6. PROCESSING OF PERSONAL DATA ON THE SITE. ART. 13 OF LEGISLATIVE DECREE 30 JUNE 2003 N. 196 (PRIVACY CODE).
Under Article 13 of Legislative Decree n. 196 of 30 June 2003, the "Code on Personal Data Protection" (hereinafter "Code"), A.S. Roma S.p.A. informs that the data relating to users of which it will come to its attention in relation to the General Conditions, or according to specific conditions or in any part of the processing provided by reports, contracts, commercial orders will be with processed, in accordance with the above law and in accordance with principles of fairness, lawfulness, transparency and protection of confidentiality.
The data will be processed for the following purposes:
A) to allow users to access the registration procedures to particular sections of the Site;
B) for purposes connected with, relating to and/or instrumental to the establishment and enforcement of obligations by each order placed by users (including the requirements of after-sales warranty, service and the likes) or to fulfill, before the execution of an order , the specific users requirements;
C) for the effective management of the Site and services offered by the same;
D) for the advertising material/information on products and/or services.
The data may be updated periodically with information acquired throughout the relationship (payment patterns, status report, etc..)
The data processing is carried out with the aid of manual and electronic tools , in order to ensure the security and confidentiality of the data.
For the purpose of letters. A) B) C), user’s personal data may be disclosed to undergo related processing, having correlated purposes and only as a core competence in relation to the specific relationship between the user and A.S. Roma S.p.A. at:
1) employees, contractors, suppliers and consultants of A.S. Roma S.p.A., who may have knowledge of the personal data as Managers or Trustees;
2) all the companies and/or subsidiaries of A.S. Roma S.p.A. or that otherwise legitimately use the mark A.S. Roma S.p.A..
As a result of the close and indispensable connection between the instrumental performance of A.S. Roma S.p.A. of the required activities by the user and to the purposes listed above letters. A) B) C), the missing data and lack of consent from the user's disclosure of their personal data to third parties for the purposes listed above will prevent the onset of any contractual relationship.
In any case, A.S. Roma S.p.A. reiterates that it is not necessary to obtain the consent of all concerned in the processing of personal data - under Article 24 of the Privacy Code - among others – what is necessary – is as follows:
(a) to comply with an obligation imposed by the law, a Community regulation or legislation;
(b) to perform obligations under a contract of an interested party or to fulfil, before the conclusion of the contract, specific requests of the interested party;
(c) relating to the data from public registers, lists, records or documents to anyone, subject to the limitations and conditions that the laws, regulations or Community legislation establishes the knowledge and publication of data;
(d) relating to data on economic activities, processed in compliance with current legislation on business and industrial secrecy;
(e) with the exception of disclosure, the necessity to enforce or defend legal claims, provided that the data processed is exclusively for said purposes and for no longer than is necessary therefore, in accordance with current regulations concerning Industrial and business secrecy;
(f) with the exception of disclosure, it may be necessary, in identified cases by the Guarantor on the basis of principles laid down by law, to pursue a legitimate interest of the owner or a third party recipient, in reference to its subsidiaries or affiliates if not overridden by the rights and fundamental freedoms, dignity or legitimate interest.
For the purposes of the preceding letter. D) the provision of data is voluntary and refusal to provide them does not effect on the performance of contractual relationships, precluding only the possibility of carrying out promotional activities. It is in fact entirely optional and not mandatory the consent to the processing of personal data for studies, research, market statistics, advertising and information, to carry out direct sales or placement of goods or services, for commercial information, to perform interactive marketing communications.
The user that indicates personal data on the site of third parties expressly declares and acknowledges that it has obtained from third parties consent to the processing of personal data, if required under the legislation on the protection of personal data for the aforementioned purposes, by A.S. Roma S.p.A. and third parties referred to in this paragraph and have obtained the expressed consent by A.S. Roma S.p.A. of advertising/\information material related to products and/or services that may be of interest if they are selected in the appropriate sections of the site options (e.g.: newsletter subscription). The user declares to have provided to third parties the information referred to in Article. 13 legislative Decree 196/03 and in particular the possibility of the communication of the data for the aforementioned purposes to A.S. Roma S.p.A.
