Privacy Notice
pursuant to art. 13 e 14 del EU Regulation n. 2016/679

Dear Guest,

pursuant to Article 13 of European Regulation 2016/679 (GDPR), we hereby provide you with information regarding the processing of personal data that may be provided to Cagliari Calcio S.p.A. when registering for and participating in the TST Festival Daily Sweepstakes and related promotional activities.

1. Data Controller

The data controller for your personal data is Cagliari Calcio S.p.a., with registered office in Assemini (CA), Località Sa Ruina snc (hereinafter also referred to simply as “the Company”). For all processing activities covered by this policy, you may contact us by sending an email to privacy@cagliaricalcio.com  

2. Data ProtectionOfficer

The Company has appointed a Data Protection Officer in accordance with Article 37 of European Regulation 679/2016 (GDPR), who can be contacted at dpo@cagliaricalcio.com  

3. Types of Data Processed

When registering for the TST Festival Daily Sweepstakes, the Company or its authorized third parties may collect your personal data, including your first name, last name, email address, and phone number. This data may be processed manually and/or using IT or telecommunications systems—where permitted by law—for the following purposes.

4. Purpose of registration and participation in promotional activities

Cagliari Calcio S.p.A. will process your personal data to allow you to access the club stand and participate in the promotional activities such as the Sardinian Tellus aperitif, the Kid Pasta Making Class, and the Foosball Tournament (including verifying the eligibility requirements and sending relevant communications), as well as for possible participation in the Daily Seeptstakes prize competition organized by the club for its most loyal supporters. The data may also be processed to manage any complaints or disputes and to comply with legal obligations.

The legal basis for the processing is the performance of a contract or pre-contractual measures at the request of the data subject (Article 6, paragraph 1, letter b) of European Regulation 679/2016) and/or the company’s legitimate interest in enabling the proper organization of activities (Article 6, paragraph 1, letter f) of European Regulation 679/2016).

5. Statistical purposes and monitoring the quality of the services provided

The data collected for the purposes described in point 4 may be processed for statistical purposes aimed at monitoring the level of participation in the initiative and the level of satisfaction among participants. The legal basis for the processing is the company’s legitimate interest in enabling the continuous improvement of its performance and business activities (pursuant to Article 6(1)(f) of the European General Data Protection Regulation 679/2016).

6. Marketing and personalizedcommunications

We would like to stay in touch with you and offer you the opportunity to personalize your “Cagliari Calcio” experience. If and when you give your consent for marketing communications and/or personalized communications, we will process your personal data only for the purposes falling within the scope of the consent you have provided (pursuant to Article 6(1)(a) of the European General Data Protection Regulation 679/2016).

6.1. Marketing Purposes 

Specifically, if you consent to marketing communications, we will occasionally send you informational and promotional messages about Cagliari Calcio products and services, team offers and events, as well as invitations to market research studies and surveys that may be of interest to you. We may also send you informational and promotional communications regarding products or services offered by our partners for the marketing and promotion of such products or services. You may receive these informational and promotional communications automatically via email, SMS, instant messaging apps such as WhatsApp and Messenger, or through traditional means such as phone calls with an operator or postal mail.

The legal basis for marketing activities is your consent (pursuant to Article 6, paragraph 1, letter a) of European Regulation 679/2016). Consent is optional, and failure to provide it will not prevent you from entering the stand or participating in the Sardinian Tellus aperitif, the kid pasta making class, and the foosball tournament. Denied consent will only prevent Cagliari Calcio from sending you informational and promotional communications about its own or third-party products or services and/or the opportunity to participate in the Daily Seeptstakes prize competition organized by the club for its most loyal supporters.

If you give us your consent, you may, of course, withdraw it at any time by logging into your personal account on the SSO Cagliari Cacio website, or by sending an email to dpo@cagliaricalcio.com. Withdrawal of consent will take effect for the future and will not affect the lawfulness of the processing we have carried out up until the time of withdrawal.

