INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA
(Articles 13 and 14 of Regulation (EU) 2016/679)
What is this information about?
This information notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and applies to personal data relating to you - as data subject and Reporting Person or Person Involved pursuant to, respectively, Articles 2(1)(g) and 2(1)(l) of Legislative Decree No. 24/2023 - and collected by Lega Nazionale Professionisti Serie A, with registered office in Milan (MI) at Via Ippolito Rosellini 4 - in its capacity as data controller (hereinafter, “LNPA”, the “Data Controller”, “we” or “our”, as the case may be) - through the internal reporting channel activated by LNPA pursuant to Legislative Decree No. 24/2023.
What categories of personal data do we collect?
We may collect the following categories of personal data:
(1) Identifying data such as first name and surname;
(2) Contact data such as e-mail address(es), telephone number(s), postal address(es);
(3) Other information relating to you (including information relating to the special categories of personal data referred to in Articles 9 and 10 of the GDPR) included in the reports or otherwise acquired in the course of any investigation initiated by the Supervisory Body.
The provision of your personal data is optional but necessary for the purposes listed below; if you do not provide your personal data, we may not be able to fulfil such purposes.
How do we collect your personal data?
If you act as a Reporting Person, we collect most of your personal data directly from you through your report or in the course of any investigation initiated by the Supervisory Body. If, on the other hand, you act as a Person Involved, we collect most of your personal data from the Reporting Person.
Moreover, whether you act as a Reporting Person or as a Person Involved, we may also collect certain of your personal data from third parties (e.g. persons interviewed in the course of any investigation initiated by the Supervisory Body), public registers or open sources.
We do not use any form of solely automated decision-making process in connection with the processing of your personal data.
For what purposes and on what legal basis do we process your personal data?
Your personal data will be processed to enable us to handle your reports and, in particular, to:
(1) comply with legal obligations to which we are subject;
(2) protect personnel, assets and property of the company;
(3) prevent, investigate and prosecute the commission of offences and conduct subject to disciplinary action;
(4) establish, exercise or defend a right in judicial or administrative proceedings or in arbitration or conciliation proceedings.
The processing of your personal data for the purposes under (1) does not require your consent as it is necessary to comply with legal obligations to which we are subject, pursuant to Article 6(1)(c) of the GDPR. The processing of your personal data for the purposes under (2), (3) and (4) does not require your consent as it is necessary to pursue our legitimate interests underlying such purposes, pursuant to Articles 6(1)(f) and 9(2)(f) of the GDPR.
How do we process your personal data?
If the internal reporting channel activated by the LNPA provides for the possibility of reporting via telephone lines or voice messaging systems, your voice, subject to your consent, may be recorded for the purpose of documenting the report.
In the processing of your personal data, we take appropriate technical and organisational measures to ensure a level of security appropriate to the risks of destruction, loss, (accidental or unlawful) alteration of personal data and unauthorised disclosure of or access to the same.
How long do we keep your personal data?
Your personal data included in reports and relevant documents will be kept for as long as necessary to follow up on the same, and in any case for no longer than five years from the date of the communication of the final outcome of the reporting procedure. It is understood that, should we decide to initiate disciplinary proceedings or judicial or administrative proceedings or arbitration or conciliation proceedings as a result of the report, your personal data shall be kept for the duration of the proceedings or the period of limitation of the rights for the establishment, exercise or defence of which the processing is necessary, even if longer than the storage periods indicated above.
To whom are your personal data disclosed?
If you act as a Reporting Person, your personal data shall be processed exclusively by the Supervisory Body and its Auxiliaries, who shall act as persons authorised to process them pursuant to Articles 29 and 32(4) of the GDPR and Article 2-quaterdecies of Legislative Decree No. 196/2003, and shall not be disclosed to third parties without your consent, without prejudice to the provisions of Article 12 of Legislative Decree No. 24/2023 and any further exceptions provided for by law.
If you act as a Person Involved, on the other hand, your personal data may be communicated to the following parties, who will act as persons authorized to processing, data processors or autonomous data controllers:
(1) Auxiliaries;
(2) people heard in the course of any investigation initiated by the Supervisory Body;
(3) our employees or collaborators in any capacity;
(4) employees or co-workers in any capacity of any parent, subsidiary or associated company;
(5) suppliers of services and consultants (e.g. lawyers, accountants, labour consultants, private investigators);
(6) judicial and police authorities.
Should any of the above-mentioned entities be based outside the European Economic Area (EEA), we will transfer your personal data, in the absence of an adequacy decision and without recourse to any of the exemptions set out in Article 49 of the GDPR, on the basis of the standard contractual clauses set out in Article 46(2)(c and d) of the GDPR.
Your rights under data protection law
Pursuant to Articles 15 to 22 of the GDPR, you have the right to:
(1) be informed of the purposes and methods of the processing of personal data;
(2) access to personal data;
(3) rectify incomplete, inaccurate or outdated personal data;
(4) obtain the erasure of personal data;
(5) obtain, in the cases provided for by law, the restriction of the processing of personal data;
(6) object in whole or in part, in the cases provided for by law, to the processing of personal data;
(7) obtain, if technically feasible, portability of personal data.
Where consent is required for the processing of personal data, you may also withdraw the consent already given at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
You may exercise the above rights and request any information on the processing of personal data by contacting the Supervisory Body at its email address.
Furthermore, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (www.garanteprivacy.it), if you consider that your rights under the GDPR have been infringed.
It is understood that, pursuant to Article 2-undecies of Legislative Decree No. 196/2003, should the exercise of the aforementioned rights result in an actual and concrete prejudice to the confidentiality of the identity of the Reporting Person, we shall not follow up on your request. If you act as a Person Involved, we may, in any case, delay, limit or exclude the exercise of your rights for the time and to the extent necessary to safeguard the confidentiality of the identity of the Reporting Person. We shall give you reasoned notice thereof. In such a case, you may exercise your rights through the Italian Data Protection Authority in the manner set out in Article 160 of Legislative Decree No. 196/2003.
