacts.
7. DATA SUBJECT’S RIGHTS
You may exercise your rights pursuant to articles 15 et seq. of the GDPR, contacting the Controller at the contacts above. You have the right, at any time, to request the data Controller to access your personal data and receive the information concerning their processing and to amend or delete your data or limit their processing. In particular, you have the right to withdraw your consent at any time. You have the right to the portability of your personal data; you have the right to object at any time to the processing of your personal data for marketing purposes. If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Data Protection Authority.
Updating date: September 2022
VILLA D’ESTE S.P.A.