In compliance with Legislative Decree no. 139/2021 and Regulation (EU) 2016/679, concerning the protection of natural persons with regard to the processing of personal data and the free movement of such data, Sportit maintains a register of processing activities, containing the following information:
- User’s name and personal details
- Purpose of the processing
- Description of the categories of data subjects and the categories of personal data
- Categories of recipients to whom the personal data are or will be disclosed
The following Privacy Policy is intended to inform users about the use and protection of their personal data. We consider it essential to provide clear and transparent information on how personal data are collected and used. For the collection and storage of data, we adhere to the following principles:
- Lawfulness, fairness and transparency: personal data are processed lawfully, fairly and in a transparent manner in relation to the data subject;
- Data minimisation: personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
- Accuracy: personal data must be accurate and, where necessary, kept up to date; all reasonable steps must be taken to ensure that inaccurate personal data are erased or rectified without delay.
- Storage limitation: personal data must be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the data are processed.
- Integrity and confidentiality: personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against accidental loss, destruction or damage.
This policy specifically details:
- What are personal data?
- Who is the data controller of the personal data?
- Which data are collected and at what time?
- Minors and third parties
- Is it mandatory to provide personal data?
- Why are personal data collected?
- Who will have access to my data?
- Are personal data transferred abroad?
- How long are the data retained?
- What are my rights and how can I exercise them?
- What security measures are in place for my data?
- What are cookies and trackers?
- Methods of data processing
- Updates to this Privacy Policy
1. What are personal data?
Within the scope of this policy, the term “Personal Data” or “Data” refers to any information that directly or indirectly identifies you, such as your name, address, phone number, email address, IP address, and other data provided directly through platforms owned by Sportit or generated through browsing activity or interactions with customer support.
2. Who is the Data Controller of the personal data and the DPO?
The Data Controller is the individual or entity that determines the purposes and means of the processing of such data.
Sportit S.r.l., with registered office in Milan, Piazza Santa Francesca Romana 3, 20129, registered with the Milan Companies Register under no. MI – 2098729, tax code and VAT number 09545330962, an online travel agency authorized by the Municipality of Milan (authorization no. MI-SUPRO/0146812 dated 08/08/2018), insured under policy no. 1505002199/Z issued by Nobis Compagnia di Assicurazioni S.p.A., and contactable at [email protected], is the Data Controller of the personal data under the conditions described in this Privacy Policy.
The Data Controller’s organization has appointed a Data Protection Officer (“DPO”), who is available to provide any information relating to the processing of personal data carried out, including the list of data processors. The DPO can be contacted at: [email protected].
3. Which data are collected and at what time?
The data we collect and process vary depending on the products, services, or features used. We collect data provided when you use our services, in particular when:
- You browse and access platforms owned by Sportit through the use of cookies and trackers;
- You create an account to access the services offered;
- You add products to the shopping cart;
- You place an order;
- You subscribe to newsletters and special offers;
- You contact customer service by phone, email, or chat;
- You participate in a survey or a satisfaction questionnaire;
- You interact with us on our social media channels;
- You respond to a job offer on our website.
Within the scope of our activities, the data collected include:
- Automatic data: IP addresses and domain names of the computers used by users connecting to the website, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response provided by the server, and other parameters relating to the user’s operating system, browser, and IT environment.
- Website browsing data collected through cookies and trackers;
- Identification data, such as first name, last name, phone number, email address, and residential address for delivery;
- Data relating to order details, payments, and deliveries;
- Call recordings of conversations with customer service (with the option to refuse recording);
- Data relating to educational background and professional experience for candidates applying for job opportunities.
Only in the event that documents are uploaded to obtain discounts reserved for specific categories:
- Facial recognition is used to compare the photo on the uploaded document and verify its authenticity. All uploaded documents are stored only for the time strictly necessary to complete the verification process and are then permanently deleted.
4. Minors and third parties
If you provide the personal data of a third party, you undertake to do so with that person’s consent, after having informed them of the conditions under which their personal data are collected, used, stored, and disclosed.
5. Is it mandatory to provide personal data?
Some information requested in the forms is mandatory and is indicated by an asterisk or a specific note. The collection of such information is essential for processing your request. Consequently, if this information is not provided, it will not be possible to proceed with your request.