The Holder’s details for the processing of the data provided are as follows: A.S. Roma S.p.A. S.p.A. registered legal office Via Emilia 47, 00187 Roma.
The data will be stored on the Owner’s premises for the time defined in the standard norms. The data will be collected, processed and stored in full compliance with the provisions of Articles 31 according to the Privacy Code and the Technical Regulations – Annexed in Attachment B of the Code- regarding security measures.
There are no provisions by the Owner A.S. Roma S.p.A. the processing of personal data defined "sensitive" (personal data revealing racial or ethnic, religious, philosophical or other beliefs, political opinions, membership of political parties, unions, associations or organizations of a religious, philosophical, political or trade union, as well as personal data disclosing health and sex life) or "judicial" nor to disseminate personal identification data. The diffusion and the general, processing can be designed to be part of a set of nonidentifying data aggregated for statistical purposes and processed anonymously.
The data will be processed in full compliance with the rules of self-regulation in the processing of personal data contained in Professional Codes of conduct in force. With reference to the website technologies and/or techniques in order to access the information stored in the terminal equipment of a subscriber or user, to store information or to monitor user operations, the regulations are specified operations, included in subparagraphs 7.1 e 7.2
The owner of the processed data may be contacted at any time, without formal obligations or by using the model prepared by the Authority for the protection of personal data in order to assert rights as provided for in Article 7 of the Code which for convenience are reproduced in full:
7. LEGISLATIVE DECREE N. 196/2003, Article 7 - Right to access personal data and other rights
1.The interested party has the right to obtain confirmation of the existence or not of personal data concerning him, even if not yet recorded and it’s communication in intelligible form.
2. The interested party has the right to obtain information:
a) origin of personal data;
b) the purposes and methods of processing;
c) the logic applied in case of processing with the aid of electronic instruments
d) the identity of the owner, manager and the representatives appointed under article 5, comma 2;
e) on subjects or categories of persons to whom the data may be communicated to or who can learn about them as appointed representative in the State, territory as managers or agents.
3. The interested party has the right to obtain:
a) An updating, rectification or, when interested, an integration of data;
b) the cancellation, the transformation into an anonymous form or blocking of data unlawfully processed, including those that do not need to be kept for the purposes for which the data was collected or subsequently processed;
c) certification that the operations noted in letters a) and b), have been brought to knowledge in regards to their contents, to those whom the data has been communicated or disseminated, except where this requirement proves impossible or involves a manifestly disproportionate to the protected right.
4. The interested part has the right to oppose in whole or in part:
a) for legitimate reasons of the processing of personal data, pertinent to the purpose of the collection;
b) the processing of personal data for purposes of sending advertising materials or direct sales or for carrying out market surveys or commercial communications.
7.1 USE OF INFORMATION TECHNOLOGIES TO ACQUIRE DATA STORED IN THE END USER EQUIPMENT (“Cookies”)
A.S. Roma S.p.A. may enable "cookies" on the Site or similar technologies in order to allow the already registered user faster access to the Site, without the inclusion of data for each access.
by "cookie" is indented a piece of information sent by A.S. Roma S.p.A.’s server which hosts the site to the user computer in order to allow rapid identification.
7.2 BROWSING DATA
Information systems and software procedures used to operate the Site acquire, during the normal course of operation, some personal data whose transmission is implicit in the communication protocols of the Internet. It concerns information that is not collected to be associated with specific individuals, but by their own very nature could, through the processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of computers used by users who connect to the site, URI addresses (Uniform Resource Identifier) of requested resources, the time of the request, the method utilized to submit the request to the server, the size of the file obtained in reply, the numerical code indicating the status of the response from the server (successful, error, etc..) and other parameters related to the operating system and the users.
This data is used only to obtain anonymous statistical information on the Site and to check its correct functioning and is deleted immediately after processing. The data could be used to ascertain responsibility in case of hypothetical computer crimes against the Site except for this possibility, the data on web contacts are not stored permanently, unless the user requests it (e.g.: access to the pages of the site that list the services used, the information required, etc).