In its capacity as the Data Controller, Federazione Italiana Giuoco Calcio (hereinafter “FIGC” or simply the “Association”), provides data subjects with the following information in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679) (hereinafter “GDPR”).

This document describes data processing carried out in relation to marketing activities. However, FIGC carries out other types of processing, for example regarding ticketing, registration, anti-doping or sports justice activities, and encourages data subjects to read the relevant policies in the event that they have not yet done so.

Introduction

The Data Controller is FIGC, located at No.14 Via Gregorio Allegri, Rome, with VAT No. 01357871001.

The Association processes personal data in order to allow data subjects to interact with FIGC, sign up for newsletters, register on the FIGC website, manage their account, interact with published content, receive news and correspondence regarding FIGC, and purchase goods and services, including through official suppliers and commercial partners.

FIGC may also process personal data in order to fulfil legal obligations, to action requests from data subjects, to pursue legitimate interests, such as conducting direct marketing activities, and to pursue its statutory objectives, which include commercial activities concerning the organisation, running and promotion of football in Italy.

In most cases, FIGC collects personal data directly from data subjects, but it is possible for FIGC to receive this data from other parties. For example, the Association may allow interaction with users browsing on social media pages or channels run by FIGC, such as Facebook, Twitter and YouTube. When this happens, FIGC receives the personal data of users directly from the social networks, based on choices made by the users themselves.

The applicable regulations authorise FIGC to conduct direct marketing activities even without the data subject's explicit consent. In such cases the processing is undertaken on the basis of Article 6 (1) (f) of the GDPR, since such initiatives are among FIGC's legitimate interests and are carried out in ways which do not override the data subject's interests, fundamental rights and freedoms.

In any case, besides duly informing data subjects, FIGC undertakes to request explicit consent for the processing of data subjects' data, whenever this is possible. When data subjects give their consent for data processing, they can withdraw or alter their consent at any time, although this does not affect the lawfulness of any data processing based on consent before it was withdrawn.

In any case, data subjects may ask FIGC to erase their data or limit data processing in circumstances regulated by law and described below. However, there are cases in which the Association may legitimately continue to process some personal data even when a data subject withdraws their consent or exercises the rights set out here and regulated in detail by Article 15 et seq of the GDPR.

FIGC uses cookies to personalise and enhance the browsing experience. To find out more, please consult our cookie policy.

Data processed by FIGC and data collection methods used. Consequences of failure to grant consent

FIGC collects and processes personal data that is spontaneously provided by data subjects when they interact with the Association or participate in events or promotional initiatives organised by it or by its technical or commercial partners. This may also occur when a data subject registers on the FIGC website or signs up for the newsletter. In other cases, the Association processes data that is collected or generated when a data subject accesses the FIGC website or websites associated with FIGC’s activities.

FIGC may process data collected, generated or communicated to the Association by third parties, for example when an app, website or social network is downloaded, installed or used. More specifically, any time a user reacts to content published by FIGC or posted on social media channels that are directly or indirectly operated by it, such as in the form of a “like”, a comment or a share, the user’s personal data may be communicated to the Association in accordance with the relevant privacy policy.

Some personal data may also be collected when FIGC match tickets are purchased or when a user browses online ticketing sites, or sites belonging to FIGC technical or commercial partners carrying out promotional activities in conjunction with the Association; in such cases, an appropriate privacy policy will be provided on the site, in accordance with law.

If a data subject chooses not to share their personal data, asks not to be contacted anymore or withdraws consent given previously, they will not be able to receive communications from FIGC regarding organised events and initiatives.

Purpose and legal basis of data processing

FIGC processes the personal data of data subjects in order to carry out promotional, commercial or marketing activities, as well as for merchandising purposes or to promote its goods or services or those of partner companies. Such purposes are among the legitimate interests of FIGC, therefore pursuant to Article 6 (1) (f) of the GDPR, and as such FIGC can process data subjects' data even without their explicit consent, provided the methods adopted do not override the interests, fundamental rights and freedoms of data subjects.

