With this privacy policy S.P.A.L. S.r.l., as the Data Controller, wishes to inform users of the application "S.P.A.L. Social", available for smartphones/tablets as well as a web app (hereinafter the ”App”), of the policy adopted regarding the protection of personal data, emphasizing its commitment and attention to the protection of the privacy of the App’s users (the "Users"). Please read our Privacy Policy carefully, which applies both in the case of simply downloading the App and registering for it and using related services.
The download of the App is free, but in order to use it, navigate within it and to be able to use the services offered (e.g. access to photographic, audio/video content, benefits and initiatives reserved for members of the App) it is necessary for the User to complete the registration process, providing the requested data. Where the User intends to provide his or her personal data, he or she may find in this document all the information regarding the processing of his or her personal data pursuant to Regulation (EU) 2016/679 - General Data Protection Regulation (the "GDPR") and Italian Legislative Decree no. 196 of June 30, 2003 - Italian Data Protection Code (the "Code"), indicating (by way of example) the purposes and methods of data processing by S.P.A.L. S.r.l, as well as the right to obtain at any time the erasure of the data or their updating.
By completing the download of the App, the User acknowledges having read and understood this Privacy Policy.
Pursuant to and in accordance with Article 13 of the GDPR, S.P.A.L. S.r.l. provides the following information.
- Identity and contact details of the Data Controller
S.P.A.L. S.r.l., with registered office in Via Copparo no. 142 – 44123 Ferrara (FE), VAT code 00858930381, Telephone number +39-0532593173, e-mail info@spalferrara.it, certified email: s.p.a.l.srl@legalmail.it (hereinafter “SPAL” or the “Company”) is the Data Controller of the processing of personal data collected through the App.
- Type of personal data processed
In order to access and use the App and have access to the features and services it offers (e.g. viewing photographic or audio/video content, access to discounts, benefits or initiatives reserved for App members), it is necessary for the User to complete the registration process. Once this process is completed, by means of his or her own personal and confidential credentials (i.e. username and password), it will be possible to take advantage of all the features offered by the App. In addition, the App offers some functionalities for the use of which it is necessary to provide certain personal data (i.e. to receive our commercial communications, etc.).
Where necessary, the Company will acquire the specific consent of the User to the relevant data processing.
Here is a summary of the type of information that is collected through the App:
-
Biographical information: first name, last name, address, date of birth, gender;
-
Contact information: email address, residential address, zip code, phone number;
-
Data related to interests and preferences: this is information that we derive from the analysis of data that the User provides, such as, for example, use of the App, membership in services, benefits, promotions offered by S.P.A.L. through the App, age or gender of Users, as well as data related to the use of our services (e.g., visit history, types of services used);
-
Connection and usage data: IP address, device number/ID, data related to your internet connection and service provider, the device you use to access the App, your browsing history, and other technical and usage details.
With reference to data about your navigation within the App collected by cookies or other analytical tools, see also Section 11 below.
- Optional submission of personal data
Some of the personal data requested on the App, e.g., date of birth and email address, first and last name, telephone number, may be marked or requested as “mandatory” (e.g., indicated with an (*)). Failure to submit data marked as “mandatory” will result in the Company’s inability to provide the requested service (e.g., if the User does not provide his/her email address and date of birth, S.P.A.L. will not be able to proceed with the registration process). Failure to submit “optional” data will have no consequences.
Users are required to indicate within the App only their personal data. If personal data of third parties are indicated, Users declare and acknowledge that they have obtained data subjects’ consent for the processing of their personal data by the Company, or other data controllers.
- Purpose and legal basis for processing
Users’ data are collected and processed for the following purposes, strictly related to the use, management and updating of the App, the services offered within it and its presentation to Users.
- Registration to the App, creation of a personal account, use and improvement of the services offered by the App.
Personal data of Users will be processed by S.P.A.L. to:
-
enable registration to the App
-
proceed to the creation of a personal account, and
-
ensure access to the features and services offered by S.P.A.L. through the App (e.g. view photographic, audio, video content; take advantage of benefits and initiatives reserved for Users of the App).
Users’ e-mail address may also be used for:
-
sending any communications on how to use the features of the App (e.g., confirmation of registration, invitation to renew credentials, etc.).
We will also use certain personal data (see Note no. 1 below) of Users related to connection and navigation within the App to:
-
enable normal and efficient navigation and enjoyment of the App, and
-
improve its performance and functioning.
The processing of data related to the provision of the services of the App and its functioning does not require the consent of Users, as it is necessary for the performance of a contractual relationship between Users and S.P.A.L. as well as to properly fulfill the legal obligations to which the Company is subject (art. 6, paragraph 1, lett. b) and c) of the GDPR).
