By means of this Privacy Policy, S.P.A.L. S.r.l., in its capacity as data controller, wishes to inform users visiting the website www.spalferrara.it (hereinafter the “Website”) of the policy it has adopted with regard to the protection of personal data, emphasising its commitment and attention to the protection of the privacy of the users of the Website (the “Users”). We kindly ask you to carefully read our Privacy Policy, which applies both to simple navigation within the Website and to the use of related services.

 

Navigation within the Website is free and does not require any registration, with the exception of certain areas in which the Users may freely and expressly provide a series of data concerning them in order to access specifically identified services (e.g. to request information from the Company). Should the Users intend to provide their personal data in order to access such further services, they may find in this document all the information relating to the processing of their personal data pursuant to Regulation (EU) 2016/679 - General Data Protection Regulation (the “GDPR”) and to Legislative Decree no. 196 of 30 June 2003 - Personal Data Protection Code (the “Code”), indicating (by way of example) the purposes and methods of data use by S.P.A.L. S.r.l, as well as the right to request the erasure of data or their updating at any time. 

 

We remind Users that personal data are defined as "any information concerning an identified or identifiable natural person"; processing means "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction".

 

By accessing the Website Users declare to have read and understood this Privacy Policy.

 

Information on the processing of personal data 

 

Pursuant to Article 13 of the GDPR, S.P.A.L. S.r.l. provides the following information.

 

1. Identity and contact details of the Data Controller

2. Type of personal data processed 

3. Optional submission of personal data

4. Purpose and legal basis of processing

(a) Use and improvement of the services offered by the Website

(b) Request for information

(c) Marketing 

(d) Sending discount code

5. Modalities of processing

6. Recipients of personal data

7. Transfers outside the EU

8. Storage period

9. Links to other websites

10. Analysis and profiling tools

11. Rights of data subjects

12. Complaint to the Supervisory Authority

13. Data Protection Officer (DPO)

14. Review clause

 

1. Identity and contact details of the Data Controller

 

S.P.A.L. S.r.l., with registered office in Via Copparo no. 142 - 44123 Ferrara (FE), VAT code 00858930381, Telephone number +39 0532 593173, E-mail info@spalferrara.it, Certified e-mail s.p.a.l.srl@legalmail.it (hereinafter referred to as "SPAL", the "Company" or the "Club") is the Data Controller of the processing of personal data collected through theWebsite.

 

 

2. Type of personal data processed 

 

No registration is required to access the Website. However, the Website offers certain services for the use of which it is essential to provide your data (e.g. to request information from the Company).

 

Where necessary, the Company will obtain the specific consent of Users for the relative use of the data.

 

Here is a summary of the type of information that is collected through the Website: 

 

• personal information: name, surname, address, age, sex, etc.
• contact data: e-mail address, telephone number
• connection and usage data: IP address, device/ID number, data relating to your internet connection and your service provider, the equipment you use to access the Website, your browsing history and other technical and usage details. With reference to the data relating to navigation within the Website collected through the use of "cookies", see also paragraph 10 below concerning Analysis and profiling tools.

 

3. Optional submission of personal data

 

Some of the personal data requested on the Website, such as e-mail addresses, may be marked as "mandatory" (e.g., indicated with an (*)) as they are necessary to access the services offered by the Company through the Website one wishes to use (e.g., if you choose to submit an information request using the form provided). Failure to provide the data marked as "mandatory" will make it impossible for SPAL to provide the requested service. Failure to provide data marked as "optional" will have no consequences.

 

Users are required to indicate on the Website only the personal data that concerns them. If personal data of third parties are indicated, Users must expressly declare and acknowledge that they have obtained the consent of third parties for the processing of the corresponding personal data by the Company, or other data controllers.

 

N.B. Some sections of the Website contain forms that can be freely filled in to allow Users to customize and/or provide more information regarding their requests: please do not enter personal data in these spaces that are not functional to the request and/or other data belonging to special categories (such as, for example, data relating to health), with the warning that if they are indicated these will be immediately deleted. 

