Privacy Notice on the Processing of Personal Data pursuant to Article 13 of the European Union General Data Protection Regulation 2016/679 (“GDPR”)
Data Controller
The Data Controller of your personal data is Arena Milano Management S.r.l. (hereinafter the “Data Controller” or the “Company”), subject to the direction and coordination of CTS EVENTIM AG & Co. KGaA, Tax Code No. 14208180969, with registered office at Via Fabio Filzi No. 29, Milan, Italy.
For any request relating to the processing of personal data, the Data Controller may be contacted at the following addresses: (i) Arena Milano Management S.r.l., Via Fabio Filzi No. 29, 20124 Milan, Italy; (ii) Certified Electronic Mail (PEC): arenamilano@legalmail.it.
The Company has appointed a Data Protection Officer (hereinafter the “DPO”), based in Milan, at Via Fabio Filzi No. 29.
The DPO may be contacted regarding matters relating to the processing of personal data and the exercise of the rights provided for under the GDPR at the following address: dpo@unipoldome.it.
Types of Personal Data Collected
The Data Controller processes the personal data of users who access and use the “Future Market” self-service stores located inside Unipol Dome. These stores feature an automated purchasing system that allows users to select products and complete their purchases without going through a traditional checkout.
To enable the system to operate, the following categories of personal data are processed:
Images and video footage captured by cameras installed inside the Future Market;
Data relating to the user's location and movements within the Future Market;
Data relating to interactions with products, including products picked up or returned to the shelves, and data relating to the virtual shopping cart;
Technical data and sensor data associated with the operation of the system and its integrated devices;
Transaction data and partial payment card data used for access and payment, limited, where applicable, to the Bank Identification Number (BIN), the card expiry date and the last four digits of the card used.
Images captured by the cameras are not used to identify users through biometric recognition. The system processes images to detect users' movements within the Future Market and their interactions with products, assigning each user an anonymous token and representing their movements within the store through a stylised figure (“avatar”). Faces appearing in the images are subjected to a blurring process before the images are potentially transmitted to and stored in the cloud.
Purposes of Personal Data Processing
Personal data are processed for the following purposes:
To enable access to and use of the Future Market and the completion of purchases by tracking users' movements within the store and their interactions with products, identifying products picked up or returned to the shelves, creating and updating the virtual shopping cart, and managing the transaction and related payment;
To manage any disputes relating to purchases made, verifying, where necessary, the correct matching of products picked up with those charged for;
To ensure the proper functioning, maintenance and technical support of the system, including the analysis and resolution of any anomalies, malfunctions or errors;
To retain data for the periods necessary to fulfil the above purposes and to comply with any applicable legal obligations.
Data may also undergo anonymisation and aggregation processes. Data resulting from such processes, where they no longer allow data subjects to be identified, directly or indirectly, may be used for analysis purposes and to improve the functionality and accuracy of the artificial intelligence system.
Legal Basis for Processing
Processing activities necessary to enable access to and use of the Future Market, detect selected products, create and update the virtual shopping cart, manage transactions and related payments, and handle any disputes relating to purchases made are based on the performance of a contract with the user, pursuant to Article 6(1)(b) of the GDPR.
Where the retention or further processing of certain data is necessary to comply with legal obligations, the processing is based on compliance with a legal obligation to which the Data Controller is subject, pursuant to Article 6(1)(c) of the GDPR.
Activities aimed at analysing and improving the functionality and accuracy of the artificial intelligence system are carried out using previously anonymised data, which do not allow data subjects to be identified and therefore do not constitute personal data within the meaning of the GDPR.
Recipients of Personal Data
Personal data may be processed by the Data Controller's duly authorised personnel, who have received appropriate instructions in accordance with applicable legislation, as well as by third parties providing services necessary or related to the management and operation of the Future Market.
In particular, AiFi Inc., as the provider of the technological solution used to operate the Future Market, processes personal data on behalf of the Data Controller in its capacity as a data processor pursuant to Article 28 of the GDPR. AiFi Inc. may engage additional parties appointed as sub-processors, in compliance with the conditions laid down by applicable legislation and the agreements in place with the Data Controller.
Personal data may also be disclosed to public bodies or competent authorities where required by law.
Countries to Which Personal Data May Be Transferred
Your personal data are processed by the Data Controller within the European Economic Area (EEA).
If, in connection with the services provided by AiFi Inc. and its