Porsche Experience Center – Franciacorta
We, Porsche Italia S.p.A. (hereinafter referred to as “we“, “us” or “Porsche ltalia“), are pleased that you have chosen to visit our website and/or access the services offered by us at the Porsche Experience Center Franciacorta (hereinafter referred to as “PEC“) We thank you for your expression of interest in our company and in our products and services We consider your privacy as a key priority We take the protection of your personal data very seriously and will treat your personal data as strictly confidential. The processing of personal data is carried out exclusively in accordance with the legislation on data protection and, more specifically, with the provisions of the General Data Protection Regulation of the European Union (Regulation EU 2016/679, hereinafter referred to as the “GDPR“).
1. Data contfoller, data pfotection officef and contact details
The Data Controller under the data protection legislation is:
Porsche Italia S.p.A.
Corso Stati Uniti 35
If you have any questions or comments about data protection, you may contact our designated Data Protection Officer as follows:
Data Protection Officer (DP0]
Porsche Italia S.p.A.
Corso Stati Uniti 35
2. Protection of your personal data
The object of data protection is personal data. Personal data refer to all information linked to an identified or identifiable natural person (referred to, within the meaning of privacy legislation, as a data subject]. This includes, by way of example, information such as your name, postal address, email address or telephone number, as well as information necessarily originating from the use of our Website, such as data relating to the start, end and scope of use, and disclosure of the user’s IP address or services, such as information relating to access to PEC Franciacorta and information relating to the services you have used.
3. Type, scope, pufpose and legal basis of automatic data processing
With regard to the Website, please note that, in principle, you may use the Website without the need to register. Personal data may be processed even if the Website is used without registration.
In the following sections you will find a description of the type, scope, purposes and legal bases of the data processing carried out by us within the Website and in relation to your registration (if any] to use the services of the PEC Franciacorta, access to the PEC Franciacorta and the delivery of related services.
3.1 Processing related to the Website
When you access the Website through your device, the Company will automatically process the following data:
- • Date and time of access
- • Duration of visit
- • Type of device
- • Operating system used
- • Functions used
- • Amount of data sent
- • Typeofevent
- • URLreferrer
- • IP address
- • Domain name
Such data are processed by the Company on the basis of Article 6 (1) (f) of the GDPR to provide the service, ensure its technical operation, identify and correct any errors. In so doing, the Company pursues the purpose of facilitating and ensuring the long-term use of its Website and the technical operation thereof. When the Website is selected, the processing of such data will be automatic It is not possible to use the services of the Company unless such data are provided. The Company does not use these data to draw conclusions about you or your identity.
User can register to use the services by creating a personal profile. Without registration, users may not be able to access some of the services available on the Website and provided by the PEC (or may be able to use the Website with a limited number of functions available and only some of the services of the PEC).
Input fields marked with an “*” indicate that the data to be entered are required for registration and generally include: title, first and last name, date and place of birth, postal address and email address, tax identification number or VAT registration number for billing purposes. Registration will not be allowed unless such required data are provided. When registering, users also have the option of entering, on a voluntary basis, other information such as their company name and driving licence details. This additional information is not required to register and the users alone will decide whether they wish to provide such information. However, failure to provide such data may, in certain cases, result in the Company being unable to deliver the services in the best possible way for the benefit of the users.
The Company will use the personal data provided by the users during the registration process to create a linked personal profile and to identify the individual users each time they log in. The applicable legal basis for such data processing procedures is Article 6(1)(b] of the GDPR. Other data may be collected and linked to those of the personal profile, depending on the service for which a user intends to register. When using the offers and services described in detail below, other personal data (e.g. payment details specified when making purchases) may also be collected and processed and disclosed to third parties in order that these offers and services may be provided to the users.
The Company will implement all processing procedures described in this section on the basis of the user’s consent, to fulfil the contract entered into with the user or on the basis of its legitimate interests, where specified.
More information about other offers and services is provided in the following section.
3.4 Other contact details
If you provide us with personal data via email or a contact form, this will always be done on a voluntary basis. Your information will be processed by us to follow up your contact request and in accordance with Article 6(1](b) (if your request relates to a possible contract to be entered into with us or a contract already entered into with us] or (f) (for any other type of request) of the GDPR. Moreover, this information may, as part of the above process, also be disclosed to third parties (e.g. our Porsche Centres).
