IN ACCORDANCE WITH ART. 13 OF EUROPEAN REGULATION 2016/679
 
EU Regulation 2016/679 (General Regulations on Data Protection, "Regulation") and the Italian legislation in force, including Legislative Decree no. 196 of 30 June 2003 as amended (Personal Data Protection Code), (together "Applicable Regulations") establish the right of anyone to  protection of personal data concerning him/her. The applicable regulations therefore require that personal data is processed in compliance with fundamental rights and freedoms and the dignity of the user, with specific reference to right to the confidentiality and protection of personal data.
 
Società per azioni Esercizi Aeroportuali S.E.A., having its registered office in Segrate (Milan) - 20054 - at the Milan-Linate Airport, ("Company") in the provision of services (including, for example, flight tracking, search for information on services available at individual airports, travel planning service to and from airports, etc.) which can be used through browsing and registration on the portals www.milanomalpensacargo.eu, www.milanolinate-airport.com, www.milanomalpensa-airport.com, www.milanairports.com, and wifi.seamilano.eu("Service(s)"), processes the personal data provided freely by users in accordance with the Applicable Regulations.

Pursuant to art. 4, paragraph 1, no, 2) of the Regulation, processing of personal data means any operation or set of operations, performed with or without the aid of automated processes and applied to personal data or sets of personal data, even if not recorded in a database, such as collection, registration, organization, structuring, storage, processing, selection, blocking, adaptation or modification, retrieval, consultation, use, communication by transmission, circulation or making available in any other form, comparison or interconnection, restriction, erasure or destruction.

The Company will perform the processing, therefore, in accordance with the Applicable Regulations, for the purposes listed below, with automated systems suitable for storing and managing the data in compliance with the above-mentioned purposes and in such a way as to guarantee their security and confidentiality.

1. Purpose and legal basis of the processing

The data are acquired and processed in compliance with the rules set out in the Applicable Regulations for the following purposes, with an indication of the relevant legal basis:

• Permitting use of all the Service's functions (see point 3.1 below): performance of a contract;
• Allow registration to the Service (see point 3.1. below): performance of a contract;
• Comply with legal obligations (see point 3.1. below): legal obligation;
• Communication of data to third parties in order to comply with any legal obligations (see point 3.1. below): legal obligation;
• Use the travel planning service to and from airports (see point 3.2. below): consent;
• Allow access and use of the wi-fi network (see point 3.3 below): performance of a contract;
• Profiling (see point 43.43 below): consent. 
• Send promotional, commercial and marketing communications relating to the services of the Company or of partner companies (see point 3.5 below): consent

 
2. Disclosure and circulation of personal data to pursue the purpose of processing.

The data may be disclosed to third parties when the disclosure is required by law, including the scope of prevention/repression of any illegal activity. The data may be communicated to employees/collaborators/consultants, as well as to third party companies to which the Company outsources the processing activities described in this privacy policy, duly designated as data processors pursuant to art. 28 of the Regulation or authorized to perform the processing pursuant to art. 29 of the Regulation. The updated list of processors is available at the Company's registered office.

The data will not be circulated, that is personal data will not be disclosed to the public or, in any case, to an indeterminate number of parties.

3. Mandatory or optional provision of data for pursuit of the purposes of processing
 
3.1. Use of the Site
 
The Company will process your personal data in order to allow you to access the Site and use all the features, including the possibility to create an account and register on the Site.
 
In addition, the Company will process your personal data to fulfill the legal obligations required of it.
 
The provision of personal data for these purposes is mandatory and a refusal to provide the data may make it impossible for the Company to carry out the purpose for which the personal data is collected. Failure, partial or incorrect provision of the data marked with an asterisk (*) in the registration form will make it impossible to register and to use the Services. The failure, partial or incorrect provision of data not marked with an asterisk will not prevent the registration or its use.
 
3.2. Using the wi-fi network
 
The Company provides the user with a free wi-fi network, which can be accessed without registration.
 