Likewise, the processing of data for the purpose of analysis and improvement of the operation of the App does not require the consent of Users, as it is necessary for the pursuit of the legitimate interest of the Company and Users in the provision of a high-quality service (art. 6, paragraph 1, lett. f) of the GDPR).
The User’s account information may be updated and changed independently at any time by accessing the “Profile” “Personal Information” section of the App.
With User’s consent, the App may send you push notifications to alert you, for example, of the publication of news, notify you when new content has been uploaded, etc. You may at any time revoke or change your choices regarding push notifications by accessing the “Profile” “Notification Preferences” section and changing the relevant settings or by accessing your device settings.
- Request for information
If the User sends the Company a request for information, including by filling in special forms included in the App, his/her data will be processed by SPAL to adequately handle the requests received and, where necessary, to re-contact the Users concerned.
The processing of data for this purpose does not require the consent of the Users, as it is necessary for the execution of pre-contractual measures taken at the request of the User (art. 6, paragraph 1, letter b) of the GDPR).
- Marketing
Upon the collection of suitable and specific consent, Users’ data will be processed by S.P.A.L. to send commercial, promotional and advertising communications or relating to offers and promotions and events of the Company and its official partners and sponsors as well as participation in market research through:
-
push notifications (i.e., pop-up notifications on the App);
-
contact systems both traditional and automated, such as newsletters, telephone, SMS, mail, instant messages, posts, messages or communications of initiatives on social networks, etc.
Where the User of 18 years of age or older than that has consented to the analysis of his/her preferences, communications may be personalized on the basis of interests and additional available information related to the User (e.g., indicating any initiatives dedicated to a certain age group or active in the area of living of the data subject).
The processing of data for this purpose requires the prior consent of Users (art. 6, paragraph 1, letter a) of the GDPR).
- Preference analysis and content customization (only on personal data of Users of 18 years old or older)
Subject to the collection of suitable and specific consent, where the User is at least 18 years old, his/her data will be used for analysis purposes to learn about his/her preferences and interests and allow S.P.A.L. to improve its services and offerings accordingly and to personalize communications intended for the User.
If the User consents to such processing, he or she may receive communications about promotions and events that, based on his or her preferences and characteristics, we believe may be of interest to him or her or respond to his or her specific needs (e.g., he or she will receive promotions related to his or her birthday, area, etc.).
The processing of data for this purpose requires the prior consent of Users (art. 6, paragraph 1, letter a) of the GDPR).
It is understood that failure to provide consent for the purposes (c) and (d) will not condition in any way the possibility of registering on the App and taking advantage of the services it offers.
We remind Users that any consents provided may be withdrawn at any time (i) (as to push notifications) by accessing the "Profile" "Notification Preferences" section and changing the relevant settings or by accessing the settings of your device, (ii) (as to marketing communications via email) by clicking on the appropriate link present in all communications; (iii) by sending appropriate communication to spalsocial@spalferrara.it. It is always possible to withdraw consent limited to the receipt of communications by electronic means (e.g., email, text messages, instant messages), while continuing to receive, where applicable, marketing communications solely by paper mail or telephone contact with an operator, if the User has provided the relevant contact details.
- Access to data stored in your device
The App requires the User's consent (to be provided in different ways depending on the operating system of your device, e.g. Android, Windows, IOS, etc.) to access the following data and/or information stored in your device in order to offer you the services indicated:
-
access to the camera and camera roll allows the App to capture photographs or select images that you intend to upload to the App;
-
access to the calendar allows the App to coordinate its calendar with your device's calendar, simplifying the planning of the User's days.
In particular, consent in relation to such processing will be requested when the App is first launched or before accessing each of the above services: the way consent is collected may vary depending on the Operating System of your device.
In all cases you will be able to witdraw/provide your consent at any time by accessing your device's settings.
- Modalities of processing
The processing of Users' personal data is carried out by means of storage on electronic media, in compliance with the regulations in force and, in any case, in such a way as to guarantee the security and confidentiality of the data and prevent unauthorized disclosure or use, alteration or destruction. All information collected is transmitted in secure connection to prevent its interception by outsiders.
If the User of at least 18 years of age consents to data processing for analysis purposes, S.P.A.L. will use the data collected (e.g., zip code, age, gender, etc.) to examine his/her interests and preferences in order to improve its offerings and services and personalize (see Note no. 2 below) its communications. All data and preference analysis activities will not take place in an exclusively automated manner but will always involve the intervention and evaluation of duly authorized natural persons.