3.5 Processing related to the delivery of PEC services, access to PEC and Free WI-FI
If you use the PEC Services, or register to use them, we will process the personal data that you will provide to us at the time of registration (email address, first name, last name, date and place of birth, address of residence, tax identification number or VAT registration number, unique code to access the Porsche Owner program, copy of driving license, password and login details of the authentication system] and the personal data that we will collect at the time of your access and as part of your using the services (for example, data relating to goods and services purchased by you and/or which you use at the PEC, time of access to the areas where the services are delivered, as well as the data included in the disclaimers for the use of cars and equipment) (if you do not give consent to profiling, such personal data will be retained only for two weeks and then will be anonymised). Such data will be processed to (i) perform the contract relating to our goods and/or services, , (ii) fulfil your specific requests prior to acceptance of the contract, (iii) enable you to use the Service (Article 6(1)(b) of the GDPR); (iv) comply with legal obligations (in relation to the purchases you have made, we will process your personal data to comply with legal obligations regarding tax and consumer protection, pursuant to Article 6(1](c] of the GDPR]; (v] pursue our legitimate interest in ensuring the security of the areas and facilities of the PEC and the services provided through the PEC, pursuant to Article 6(1](c] and (f]. Any processing for marketing and/or profiling purposes will be carried out only after obtaining your consent, in accordance with the provisions of Article 7 below.
With regard to the processing of the personal data of the users who intend to connect to the WI-FI network open to the public, available at the PEC, please refer to the provisions set out in the specific disclosure, which can be viewed when accessing the WI-FI service through the link shown at the bottom of the WI-FI service registration form.
3.6 Data related to audio/photo/video recordings in relation to Track Driving Activities and data related to photographs for kart activities
Subject to your free and optional consent (Article 6(1)(a) of the GDPR), we may collect your personal data consisting of audio, photo and video recordings containing your image and/or voice, during the course of the track activities in which you participate at the PEC (hereinafter referred to as the “Track Driving Activities”). In this regard, it should be noted that both photographs and audio/video recordings (hereinafter collectively referred to as “Recordings”) may be shot during the course of Track Driving Activities. Recordings may be made available to the participants in Track Driving Activities and published on hard copy, websites, social media of Porsche Italia S.p.A. and/or other promotional media. However, if you do not wish to appear in the Recordings, you may refuse to consent to the processing of your personal data and inform the Company’s staff. In this case, you will be given a special badge signifying that you do not wish to be filmed. Your personal data contained in the Recordings will be retained for as long as the Recordings are published on the channels set out in this section 3.6.
Subject to your free and optional consent (Article 6(1)(a) GDPR), we may take a picture of you and process the personal data contained therein for the sole purpose of displaying your picture in connection with information about the progress/results of Kart activities. The picture, again subject to your free and optional consent (Article 6(1)(a] GDPR] may be stored in our databases and reused in connection with your future Kart activity at the PEC. In the absence of your consent, the picture will be deleted within 48 (forty-eight) hours after completion of your activity.
3.7 Data contained in the disclaimers for Track Driving Activities, karts and simulators
The personal data contained in the disclaimers, acknowledgement of regulations and assumption of liability will be processed by the Company to (i) execute the disclaimer or respond to your specific requests before signing the disclaimer, and (ii) where necessary, exercise or defend a legal claim of the Company (Article 6 (1) b) and (c) of the GDPR). The data referred to in this paragraph will be processed and retained by the Company until the end of the period of validity and effectiveness of the disclaimers.
3.8 Processing of personal data collected for the purpose of containment of C0VID-1 9 infection
In view of recent events related to the spread of COVID-19 and the need to take the relevant containment and prevention measures, anyone wishing to enter the PEC will have their body temperature taken at the time of entry. We will process the relevant personal data: (i) ) for the protection of the health of individuals and the containment and prevention of infection by COVID-19, so as to establish whether access to the PEC may be granted (including pursuant to Article 9(2)(i) i) of the GDPR); and (ii) to comply with the legal obligations binding on us, including those related to the implementation of anti-contagious safety protocols (Article 6(1)(c] and Article 9(2)(g] of the GDPR). The processing of data relating to body temperature also falls within the above-mentioned purposes. These data will be used only to take your body temperature in real time in order to establish whether or not you may be granted access to the PEC and they will not be recorded or retained, except that individuals whose body temperature exceeds the permitted limits will not be allowed to access the premises.
