PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA
Pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)
ACCESSIBLE PACKAGE
Your privacy is important to us. For this reason, this notice provides you with all the information regarding the processing of your personal data, carried out in accordance with Regulation (EU) 2016/679 (“GDPR”). This notice is divided into sections covering the various aspects of processing, allowing you to easily identify the information relevant to you and understand its content in a clear and transparent manner.
1. Data Controller and Data Protection Officer
The data controller is Arena Milano Management S.r.l., with registered office at Via Fabio Filzi No. 29, 20124 Milan, Italy, email: privacy@unipoldome.it (the “Data Controller”, “we” or “us”).
Please note that the Company has appointed a Data Protection Officer (“DPO”), who may be contacted regarding matters relating to the processing of personal data at the address indicated above or by email at: dpo@unipoldome.it.
2. Who This Privacy Notice Applies To
This privacy notice applies to the person purchasing the Accessible Package (the “Purchaser”), the person with a disability who will use the service and requires specific accessibility measures (the “Eligible Person”) and, where applicable, their legal representative and the person accompanying them (the “Companion”), as defined in further detail in the Terms and Conditions for the Purchase and Use of Accessible Tickets, available at www.unipoldome.it/accessible-packages-terms-conditions, which we invite you to consult (the “Terms and Conditions”).
The Purchaser may also be the Eligible Person or the Companion.
3. What Data We Process
To manage the purchase of the Accessible Package and enable access to the event, we process the following data:
PURCHASER: first name and surname, contact details and order-related information.
ELIGIBLE PERSON: first name and surname, information necessary to identify accessibility requirements and documentation suitable for certifying eligibility for the requested benefits. Such documentation may contain health-related data, which constitute special categories of personal data under the GDPR. We also process the declaration or form through which explicit consent is provided, where such consent constitutes the legal basis for processing, as well as the personal data of the Eligible Person’s legal representative (first name and surname, capacity/title and consent form), where the Eligible Person lacks legal capacity and is unable to provide consent.
COMPANION: first name and surname and, where necessary, information solely relating to whether the age-of-majority requirement is met.
To minimise the amount of data processed, where possible, we ask you to submit a summary certificate or a copy of the relevant documentation with the diagnosis, medical history and any other unnecessary clinical information redacted. Only identifying information and the details strictly necessary to verify eligibility for the benefits and accessibility requirements must remain visible.
4. Why We Process Data, the Legal Basis and Retention Periods
(a) Order Management and Event Attendance
Purpose
We use the Purchaser’s and participants’ data to manage the Accessible Package order, allocate seats, send service-related communications, and handle any changes, cancellations or refunds.
Legal basis
Processing is necessary to enter into and perform a contract, pursuant to Article 6(1)(b) of the GDPR.
Retention period
Order-related data are retained for the duration of the contractual relationship and, subsequently, for ten years from the termination of the relationship, in accordance with the standard retention periods applicable to contractual, administrative and accounting records, without prejudice to any longer periods required by law or necessary in the event of disputes.
(b) Verification of Eligibility Requirements and Organisation of Accessibility Measures
Purpose
We use the Eligible Person’s documentation to verify whether the requirements for access to reserved rates, seats or services are met and to organise the necessary accessibility measures.
Legal basis
The processing of health-related data is based on the Eligible Person’s explicit consent, pursuant to Article 9(2)(a) of the GDPR.
The processing of personal data other than health-related data is based on the management and performance of the contract, pursuant to Article 6(1)(b) of the GDPR.
Retention period
Health-related documentation is retained only for the time necessary to verify eligibility and is deleted within three months of the event date.
The retention period applicable to processing based on the contract is as indicated in paragraph (a) above.
(c) Management of Free Parking and Other Ancillary Services
Purpose
Where requested, we use the data necessary to arrange free parking or other ancillary services included in the Accessible Package.
Legal basis
Processing is necessary for the performance of the contract, pursuant to Article 6(1)(b) of the GDPR.
Retention period
Data are retained for the duration of the contractual relationship and, subsequently, for ten years from the termination of the relationship, in accordance with the standard retention periods applicable to contractual, administrative and accounting records, without prejudice to any longer periods required by law or necessary in the event of disputes.
(d) Administrative, Tax and Accounting Obligations
Purpose
We process purchase-related data and any refund-related data to comply with administrative, tax and accounting obligations established by law.
Legal basis
The legal basis is compliance with a legal obligation, pursuant to Article 6(1)(c) of the GDPR.
Retention period
The relevant documentation is retained for ten years, unless longer periods are required by applicable legislation.
(e) Establishment, Exercise or Defence of Legal Claims
Purpose
In the event of complaints, disputes or legal proceedings, data may be processed to establish, exercise or defend the rights of the Organiser or third parties in judicial or extrajudicial proceedings.
Legal basis
For ordinary personal data, processing is based on the legitimate interest in protecting legal rights, pursuant to Article 6(1)(f) of the GDPR. For any health-related data, Article 9(2)(f) of the GDPR applies.
Retention period
Data are retained for the time necessary to manage the dispute and, subsequently, until the expiry of the applicable limitation periods or the final conclusion of the proceedings. During this period, access to the data is restricted to those who have an actual need to access them.