 

 

4. Purpose and legal basis of processing

 

Users' data are collected and processed for purposes strictly related to the use, management and updating of the Website, of the services offered therein and to their presentation to Users. The specific purposes of data use are detailed in this paragraph.

 

(a) Use and improvement of the services offered by the Website

Users' personal data will be processed by SPAL to ensure access to the main areas and functionalities of the Website (e.g. to send information requests). 

We will also use certain personal data of Users relating to connection and navigation within the Website to

• enable normal and efficient navigation and use of the Website, and
• improve its performance and operation.

 

The processing of data related to the provision of the Website's services and its functioning does not require the consent of the Users, as it is necessary for the performance of a contractual relationship between Users and SPAL, as well as for the correct fulfilment of the legal obligations to which the Company is subject (art. 6, paragraph 1, lett. b) and c) of the GDPR). 

Likewise, the processing of data for the purpose of analysis and improvement of the Website's functioning does not require Users' consent, as it is necessary for the pursuit of the legitimate interest of the Company and the Users in the provision of a high quality service (art. 6, par. 1, lett. f) of the GDPR).

 

(b) Request for information 

If Users send the Company a request for information by filling in the appropriate computer forms, their data will be processed by SPAL in order to adequately handle the requests received and, where necessary, to re-contact the Users concerned. 

 

The processing of data for this purpose does not require the Users' consent, as it is necessary for the performance of pre-contractual measures taken at the Users' request (art. 6, par. 1, letter b) of the GDPR).

 

Furthermore, subject to the collection of appropriate and specific consent, Users' data will be processed by SPAL for:

 

(c) Marketing 

Sending commercial, promotional and advertising communications or relating to offers, benefits and promotions and participation in market research. This activity may be carried out through the use of electronic mail (or other automated means such as SMS, WhatsApp, instant messages, posts and communications on social networks, etc.).

 

The processing of data for this purpose requires the prior consent of the Users (art. 6, paragraph 1, lett. a) of the GDPR).

 

It is understood that failure to provide consent for purpose (c) will in no way condition the possibility of using the services offered by the Website.

 

(d) Sending discount code

Your data will be processed in order to allow you to receive the discount code for the purchase of the ticket for the SPAL match at the Paolo Mazza Stadium in Ferrara that is the subject of the promotion created in agreement with the University of Ferrara. In particular, your personal data will be processed by SPAL in order to:

• enable the generation of a univocal discount code;

• send the discount code to the contacts you have indicated.

 

The processing of data connected to the issue of the discount code is necessary for the execution of pre-contractual measures taken at your request (art. 6, paragraph 1, letter b) of the GDPR.

 

We would like to remind you that any consent given may be withdrawn at any time (i) (as regards the Newsletter) by clicking on the specific link present in all communications, (ii) by sending an e-mail to info@spalferrara.it.

 

 

5. Modalities of processing

 

The processing of Users' personal data is carried out by means of storage on electronic media, in compliance with the regulations in force and, in any case, in such a way as to guarantee the security and confidentiality of the data and to prevent unauthorised disclosure or use, alteration or destruction. All information collected is transmitted via secure connection in such a way as to prevent its interception by outsiders. 

 

The sending of commercial communications may take place in a fully automated manner thanks to the use of marketing automation software; however, this processing does not produce any effect of a legal nature on Users, nor does it affect them in any significant way.

 

 

6. Recipients of personal data

 

The Users' data will be disclosed (limited to their respective sphere of competence) to the personnel expressly authorized by the Company, pursuant to Article 29 of the GDPR.

 

Within the scope of the purposes indicated in the scheme below, Users' personal data may come to the knowledge of the following third parties:

 

Purpose	Recipients
(a)	(i) Subjects that provide services inherent to the management of the technological infrastructure of the Company (ii) Companies in charge of the management or support in the management of services functional to the correct functioning of the Website.
(b)	(i) Subjects that provide services inherent to the management of the technological infrastructure of the Company; (ii) Subjects that provide technical and organisational services instrumental to the management of the pre-contractual relationship (e.g. suppliers of management applications and dedicated software); (iii) Legal, tax and accounting consultants.
(c)	(i) Parties that provide services inherent to the management of the Company's technological infrastructure; (ii) Companies that provide services instrumental to advertising, marketing and communication activities (e.g. suppliers of platforms for sending commercial communications, companies operating in the field of market research).