- Recipients of personal data
The User’s data will come to the knowledge (limited to their respective sphere of competence) of personnel expressly authorized by the Company, pursuant to Article 29 of the GDPR and 2-quaterdecies of the Code.
Within the scope of the purposes indicated above, Users’ personal data may come to the knowledge of the following subjects: (i) subjects that provide services inherent to the management of the technological infrastructure of the Company; (ii) subjects that provide services inherent to the management (also technological) or support in the management of services functional to the proper functioning of the App; (iii) companies that provide services instrumental to the activity of advertising, marketing and communication (e.g. providers of platforms or software for sending commercial communications and data analysis); (iv) Public authorities, state and EU control bodies; (v) legal, tax and accounting consultants.
Where necessary, the Company has appointed recipients of Users' personal data as data processors, pursuant to Article 28 of the GDPR. A list of all data processors may be requested by means of a communication to be sent to the addresses indicated in this Privacy Policy (par. 1).
If the User registers to the App using the social log-in mechanism (e.g., registration through Facebook or Google), the User’s data (username and password) will be exchanged with the social network for the sole purpose of enabling registration/log-in.
- Transfers outside the EU
Users' personal data will not be transferred to Countries outside the European Union.
- Storage Period
Users' data will be stored for the time strictly necessary to pursue the purposes indicated in paragraph 4 of this Privacy Policy and in compliance with any consents provided. At the end of the storage period, the data will be destroyed or anonymized.
Specifically, data will be stored according to the criteria shown in the following table.
| Purpose | Storage period |
|---|
| (a) | The data will be stored for the entire duration of registration to the App. After a period of 5 years of total inactivity of the account, the data will be deleted.
With reference to the storage time of data related to connection and navigation within the App, please refer to what is stated in paragraph 11 below. |
| (b) | The data will be kept for as long as necessary to properly handle the User's request for information. |
| (c) | Personal data will be stored for the entire duration of the subscription to our update and/or marketing communication services, in full compliance with the consents provided, without prejudice to the possibility at any time to revoke consent or object to the processing of data for direct marketing and profiling purposes. |
| (d) | |
- Links to other websites.
This Privacy Policy is provided only for the App “S.P.A.L. Social" and not also for other websites that may be consulted by the User through links. The Company cannot be held responsible for personal data provided by Users to external parties, or any websites linked to this App.
- Analysis and profiling tools
The App uses “Cookies”, both technical (i.e., to facilitate navigation and use) and profiling (i.e., to analyze Users and their behaviors and preferences and get them personalized advertisements). For a detailed explanation of the cookies used and how to disable them we invite Users to read the Cookie Policy.
- Rights of data subjects
By contacting SPAL's customer service or by sending a communication to info@spalferrara.it the User may at any time exercise the rights (see Note no. 3 below) set out in Articles 15 to 22 of the GDPR, including knowing what data we are processing, how and for what purposes we process them, modify the data you have provided or delete it, ask us to restrict the use of the data, request to receive or transmit the data, without prejudice to the possibility of always withdraw and/or modifying any processing consents you may have provided.
You may also always object to the processing of your data carried out for marketing or preference analysis purposes.
- Complaint to the Supervisory Authority
If a User believes that the processing concerning him or her data violates the provisions set forth in the GDPR, he or she may always lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it), or with the Supervisory Authority of the Country where he or she normally resides, works, or where the alleged violation occurred.
- Data Protection Officer (DPO)
The Data Protection Officer (DPO) designated by the Company pursuant to Article 37 of the GDPR can be contacted at dpo@spalferrara.it.
- Revision Clause.
The Company reserves the right to revise, modify or simply update, in whole or in part, at its sole discretion, in any manner and/or at any time, without prior notice, this Privacy Policy, including in consideration of changes in data protection laws or regulations. Changes and updates to the Privacy Policy will be notified to Users as soon as they are adopted and will be binding as soon as they are published in the App. We therefore kindly ask Users to regularly access the "Privacy Settings/Privacy" section of the App to check the publication of the most recent and updated Privacy Policy version.
Such as, for example, the IP addresses or the addresses in URI-Uniform Resource Identifier notation of the requested resources, the time of the request, the method used in submitting the request to the server, the domain names of the computers used by Users, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the User's operating system and computer environment. This is information that while not collected to be associated with individuals, by its very nature could, through processing and association with other data, even if held by third parties, allow Users to be identified (e.g., through mobile device identifiers - including Android Advertising ID or Advertising Identifier for OS - or other technologies similar to cookies).
Articles 15 to 22 of the GDPR recognize specific rights including for data subjects: