Pursuant to current legislation, we wish to inform you that SAGAT S.p.A. processes the personal data you provide in accordance with fundamental rights and freedoms, with particular reference to the confidentiality of your personal identity and your right to data protection.
The Data Controller is SAGAT S.p.A., with its registered office at Strada San Maurizio 12, Caselle Torinese (TO), which can be contacted at the following email address: privacy@sagat.trn.it, or by sending a letter to SAGAT S.p.A. – Data Controller, Strada San Maurizio 12, Caselle Torinese (TO).
The Company has appointed a DPO (Data Protection Officer), who can be contacted at the following email address : dpo.privacy@sagat.trn.it , or by sending a letter to SAGAT S.p.A. – DPO, Strada San Maurizio 12, Caselle Torinese (TO).
TYPES OF DATA PROCESSED – PURPOSES OF THE PROCESSING
The data you provide, and in particular your personal details (first name, surname) and email address, are related to and necessary for your subscription to the newsletter service and your inclusion on the mailing list, in order to send you information relating to airport operations or communications concerning promotional marketing activities.
LAWFUL BASIS FOR DATA PROCESSING
The legal basis for the processing is the user’s consent, pursuant to Article 6(1)(a) of EU Regulation 2016/679 (GDPR). (1)(a) of EU Regulation 2016/679 (GDPR).
The provision of the data required for the sending of newsletters and promotional communications is optional. Failure to provide the data and to give consent will make it impossible for SAGAT S.p.A. to complete the user registration process and therefore to send the aforementioned communications.
If you have already purchased products or services from the Data Controller and provided your email address in connection with that purchase, the Data Controller may use these details to send you marketing communications relating to products or services similar to those already purchased, without the need to obtain further consent, but on the basis of the Data Controller’s legitimate interest, also pursuant to Article 130(4) of the Italian Data Protection Code.
You retain the right to object to such processing at any time, easily and free of charge, using the methods set out below in this privacy notice, or by unsubscribing by following the instructions at the bottom of newsletters and promotional communications.
For the establishment, exercise or defence of the Data Controller’s legal claims, the legal basis is Article 6(1)(f) of the GDPR. (1)(f) of the GDPR.
PERSONAL DATA PROCESSING METHODS
The processing shall be carried out in accordance with the confidentiality and security rules set out in the legislation on the protection of personal data.
The data shall be processed using electronic means and shall be stored and controlled through the implementation of appropriate preventive security measures aimed at minimising the risks of loss and destruction, unauthorised access, and processing that is unlawful or contrary to the purposes for which the processing is carried out.
The data are not subject to any automated decision-making process, including profiling.
CATEGORIES OF RECIPIENTS
We hereby inform you that your personal data will be processed by authorised employees of SAGAT S.p.A. and that your data may be disclosed to companies or third parties responsible for managing the service or processing personal data on behalf of SAGAT S.p.A., who have been appointed and specifically instructed as Data Processors pursuant to Article 28 of the GDPR.
The data is processed using IT and telematic systems. This data may be subject to automated decision-making. The data are stored in electronic files and, to a lesser extent, in paper form, with the minimum security measures required by law fully ensured.
SAGAT S.p.A. does not transfer data to a third country outside the EU or to an international organisation.
Should your personal data be transferred outside the European Economic Area (EEA), we will ensure an adequate level of protection by implementing appropriate safeguards, such as adequacy decisions or standard contractual clauses approved by the European Commission.
RETENTION PERIOD
Your personal data will be retained for the period strictly necessary to fulfil the purposes for which it was collected.
Where consent has been given, the data shall be retained until you withdraw your consent or, in the absence of withdrawal, for a maximum period of 24 months from the last meaningful interaction.
In the case of marketing and promotional communications relating to services or products similar to those already purchased, the data will be retained for a maximum period of 24 months from the date of the most recent purchase.
Once these periods have expired, the data shall be erased or made irreversibly anonymous, unless further retention is necessary to comply with legal obligations or to establish, exercise or defend a legal claim.
RIGHTS OF THE DATA SUBJECT
With regard to the data processed as described in this privacy notice, as a data subject, pursuant to the GDPR, you have the right to exercise, at any time, the rights set out in Articles 15–22 of the GDPR:
To request confirmation as to whether or not personal data concerning you are being processed and, if so, to obtain access to such data (Article 15 of EU Regulation 2016/679);
To request the rectification of inaccurate personal data concerning them and/or the completion of incomplete personal data (Article 16 of EU Regulation 2016/679);
To request the erasure of personal data only if: the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; consent is withdrawn, unless the processing is necessary for the establishment, exercise or defence of legal claims by the Data Controller; the data have been processed unlawfully; or the data must be erased in order to comply with an obligation under EU or Member State law (Article 17 of Regulation (EU) 2016/679);
To request restriction of processing in any of the following circumstances: the data subject contests the accuracy of the personal data and requests restriction for the period necessary for the data controller to verify the accuracy of the personal data; the processing is unlawful and the data subject objects to the erasure of the data and instead requests restriction of its use, even though the data controller no longer needs the personal data for the purposes of the processing; the data subject needs the personal data for the establishment, exercise or defence of legal claims (Article 18 of EU Regulation 2016/679);
To request and receive, in a structured, commonly used and machine-readable format (so-called data portability), the data provided when completing the form (Article 20 of EU Regulation 2016/679);
To request that your data no longer be processed for the purposes of information relating to airport operations, promotional and commercial communications concerning the services provided by SAGAT, by withdrawing your consent at any time (Article 13(2)(c), Articles 17 and 21 of EU Regulation 2016/679). (2)(c), Articles 17 and 21 of EU Regulation 2016/679).
You also have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes EU Regulation 2016/679. The complaint may be lodged with the supervisory authority of the Member State in which the data subject habitually resides or works, or of the place where the alleged infringement occurred (Article 77 of EU Regulation 2016/679).
We hereby inform you that you may exercise the above rights by writing to privacy@sagat.trn.it or by sending a letter to SAGAT S.p.A., Strada San Maurizio 12, Caselle Torinese (TO), Italy.