6. Why are personal data collected?
The processing of personal data is based on your consent and is carried out for the management of the following purposes:
| Purposes | Legal basis (lawfulness) | Further details on the use of the data |
| Fulfilment and management of product orders | Performance of the purchase contract | Issue invoices, manage product payments, deliveries, and returns after purchase. |
| Fulfilment and management of product orders | Consent | The storage of payment card data for future purchases is carried out only at your request. |
| Fulfilment and management of product orders | Legitimate interest | After a purchase has been completed, we may carry out checks to prevent fraud, in particular through the use of automated data processing. |
| Fulfilment and management of product orders | Legitimate interest | After a purchase, we may conduct surveys and questionnaires aimed at assessing customer satisfaction in order to improve the quality of our products and services. |
| Allow and manage registration on platforms owned by Sportit | Performance of the contract | By creating an account as a user of platforms owned by Sportit, you provide the personal data necessary to identify you and to access the various services. |
| Allow and manage registration on platforms owned by Sportit | Performance of the contract | By creating an account as a user of platforms owned by Sportit, you provide the personal data necessary to identify you and to access the various services. |
| Commercial prospecting and marketing activities | Consent | By subscribing to the newsletter, you gain access to exclusive services such as access to daily event sales and will receive emails informing you about the start of sales and news. If you accept the applicable terms and conditions (in particular those relating to social networks), we may publish on our Website or on our official social media pages the photographs or stories that you share publicly or directly with us. |
| Manage communication with customer service | Performance of the contract | If the request relates to an order, the processing of the data is necessary for the performance of the contract and for the proper management of after-sales services. |
| Manage communication with customer service | Legitimate interest | Handle requests and complaints and respond to your inquiries. |
| Manage communication with customer service | Legitimate interest | When you contact our Customer Service, telephone conversations may be recorded for quality control and training purposes. |
| Manage communication with customer service | Legal obligations | If the request concerns the exercise of the rights set out in section 10, “What are my rights and how can I exercise them?”, we will process your personal data in order to comply with our legal obligations. |
| Improve the Website and your customer experience | Legitimate interest | Ensure the operation of the Website and allow you to make the most of its features. |
| Improve the Website and your customer experience | Legitimate interest | Ensure the security of the Website. |
| Improve the Website and your customer experience | Legitimate interest | Measure Website traffic and compile anonymous visit statistics based on legitimate interest. |
| Recruitment management | Performance of the contract (pre-contractual measures) | We review and respond to all job or internship applications we receive. |
| Recruitment management | Legitimate interest | Creation of a CV database |
| Management of pre-litigation or litigation matters | Legitimate interest | To sanction violations of the Website’s general terms and conditions or any other identified breach, and to manage disputes or litigation. |
| Display of skiing performance | Consent | Processing of data generated through the use of the ski pass and related services (e.g. ski resorts visited, lift accesses, distance covered, elevation gain, and activity metrics) in order to create and make available to the user a personalized dashboard of their performance within the app. Access to the “Performance” section is subject to acceptance of the data display conditions. |
| Management of insurance services and claims | Performance of the contract | The User’s personal data may be disclosed to insurance partners exclusively for the purpose of managing, verifying, and settling claims related to insurance policies purchased through the platform. Such partners act as independent data controllers. |
In addition, the data will be processed in anonymized and/or aggregated form in order to improve the web browsing experience and to monitor the proper functioning and security of the portal. Furthermore, your data will be processed to comply with obligations provided for by laws, regulations, and/or EU legislation, or imposed by supervisory and control authorities. In this case, the legal basis for the processing is compliance with legal obligations to which the Data Controller is subject. This website processes your data lawfully and fairly, adopting appropriate security measures to prevent unauthorized access, disclosure, alteration, or destruction of your data.
7. Who will have access to my data?
Your personal data are processed by authorized personnel of Sportit. We may also disclose your personal data to:
- Commercial partners that provide the service ordered by the customer (e.g. equipment rental centers, ski schools, hotels).
- Sub-processors such as:
- IT service providers;
- Payment service providers and fraud prevention service providers;
- Logistics service providers;
- Transportation service providers;
- Marketing solution providers;
- Providers of commercial prospecting and communication management services;
- Customer service providers;
- Providers of prize contest and promotional game services;
- Customer satisfaction research service providers;
- Service providers.
- Lawyers, legal assistants, court officers, or administrative or judicial authorities involved in any potential dispute, in compliance with the legal obligations incumbent upon Sportit or in order to allow Sportit to defend its rights and interests;
8. Are my data transferred abroad?
The collected data are not transferred abroad.
9. How long are my data retained?
The collected data will be retained for a period no longer than is necessary to achieve the purposes for which they are processed (“storage limitation principle”, Article 5, GDPR), or in accordance with the retention periods provided by law. The relevance and obsolescence of the stored data in relation to the purposes for which they were collected are periodically reviewed.
10. What are my rights and how can I exercise them?
10.1 The content of your rights
You may exercise the following rights relating to your personal data.
- Right of access: this right allows you to obtain access to the data we process and to information relating to their processing.
- Right to rectification: the right to request the updating or modification of your data.
- Right to erasure: this is the right to be forgotten, which allows you to request the deletion of your data, unless the data are necessary for the provision of services or for Sportit to comply with its legal obligations or to establish, exercise, or defend its rights;
- Right to define instructions regarding the fate of personal data after death: the right to set instructions concerning the handling of personal data after one’s death, by appointing a trusted third party, duly authorized, to ensure that the deceased person’s wishes are respected.
You also have:
- The right to obtain restriction of processing: this right allows you to have the processing of your data restricted in certain cases provided for by the applicable regulations.
- The right to data portability: this right allows you to receive the data you have provided or to have them transferred to another entity where the processing is based on your consent or on a contractual relationship.
- The right to object: this is the right to object to the processing of your data or to request that such processing cease.
10.2 Exercising your rights
The exercise of your rights may be carried out by email at [email protected], specifying the information necessary to verify your identity.
11. What security measures are in place for my data?
Technical and organizational measures have been implemented to protect personal data, in particular against breaches that could result, whether accidentally or unlawfully, in the destruction, loss, alteration, unauthorized access to, or unauthorized disclosure of such data.
These measures ensure an appropriate level of security and take into account the state of the art, the implementation costs relative to the risks, and the nature of the data to be protected.
12. What are cookies and trackers?
When you use our website, information related to your browsing activity is recorded in the form of cookies and trackers. You can modify your preferences at any time regarding the recording of this data by accepting or blocking cookies or trackers.
13. Methods of data processing
The personal data you provide will be subject to processing in compliance with the aforementioned regulations and the confidentiality obligations guiding the activities of the Data Controller. The data will be processed using both IT tools and paper records, as well as any other suitable medium, in accordance with appropriate security measures pursuant to Article 5(1)(f) of the GDPR.
This Privacy Policy does not apply to other websites that may be accessed through links on the Data Controller’s websites, and the Data Controller cannot in any way be held responsible for third-party websites.
14. Updates to the Privacy Policy
Please note that this Privacy Policy, provided pursuant to Article 13 of the Privacy Code, is subject to periodic updates, which will be clearly indicated.
Last updated: This Privacy Policy was last updated on 24/10/2022.