6.2. Profiling and Personalized Communications

If you consent to profiling, we will occasionally send you highly relevant and personalized communications about Cagliari Calcio’s products and services, offers, and events, as well as invitations to participate in surveys and polls tailored to your profile. We may also send you highly relevant and personalized communications regarding products or services offered by our partners for the marketing and promotion of such products or services. You may receive personalized informational and promotional communications automatically via email, SMS, instant messaging apps such as WhatsApp and Messenger, or through traditional means such as phone calls with an operator or postal mail.

In order to create your individual customer profile, which underpins the sending of highly relevant and personalized communications, we will use procedures to analyze your preferences and interests, as well as your use of our products and services. You can find more information about our analysis activities in the section of the policy titled “Data Analysis and Segmentation to Optimize and Personalize Our Marketing Activities.”

The legal basis for profiling activities is your consent (pursuant to Article 6, paragraph 1, letter a) of European Regulation 679/2016). Consent is optional, and failure to provide it will not prevent you from entering the stand or participating in the Sardinian Tellus aperitif, the kid pasta making class, and the foosball tournament. Denied consent will only prevent Cagliari Calcio from sending you personalized promotional communications about its own or third-party products or services and/or the opportunity to participate in the Daily Seeptstakes prize competition organized by the club for its most loyal supporters.

If you give us your consent, you may, of course, withdraw it at any time by logging into your personal account on the SSO Cagliari Cacio website, or by sending an email to dpo@cagliaricalcio.com. Withdrawal of consent will take effect for the future and will not affect the lawfulness of the processing we have carried out up until the time of withdrawal.

6.2.1. Data Analysis and Segmentation to Optimize and Personalize Our Marketing Activities

To optimize our profiling activities and personalized communications, we may use data analysis and segmentation procedures and systems. Below, we provide you with information regarding the logic we use, as well as the significance and consequences of such processing.

We will create a unified customer profile of you as the basis for our personalized marketing activities, specifically to measure and understand the effectiveness of our advertising and communications, as well as to provide you with highly relevant communications about our products and services. To create such a customer profile, we will determine your preferences and interests based on information derived from your use of our products and services, such as your history of services of interest, your interaction with our e-commerce platform, our app, and/or the type of ticket you have purchased.

Once your data has been consolidated and we have created a comprehensive customer profile, we will use this data to perform predictive analytics using scientifically recognized mathematical and statistical methods. Predictive scoring involves the use of data, algorithms, and machine learning techniques to assign scores to various segments based on the available data. Once your customer profile has been mapped to specific customer segments, we will be able to control and tailor the type, content, and frequency of our marketing activities to ensure you receive communications that are highly relevant to you. Our predictive analytics are limited to creating target customer groups for our marketing activities. This may result in you receiving or not receiving certain communications, unlike other customers.

7. Purposes of Data transfer to Third Parties

If you consent to the transfer of data to third parties, Cagliari Calcio may transfer your personal data and/or your individual customer profile to partner companies. Specifically, your data may be transferred to Delta Airlines Inc, ReachAut Srl, and Antonio Puddu Costruzioni Edili – Apice Srl for their independent processing for the purposes of marketing and promoting their own products or services. These companies will process your personal data as independent data controllers (“Third-Party Recipients”) and will provide you with the necessary information regarding their processing of the data received from Cagliari Calcio.

The legal basis for data transfer activities is your consent (pursuant to Article 6, paragraph 1, letter a) of European Regulation 679/2016). Consent is optional, and failure to provide it will not prevent you from entering the stand or participating in the Sardinian Tellus aperitif, the kid pasta making class, and the foosball tournament. Denied consent will only preclude the possibility that Cagliari Calcio may transfer your data and/or your customer profile to third parties operating in the specified product sectors for their own independent marketing and commercialization of their products and services and/or the opportunity to participate in the Daily Seeptstakes prize competition organized by the club for its most loyal supporters.

If you provide your consent, you may, of course, withdraw it at any time by accessing your personal page on the SSO Cagliari Cacio website, or by sending an email to dpo@cagliaricalcio.com. The withdrawal of consent will take effect for the future and will not affect the lawfulness of the processing we have carried out up until the time of withdrawal.

In any case, you may also exercise your rights against third-party recipients as listed in paragraph 11 below of this policy.

8. With whomisyour data shared?

Access to your personal data within Cagliari Calcio is limited to those who have a legitimate need to know it in order to perform their job duties (need-to-know basis). Your personal data may be transferred and/or otherwise processed by the recipients and/or categories of recipients listed below, within the limits of the specific purposes.