5. Whether Providing Data Is Mandatory or Voluntary
Providing the data necessary to manage the purchase, issue tickets and organise the requested services is mandatory. In the absence of such data, it will not be possible to complete or fulfil the order.
Providing the information and documentation necessary to verify eligibility is essential to benefit from the Accessible Package. If the documentation is not submitted within 72 hours of the request, or within any different deadline specified in the Terms and Conditions, the order may be cancelled and the purchase price refunded in accordance with the provisions of those Terms and Conditions.
Consent to the processing of health-related data is freely given and may be withdrawn at any time by writing to the contact details provided in this notice. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. However, if consent is withdrawn before verification has been completed, this may prevent the Accessible Package from being allocated or retained.
6. Who Can Access the Data
Data are processed by the Organiser’s authorised personnel, who have received appropriate instructions in relation to their duties. Health-related documentation is accessible exclusively to personnel specifically appointed to verify eligibility requirements.
Where necessary, data may be disclosed to IT service providers, security providers and access control service providers acting as data processors; professional advisers and public authorities, where required by law; and TicketOne S.p.A., for the management of the sales process and the fulfilment of its respective responsibilities, acting as a data processor.
Please note that TicketOne S.p.A. receives only sales data and, where necessary, the outcome of the eligibility verification process, but does not receive health-related documentation.
Health-related data are not disclosed to the public or otherwise made publicly accessible.
7. Transfers to Countries Outside the European Economic Area
Personal data are not transferred to countries outside the European Union and/or the European Economic Area.
However, should any service providers involve an international transfer of data, such transfers will be carried out, within the scope of the purposes described above, in compliance with Articles 44 et seq. of the GDPR. Depending on the circumstances and on a case-by-case assessment, transfers will be based on either an adequacy decision adopted by the European Commission or appropriate safeguards, such as Standard Contractual Clauses, supplemented, where necessary, by additional technical and contractual measures and safeguards.
Further information may be requested from the Data Controller.
8. Automated Decision-Making and Profiling
We do not use data for profiling activities and do not make decisions based solely on automated processing that produce legal effects concerning data subjects or similarly significantly affect them.
9. Data Subject Rights
The data subject, meaning the person to whom the personal data relate, has the right to request the exercise of the following rights from the Data Controller.
Right of access
You may request confirmation as to whether or not your personal data are being processed and, where this is the case, access to such data and specific information about the processing, including, by way of example, the purposes, the categories of data processed and the existence of the other rights listed below. You may also request a copy of your data.
Right to rectification
You have the right to request and obtain the rectification of personal data concerning you and/or the completion of incomplete personal data.
Right to erasure
You may obtain the erasure of your data without undue delay if: (i) the data are no longer necessary for the purposes for which they were collected; (ii) you have withdrawn your consent, where consent was the legal basis for processing, unless another legal basis for processing applies; (iii) you object to the processing of your data, as described below, and there are no overriding legitimate grounds for processing, or you object to the processing of your data for marketing or marketing-related profiling purposes; (iv) your data have been processed unlawfully; or (v) your data must be erased to comply with a legal obligation.
Please note that this right does not apply where processing is necessary, among other things, to comply with a legal obligation or to establish, exercise or defend a legal claim.
Right to restriction of processing
You have the right to obtain the restriction of the processing of your personal data, meaning that processing will be suspended for a certain period. This right does not prevent personal data from continuing to be processed where permitted by law.
Right to data portability
Where processing is carried out by automated means and is based on your consent or a contract, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format and to transmit those data to another data controller.
Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on the Data Controller’s legitimate interests, unless the Data Controller demonstrates compelling legitimate grounds for the processing that override your interests, rights and fundamental freedoms, or the processing is necessary for the establishment, exercise or defence of a legal claim.
In all cases, you have the right to lodge a complaint with the competent supervisory authority (the Italian Data Protection Authority – Garante per la Protezione dei Dati Personali – www.garanteprivacy.it), pursuant to Article 77 of the GDPR, if you believe that the processing of your data infringes applicable legislation.
The above rights may be exercised by submitting an informal request to the Data Controller. The request may be sent by post or email to the following addresses: Via Fabio Filzi No. 29, Milan, Italy; email: privacy@unipoldome.it.
10. How We Protect Your Data
We adopt technical and organisational measures appropriate to the level of risk, pursuant to Articles 5(1)(f) and 32 of the GDPR. Depending on the systems used, these measures include access restrictions, the separation of health-related documentation from other order data, encryption or equivalent protection measures during transmission and storage, access logging and scheduled deletion procedures.
11. Scope of This Privacy Notice and Additional Privacy Notices
This privacy notice governs exclusively the processing of personal data connected with access to, management of and provision of the Accessible Package. It does not cover any further processing carried out by the Data Controller for different purposes or in connection with other services, initiatives or relationships with the data subject.
Where necessary, the Data Controller reserves the right to provide specific additional privacy notices, which may supplement this notice solely in relation to the processing activities to which they refer.
12. Updates to This Privacy Notice
This privacy notice was published on 9 October 2026 and may be amended from time to time, including as a result of the entry into force of new sector-specific legislation, updates to or the provision of new services, or technological developments.
In such cases, the Data Controller will notify you and highlight the relevant updates.