PRIVACY NOTICE REGARDING THE PROCESSING OF PERSONAL DATA WITHIN THE LOYALTY PROGRAMME
Article 13 of EU Regulation 679/2016
Dear Customer,
Pursuant to Article 13 of EU Regulation 679/2016 – General Data Protection Regulation (hereinafter also the “GDPR”) – we inform you that the personal data you provide to our Company when subscribing to the I LOVE Card will be processed in accordance with Article 4 of EU Regulation 679/2016.
1. DATA CONTROLLER
The Data Controller is Locate District S.p.A., headquartered at Via Francesco Lonati 3, 25125 Brescia (Italy).
2. PURPOSES AND METHODS OF PROCESSING
Your data will be processed for the following purposes:
a. Issuance and management of the I LOVE Card, including the potential issuance of a voucher to access taxi services (for tourists);
b. Management of activities related to the I Love Scalo Prize Contest.
Furthermore, if you provide your consent, the Controller will also process your data for the following purposes:
c. Direct marketing activities, such as sending advertising material and informational or promotional communications from the Controller, including via email and/or SMS (should you provide your phone number during registration);
d. Individual or aggregate profiling and market research activities aimed, for example, at analysing consumer habits and preferences, as well as producing statistics;
e. Disclosure to third parties for marketing purposes.
Your personal data will be processed by personnel authorised under Article 29 of EU Regulation 679/2016.
Processing for purposes listed under points a) and b) falls under Article 6(1)(b), while processing under points c), d), and e) falls under Article 6(1)(a).
The processing may concern the following personal data:
Personal identification data (e.g., gender, first name, last name, province/nationality);
Email address;
I LOVE Card usage data (e.g., transaction date, store where the transaction took place, transaction amount);
Mobile phone number.
Processing for the purposes listed from a) to e) will be performed through automated and manual means, strictly limited to the purposes for which the data are collected and in compliance with the principles of necessity and data minimisation, meaning no additional data will be collected beyond what is required for the stated purposes.
3. MANDATORY OR OPTIONAL NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL
For purposes under letters a) and b) above, providing your data is optional but constitutes a necessary requirement to fulfil your request to obtain the I LOVE Card.
In all other cases, you are free to provide or withhold your data, and any refusal will have no consequences and will not affect the normal management of the I LOVE Card or participation in the I Love Scalo Prize Contest.
4. DATA DISCLOSURE AND DISSEMINATION
Your data, or part of them, may be communicated to the following entities, which may carry out processing operations on our behalf:
ContactLab S.p.A., headquartered at Via Natale Battaglia 12, 20127 Milan;
Third-party companies for marketing activities, if you have given your consent.
Such entities may act as independent Data Controllers or as Data Processors under outsourcing agreements. The data concerning the Data Subject are or have been provided to the Company by the Data Subject themselves.
Your data will not be disseminated in any way and will not be transferred abroad. Should a transfer occur, the Controller will provide prior information and evidence of the safeguards adopted.
5. PROFILING ACTIVITIES
If you provide your consent, your data will be used for profiling activities, aimed at creating dynamic contact profiles with detailed demographic, behavioural, and purchasing information.
These profiles allow for the creation of segments based on behavioural data and enable the sending of personalised communications.
6. DATA RETENTION PERIOD
Data will be stored for the time strictly necessary to achieve the purposes mentioned in point 2, and in any case:
Purpose Retention Period
Prize Contest
No longer than 12 months after its conclusion
Marketing
Until withdrawal of consent; in any case, after 36 months from consent, you will be asked whether you wish to renew or revoke it
Profiling
Until withdrawal of consent; same 36-month renewal requirement
Third Parties
Until withdrawal of consent; same 36-month renewal requirement
7. RIGHTS OF THE DATA SUBJECT
GArticles 15 to 22 of the GDPR grant the Data Subject several rights, which we invite you to review carefully. Among these, you have the right to:
Obtain confirmation of whether personal data concerning you exist, even if not yet recorded, and receive such data in an intelligible form;
Obtain information regarding:
a. the origin of the personal data;
b. the purposes and methods of processing;
c. the logic applied in case of processing carried out using electronic tools;
d. the identification details of the Controller, Processors, and designated representatives;
e. the recipients or categories of recipients to whom the data may be communicated.
Obtain:
a. the updating, rectification, or—where relevant—completion of the data;
b. the erasure of personal data concerning you without undue delay where the data are no longer necessary for the above purposes, if you withdraw consent, or if you object to the processing;
c. certification that the operations under points a) and b) have been notified to those to whom the data were communicated, unless this proves impossible or involves a disproportionate effort;
d. restriction of processing;
e. data portability.
Object:
a. at any time to profiling;
b. to processing carried out for marketing purposes (including each communication method individually).
You also have the right to lodge a complaint with a supervisory authority.
To exercise your rights, you may contact the Data Controller or the Data Protection Officer (DPO), who can be reached at [email protected]
.
You may also manage your consents through your personal account area.