pursuant to Article 13 of Regulation (EU) 2016/679 on the protection of natural persons in respect of processing activities and to ensure the free movement of such data, and under the applicable Italian laws and regulations
 
Società per azioni Esercizi Aeroportuali S.E.A., with registered offices in Segrate (Milan) - 20054 at Milan-Linate Airport (the “Company”), in the performance of customer assistance services, such as requesting information, complaints, reporting lost / found items, accessible on the websites www.milanomalpensa-airport.com  and www.milanolinate-airport.com or from the relevant paper forms available at the airport (“Service”), processes the personal data (“Personal Data”) provided by data subjects in its capacity as data controller under Articles 4 (7) and 24 of Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons in respect of processing activities and to ensure the free movement of such data (the “Regulation”) and in compliance with the applicable Italian laws and regulations.

The term processing shall mean any operation or set of operations, whether or not by automated means and applied to personal data or sets of personal data, including when not recorded in a data bank, such as collection, recording, organisation, structuring, storage, processing, selection, blocking, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The Company shall, therefore, under the Regulation and in compliance with the applicable laws and regulations in force in Italy, process personal data for the purposes listed below, including manually and/or with the assistance of computer or telecommunication systems.

1 - Purposes and legal grounds for processing
The Personal Data shall be acquired and processed in compliance with the rules set in the Regulation and under the applicable Italian laws for the provision of the Service to the data subject (hereinafter, “Primary Purposes”), performing a contract to which the data subject is party or taking steps at the request of the data subject prior to entering into a contract.

2 - Communication and disclosure of personal data for the pursuit of the Primary Purposes for processing
The Personal Data may be communicated to third parties when the communication thereof is mandatory under the law, including for the purposes of prevention/suppression of any illegal activity. With regard to Article 13, paragraph 1, letter (a) of the Regulation and the applicable Italian laws and regulations, the Personal Data may be disclosed exclusively for the pursuit of the above Primary Purposes to the staff/collaborators/consultants of the Company, and to third-party companies providing assistance to the Company in the pursuit of its Primary Purposes. An updated list of external data Processors is available at the registered offices of the Company.
The Personal Data, except as provided above, shall not be disclosed to the public or in any case to an undetermined number of people.

3 - Mandatory or Optional Provision of Personal Data for the Pursuit of the Purposes of Processing
The provision of Personal Data to the Company shall be optional.
 A refusal to provide data which provision is not mandatory under the law, but which are strictly functional to the performance of the Service, shall have no repercussions over the agreements in place, except that it may prevent carrying out operations connected to such data or the provision of the Service.

4 - Transfer of personal data to Countries Outside of the European Union
The data collected and processed are not transferred to companies or other entities outside the territory of the European Community.

5 - Data storage period
With reference to Personal Data processed for the pursuit of the service of reporting lost and found items they shall be retained in compliance with the principle of proportionality and as long as the purposes of the processing are being pursued, for a period of no longer than 5 years.
With reference to Personal Data processed for the pursuit of all other customer assistance services they shall be retained in compliance with the principle of proportionality and as long as the purposes of the processing are being pursued, for a period of no longer than 2 years.
In any case, Personal Data whose retention is not necessary in relation to the purposes for which they have been processed, and in any case upon expiry of the aforementioned retention periods, are deleted or transformed into anonymous form by the Company, also through third parties who in that case hold the position of data processors.

6 - Data Controller
The identification details of the Data Controller Company are the following:
Società per azioni Esercizi Aeroportuali S.E.A., with registered offices in Segrate (Milan) – 20054 – at Milan-Linate Airport.

7 - Data Protection Officer (DPO)
The Data Protection Officer can be contacted, including for the purpose of exercising the data subjects’ rights under Articles 15-22 of the Regulation, writing via e-mail to privacy@seamilano.eu.

8 - Rights of data subjects
As to the processing of Personal Data, data subjects may exercise the rights granted under Articles 15-22 of Regulation (EU) 2016/679, summarised in Annex A to this Privacy Policy Information. Data subject may exercise these rights by sending a request to the Data Protection Officer at privacy@seamilano.eu or by ordinary mail addressed to Data Protection Officer- 20054 Segrate (Milan), at Milan Linate Airport.
The above rights are not subject to any formal restrictions and can be exercised free of charge.
 
Annex A
European Regulation on the protection of personal data
Articles 15 to 22
 
Under Articles 15 to 22 of Regulation (EU) 2016/679, Data Subjects have the right to obtain the rectification, supplementing, or erasure of their personal data (also known as “right to be forgotten); the right to limit the processing of personal data and the right to data portability, the right to object to the processing of their personal data, including for profiling purposes, and lastly the right to lodge a complaint with the Privacy Supervisory Authority.