pursuant to European Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and pursuant to current Italian legislation
Società per azioni Esercizi Aeroportuali S.E.A., having its registered office in Segrate (Milan) – 20090 – at the Milan-Linate Airport, ("Company
") in providing the services offered as part of the "Autism Project" ("Service(s)
"), processes the personal data provided by the data subjects in its capacity as Data Controller, pursuant to articles 4, no. 7) and 24 of EU Regulation No. 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data ("Regulation
"), as well as in compliance with current Italian legislation.
Processing of personal data means any operation or set of operations performed with or without the aid of automated processes and applied to personal data or sets of personal data, even if not recorded in a database, such as their collection, recording, organisation, structuring, storage, processing, selection, blocking, adaptation or alteration, retrieval, consultation, use, communication by transmission, dissemination or any other form for making the data available, the comparison or interconnection of the data and their limitation, cancellation or destruction.
The Company will therefore proceed, in accordance with the Regulation and the applicable Italian legislation, to said processing for the purposes listed below, either manually and/or with the support of computer or telematic means.
1. Purpose and legal basis of processing
The data are acquired and processed in compliance with the rules established by the Regulation and by the applicable Italian legislation only insofar as is necessary to provide the Service ("Primary Purpose
In particular, the following personal data are collected and processed: (i) personal data of a common or ordinary nature (personal data and contact details); (ii) special data (health-related data) relating to the person with autism; (iii) flight data (if communicated).
The data subjects are: minors or adults with autism, as well as family members, caregivers or their legal guardians.
The personal data specified above are processed for the following purposes: A) in order to provide the Service and to manage the passenger service as requested; B) to issue daily passes for access to airport areas in order to help passengers get acquainted with the relevant facilities.
The legal basis for the processing of the personal data is therefore: the data subject’s explicit consent (or of those exercising parental authority or the data subject’s legal guardian) for the purposes referred under point A); legal obligations for the purposes referred to under point B).
2. Communication and dissemination of personal data for the pursuit of the Primary Purposes
The data may be disclosed to third parties when such disclosure is required by law, including in the context of the prevention/suppression of any illegal activity. With reference to article 13, paragraph 1, letter (e) of the Regulation and to the applicable Italian legislation, the data may be communicated only insofar as is necessary to achieve the Primary Purposes, to the Company's employees/partners/consultants, as well as to third-party companies with which the Company collaborates in order to pursue the Primary Purposes. The updated list of external Data Processors is available at the Company's registered office.
The data will not be disclosed, or rather, the personal data will not be disclosed to the public or, in any case, to an indefinite number of subjects.
3. Mandatory or optional provision of data for the pursuit of the data processing purposes
3.1 Primary Purposes
The provision of the data to the Company is mandatory only for data for which there is a regulatory obligation to that end.
Any refusal to provide such mandatory data may force the Company to obtain them from third parties (where legally permitted) or make it impossible for the Company to provide the Service. Any refusal to provide data for which disclosure is not mandatory under the law, but strictly functional to the provision of the Service, does not have any consequences on ongoing relationships between the Company and the data subject, except for the fact that it may prevent the Company from following up on the operations related to such data or prevent it from providing the Service.
In any case, even where the data subject has given his/her consent to authorise the Company to pursue all the purposes mentioned in the above points, he/she will still be free to revoke such consent at any time.
We specifically and separately inform you, as required by art. 21 of the Regulation, where applicable, that the data subject has the right to object at any time to the processing of personal data concerning him/her carried out for such purposes and that, if the data subject objects to the processing, the personal data may no longer be processed for such purposes.
4. Transfer of personal data to countries outside the European Union.
The data collected and processed shall not be transferred to companies or other entities located outside the European Union.
5. Data retention
With reference to personal data processed for the pursuit of the Primary Purposes, they shall be retained in compliance with the principle of proportionality and as long as the purposes of the processing are being pursued, for a period of no longer than 2 years.
6. Data Controller
The identification details of the Company that acts as the Data Controller are provided below:
Società per azioni Esercizi Aeroportuali S.E.A., with registered office in Segrate (Milan) – 20090 – at the Milan-Linate Airport.
7. Data Protection Officer (DPO)
Data subjects may contact the Data Protection Officer, including for the purpose of exercising their rights, pursuant to Articles 15-22 of the Regulation, simply by sending an e-mail to firstname.lastname@example.org
8. Rights of the data subject
In relation to the processing of their personal data, data subjects are entitled to exercise the rights referred to in Articles 15 to 22 of European Regulation No. 2016/679, reproduced in summarised form in Annex A to this statement.
The exercise of the rights is not subject to any formal constraint and is free of charge.
European Regulation on the protection of personal data
Articles 15 to 22
Pursuant to Articles 15 to 22 of European Regulation No. 2016/679, the data subject has the right to obtain from the Data Controller the rectification, integration or erasure (so-called right to be forgotten) of his or her personal data; the right to obtain the restriction of the processing and the right to data portability; the right to object to the processing of personal data, including for profiling purposes; and finally, the right to file a complaint with the Italian Data Protection Authority.
Form for expressing explicit consent to the processing of personal data
(of the adult passenger (18 years or above) or of the parent(s) or legal guardian(s))