The computer systems and software procedures used to operate the wi-fi service acquire, during their normal operation and at the time of connection by the user, the mac address of the device used. By connecting to wi-fi the user will be redirected to the Welcome Page of the wi-fi service where he/she must accept the terms and conditions of the service in order to use it.
 
The Company will detect the mac address of the device that will be used to enable web browsing. In addition to the mac address, the Company will also save the information about the browsing start time and its duration, measured at the end of browsing. This data is never used for user profiling, but may be communicated to the competent authorities if an offense is committed, in order to identify the user.
 
The wi-fi service uses only the technical and analytics cookies indicated in the Cookie Policy.
 
The provision of such personal data for these purposes is mandatory and a refusal to provide the data may make it impossible for the Company to carry out the purpose for which the personal data is collected.

3.3. Profiling purposes
 
The Company, with the user's consent, will process his/her personal data for the performance of profiling activities, based on the information provided at the time of registration, which is understood in accordance with Article 4, paragraph 1, no. (4) of the Regulations: "any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular, to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements".
 
Where the user does not intend to give consent for profiling purposes, the consequence will be the impossibility for the Company to proceed with the relevant processing. Failure to give consent will not cause any interference and/or consequence on any other negotiation, contractual or other types of relationship with the user.

3.4. Marketing Purposes
 
The Company, with the user's consent, will process his/her personal data for the periodic sending of e-mail messages containing advertising, communications relating to airport information, new initiatives and promotional material, as well as Company services, carried out through automated contact systems (SMS and/or e-mail).
 
Where the user does not intend to give consent for marketing purposes, the consequence will be the impossibility for the Company to proceed with the relevant processing. Failure to give consent will not cause any interference and/or consequence on any other negotiation, contractual or other types of relationship with the user.

4. Transfer of personal data to countries outside the European Union.

The data collected and processed are not transferred to companies or other parties outside the EU territory.

5. Data retention times

With reference to the personal data processed for the pursuit of the purposes referred to in sections 3.1 and 3.3, they will be stored in compliance with the principle of proportionality and until the purposes of the processing have been achieved.

In any case, with reference to the data referred to in paragraph 3.1, these will be stored for a period not exceeding 2 years, it being understood that, in case of interaction with the Site through login, this storage period will start from the latter interaction. In order to revoke consent, the procedures set out in paragraph 7 below apply.
 
With reference to the profiling and marketing purposes referred to in points 3.4 and 3.5., the data will be retained for a period of 12 months and 24 months respectively.

6. Data controller

The identification details of the data controller company are as follows:

Società per azioni Esercizi Aeroportuali S.E.A., with registered office in Segrate (Milan) - 20054 - at Milan-Linate Airport.

7. Data Protection Officer (DPO)

You can contact the Data Protection Officer, also to exercise your rights pursuant to articles 15-22 of the Regulation, by sending an email to: privacy@seamilano.eu.

8. User rights

In relation to the processing of data, you are entitled to exercise the rights set out in Articles 15 to 22 of the Regulation. Specifically, you have the right to:
 
(a)     access and request a copy;
(b)     request rectification;
(c)     request cancellation;
(d)     obtain restriction of processing;
(e)     oppose processing;
(f)      receive such data in a structured, commonly used and machine-readable format and transmit such data without hindrance to another controller, where technically feasible.
 
To exercise your rights and to withdraw consent, you may send a notification to the Data Protection Manager, in the manner indicated in paragraph 7 above, indicating in the subject "Withdrawal of consent to data processing".
 
You have the right to file a complaint or report with a supervisory authority, in particular in the Member State where you habitually reside, work or where the alleged breach has occurred. In the event that you wish to refer the matter to the Data Protection Supervisory Authority, you may do so by:
 
a)      registered letter with return receipt addressed to the Garante per la protezione dei dati personali, Piazza Venezia, 11, 00187 Roma;
 
b)      e-mail to: garante@gpdp.it, or protocollo@pec.gpdp.it;
 
(c)     fax number: 06/69677.3785.

Exercising of such rights is not subject to any formal restriction and is free of charge.