Nonetheless, FIGC will ensure users are able to provide their explicit consent whenever it is possible to do so, and in any case when processing refers to further purposes such as:

- commercial and promotional correspondence from FIGC, official sponsors or third parties;

- participation in specific events and initiatives;

- the use of apps or certain features of apps;

- the use of cookies or similar tools, as set out in our cookie policy;

- other cases which may require explicit consent due to the particular purposes or methods of the relevant data processing.

FIGC informs data subjects that, unless explicitly specified for particular initiatives, it does not use automated decision-making processes that have significant legal implications for data subjects. In the process of rationalising data processing communications, FIGC may implement a filtering process, which may be automated, to select which correspondence or initiatives might be of most interest to the recipient based on certain details the data subject may have provided. This profiling has no other consequences or purposes.

Consent to data processing

When FIGC processes personal data based on explicit consent from the data subject, the data subject may withdraw their consent at any time. However, any withdrawal of consent does not affect the lawfulness of data processing undertaken based on consent before it was withdrawn.

Even where consent is withdrawn, data subjects are reminded that there are some purposes for which the Association may legitimately continue to process the personal data of the data subject, where there are other legal bases for data processing. For example, the Association may legitimately send direct marketing communications where this is done on the basis of a legitimate interest.

However, the data subject is entitled to oppose data processing for direct marketing (also known as “opting out”) and ask not to receive this kind of correspondence and not to be subject to profiling insofar as this is based on those direct marketing activities. Data subjects can contact the Association using the contact details below in order to exercise their rights. 

Minors

 Football is a passion shared by people of all ages. As such, it is possible that data subjects will be minors.

However, where consent is required, data processing consent can only be legitimately expressed by a minor when they are 16 or over. In other cases, the Association requires data processing consent to be provided or authorised by the minor’s parent or legal guardian.

Data storage period

The personal data collected by FIGC for marketing purposes relates to the data subject's wish to be informed of and involved in initiatives run by FIGC or its technical and commercial partners. For this reason, we keep the data subject's personal data for five years after the last interaction with us, or in any case until the data subject requests that communications should cease.

The Association would like to clarify that when a data subject exercises their rights, for example by withdrawing their consent or asking not to receive direct marketing anymore, their personal data is not erased and their use is not limited immediately. The data may be processed for a further period as is strictly necessary for FIGC to action the requests it has received.

Finally, FIGC keeps a record of the fact that a data subject has exercised a right for an indeterminate period of time, in order to allow it to adhere to the requests it has received (i.e. a request from a data subject who no longer wishes to be contacted).

Communication and sharing of personal data. Transfer to other countries

Personal data processed for the purposes set out here is available to FIGC staff working in the Vivo Azzurro department. For the pursuit of these purposes, this same personal data may be shared with other departments of the Association (including those belonging to its constituent bodies), if authorised, and possibly with third parties such as suppliers of goods or services or commercial partners of the Association.

Personal data may need to be communicated to subjects so that they can process them as autonomous data controllers; in such cases, the Association will obtain the relevant consent.

In any case, FIGC may communicate personal data it has processed to the authorities even without the data subject's consent, when this is required by law.

FIGC does not intend to share data subjects' personal data without explicit consent for individual initiatives, nor transfer it outside of the European Economic Area. Should this be necessary, if no explicit consent is obtained from the data subject in advance, FIGC will ensure that any such transfer will occur in accordance with standard contractual clauses, binding corporate rules or an equivalent code of conduct. Details of the applicable mechanism in each case will be provided where a request is made.

 Rights of data subjects

 All data subjects have the right to ask FIGC to access their personal data, the right to rectification, the right to erasure and the right to restrict data processing, where legitimate grounds exist. The Data Controller can be contacted at privacy@figc.it.

 In accordance with the GDPR, FIGC has appointed a Data Protection Officer, who can be contacted via email at protezionedati@figc.it or by sending a letter via recorded delivery to:

Data Protection Officer

Federazione Italiana Giuoco Calcio

Via Gregorio Allegri No.14

00198 – Rome

 Data subjects also have the right to make a complaint to a supervisory body. In Italy, the supervisory body can be contacted at www.garanteprivacy.it.