Private third parties that assist us in providing services:

• Your data may be shared with third-party suppliers, designated as External Data Processors, who help us provide you with services and who process the data on our behalf and within the limits of our instructions and the tasks we have assigned to them;
• These external data processors will be contractually obligated to implement appropriate technical and organizational measures to ensure the protection of the personal data we share with them. Among these entities, we can mention:
• Infront and Y-tech S.r.l., with headquarters in Milan, Piazza Volontari 4—the current External Data Processor for the development and maintenance of Cagliari Calcio’s Single Sign-On;
• Abylitia S.r.l., with headquarters in Milan, Via Antonio Baldissera 2, External Data Processor for the development and maintenance of the Cagliari Calcio app;
• Ticket One S.p.A., with headquarters in Milan, Via Fabio Filzi 29, External Data Processor for ticketing management;
• Riccardo Casu, with registered office at Via B. Dol 30, Sinnai 09048 (CA), External Data Processor for the development of the e-commerce site and the Cagliari Calcio membership card;
• To ensure the company can carry out the activities necessary for its operations, your data may also be disclosed to professionals appointed by the company to perform services complementary to its business activities, including, for example, accountants, auditors, and lawyers; companies responsible for website maintenance; companies managing the corporate contact center; and companies handling the shipment of products ordered online.

Other third parties:

• solely to comply with legal or regulatory obligations, your data may be disclosed to authorities and supervisory and regulatory bodies, including the Security Operations Group (G.O.S.), the State Police, and the Police Headquarters, as well as to national and international federal and non-federal bodies and other sports clubs.

9. Disclosure of Personal Data

Disclosure of personal data means making such data known to unspecified parties in any form. Your personal data will not be disclosed to anyone.

10. Transfer of Data Abroad

Our databases and those of our suppliers are located within the European Union.

11. Data retentionperiod

With regard to the purposes mentioned in points 4 and 5, your data will be retained for the time necessary to fulfill the purposes of contest participation and quality monitoring and, in any case—except for data whose retention is required by law—for a period not exceeding 12 months from the date of collection.

The data we collect for our own or third-party marketing purposes, profiling, and/or transfer to third parties for their own marketing purposes, pursuant to the provision of the Italian Data Protection Authority No. 181 of October 15, 2020, will be retained until you revoke your consent to processing and, in any case (for accountability purposes), for no longer than 36 months from the date of granting such consent. In this regard, we inform you that we will send you an email shortly before the expiration of the 36-month validity period of your consent, notifying you that if you do not revoke it via our SSO or other available channels, we will renew it for an additional 36 months.

12. Rights of the interested parties

In relation to the data processing described in this notice, as an interested party you may exercise the rights set out in articles 15 to 22 of the European Regulation 2016/679 and, in particular, the following rights:

• right of access – right to obtain confirmation as to whether or not personal data concerning you are being processed and, in this case, obtain access to your personal data;
• right of rectification – right to obtain, without unjustified delay, the rectification of inaccurate personal data concerning you and/or the integration of incomplete personal data;
• right to erasure (right to be forgotten) – right to obtain, without unjustified delay, the cancellation of personal data concerning you. The right to erasure does not apply to the extent that the processing is necessary for compliance with a legal obligation or for the performance of a task performed in the public interest or for the establishment, exercise or defense of legal claims. in court;
• right to restriction of processing – right to obtain the limitation of the treatment;
• right to data portability – right to receive, in a structured format, in common use and readable by an automatic device, the personal data concerning you and to provide them to another Data Controller;
• right of opposition – right to object to the processing of your personal data for reasons related to your particular situation and in any case to the use of your data for marketing purposes;
• right not to be subjected to an automated decision-making process – right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or which significantly affects your person in a similar way;
• right to lodge a complaint with the Guarantor Authority for the protection of personal data: http://www.garanteprivacy.it;
• right to withdraw consent provided on every occasion and with the same ease with which it was provided without prejudice to the lawfulness of the processing based on the consent given before the revocation.

You can easily exercise one or all of the above rights by sending an email to dpo@cagliaricalcio.com