 

If required, the Company has appointed the recipients of personal data as data processors, pursuant to Article 28 of the GDPR. The contact details of the subjects having the role of data processors can be requested by means of a communication to be sent to the addresses indicated below. 

 

Any communication of Users' personal data will take place in full compliance with the provisions of the GDPR and with the technical and organisational measures taken by the Company to guarantee an adequate level of security. Users' personal data will never be disclosed.

 

7. Transfers outside the EU

 

To ensure proper and efficient management of the Website, Users' personal data will not be transferred to countries outside the European Union.

 

8. Storage period

 

Users' data will be stored for the time strictly necessary to pursue the purposes indicated in paragraph 4 of this Privacy Policy and in compliance with any consents provided. At the end of the storage period, the data will be destroyed or anonymized. 

Specifically, the data will be stored according to the criteria indicated in the following table.

 

Purpose	Storage
(a)	With reference to the storage period of data relating to connection and navigation within the Website, please refer to what is indicated in paragraph 10 below.
(b)	The data will be retained for the time necessary to properly process the Users’ request for information. In any case, Users' personal data will not be stored for a period longer than 2 years from the request for information.
(c)	Data will be processed for the entire duration of the purchaser's subscription to our updating and/or marketing communication services, in full compliance with the consents provided by the purchaser, without prejudice to the possibility at any time to withdraw the consent or to object to the processing of data for direct marketing purposes.

 

 

9. Links to other websites 

 

This Privacy Policy is provided only for the Website and not for other websites that may be consulted by Users through links. The Company cannot be held responsible for personal data provided by Users to external parties or to any websites linked to this Website.

 

 

10. Analysis and profiling tools

 

The Website uses "cookies", both technical (i.e. to facilitate navigation and use) and profiling (i.e. to analyse Users and their behavior and preferences and provide them with personalized advertising).

For a detailed explanation on the cookies used and how to deactivate them, we invite Users to read our Cookie Policy.

 

 

11. Rights of data subjects

 

By contacting SPAL's customer service or by sending a communication to info@spalferrara.it you may at any time exercise your rights as set out in Articles 15 to 22 of the GDPR, including knowing what data we are processing, how and for what purposes we use it, modifying the data you have provided us with or erase it, asking us to restrict the use of your data, requesting to receive or transmit your data, without prejudice to your right to withdraw and/or modify any processing consents you may have given us. 

 

Furthermore, Users may always object to the processing of their data for direct marketing purposes.

 

In the event of exercising one of the rights provided for by the GDPR, the Data Controller reserves the right to verify Users’ identity by requesting that a photocopy of an identity document attesting to the legitimacy of the request be sent. Once the identity has been confirmed, the photocopy received will be immediately destroyed.

 

12. Complaint to the Data Protection Authority

 

If a User deems that the processing concerning him/her violates the provisions of the GDPR, he/she may always lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it), or with the Data Protection Authority of the country in which he/she normally resides, works or where the alleged violation occurred.

 

 

13. Data Protection Officer (DPO)

 

The Data Protection Officer designated by the Company pursuant to Article 37 of the GDPR can be contacted at dpo@spalferrara.it.

 

 

14. Review clause

The Company reserves the right to revise, modify or simply update, in whole or in part, at its sole discretion, in any manner and/or at any time, without prior notice, this Privacy Policy, also in consideration of changes in laws or regulations on the protection of personal data. Changes and updates to the Privacy Policy will be notified to Users as soon as they are adopted and will be binding as soon as they are published on the Website. We therefore kindly ask Users to regularly access the "Privacy" section to check the publication of the most recent and updated Privacy Policy.