4. Protection of legitimate interest
The Company will also process the user’s personal data to protect its own legitimate interests. In addition to the interests specified in the description of individual offers and services in Sections 3.1, 3.3, 3.4, 3.5, data processing procedures are implemented on the Website or following completion of registration, with special reference to the following interests:
- Ensuring the availability, operation and security of technical systems, as well as technical data management;
- Further development of products, services and service offerings;
- Processing of data on a centralised platform dedicated to existing and potential customers, as well as on downstream and upstream systems for sales and customer loyalty purposes in order to offer customised assistance;
- Customer segmentation and customer’s needs analysis, e.g. calculating and assessing affinities, preferences and potential;
- Pursuing our legitimate interest in exercising or defending a legal claim in or out of court.
These data are processed on the basis of Article 6 (1) (f) of the GDPR.
5 Consent to processing for marketing and profiling purposes
Subject to your free and optional consent (Article 6(1)(a) of the GDPR), we will process your data for marketing purposes (direct sales, sending advertising material, carrying out market research, commercial communications, sending race rankings at the end of the competitions held at the kart track and customer satisfaction surveys). In this connection, we may send you information and offers regarding products, services and events related to the Porsche brand (including products and services offered by Porsche-authorised service centres), by post, email, SMS, fax, fixed/mobile phone with or without operator, WhatsApp and social media (such as, for example, Facebook, Instagram and Twitter). The consent to the processing of your personal data is free and optional and failure to provide such consent will neither prevent you from entering into a contract with us nor will it result in you suffering any detrimental consequences. You may withdraw your consent to the processing of your data for marketing purposes at any time and free of charge, without any consequences, by contacting us as specified under 11 below, including selectively, i.e. stating that you no longer wish to be contacted.
Subject to your free and optional consent (Article 6(1)(a) of the GDPR), we will process your personal data (personal data; contact details; data relating to the purchase of goods and services; data optionally provided by you in relation to your personal characteristics, tastes and habits) for profiling purposes, in order to (i) be able to send you promotional communications that are personalised and consistent with your profile (for example, if you have purchased a service or an experience at the PEC, we will send you promotional communications relating to the experiences that you can enjoy at the PEC through the use of our cars and other equipment made available to you, as well as promotional communications relating to the cars offered for sale by us; if you have provided information regarding your age, we will send you promotional communications regarding products and services that are suitable for people of your age), (ii) perform statistical analysis and processing regarding the personal characteristics of Porsche vehicle owners and customers of services and experiences delivered at the PEC, and (iii) perform evaluations and analyses, such as segmentation and analysis of potential sales, analysing and improving our customer service offerings and programmes, and analysing purchasing habits and behaviour to support sales and customer service. Failure to consent to the processing of your personal data for profiling purposes or to provide the requested data for profiling purposes will neither prevent you from entering into a contract with each Data Controller nor will it result in you suffering any detrimental consequences. You may in any case freely withdraw your consent and object to the processing of your personal data for profiling purposes at any time and free of charge, without any consequences, by submitting a request to each Data Controller as specified under 11 below.
6.6. Personal data recipients
Internal recipients: The only people within Porsche Italia who have access to personal data include individuals who need such access for the purposes as specified.
External recipients: The Company will only disclose your personal data to recipients outside Porsche Italia if this is necessary for the handling or processing of your request, if there is another legal authorisation or if the Company has received your consent to disclose your data.
External recipients include:
a) Data Processors
Group companies within Porsche Italia or external service providers on whom the Company relies for the supply of services, e.g. in the areas of maintenance and technical infrastructure for the Porsche Italia offering or the provision of content. The Company carefully selects and regularly audits such data processors to ensure privacy protection. Service providers may use the data only for the purposes specified by the Company and in accordance with the Company’s instructions.
b) Public entities
Public authorities and bodies, such as public prosecutors, courts or financial authorities to which the Company is required to disclose personal data for legal reasons. The data are disclosed pursuant to Article 6(1)(c) of the GDPR.
c) Private entities
Porsche dealers and service companies, partners, service providers or persons to whom data are disclosed based on consent, for the performance of a contract entered into with the user or for the protection of legitimate interests, e.g. other Porsche dealers and Porsche Service Centres, lending institutions, providers of other services or transport service providers. The data are disclosed pursuant to Article 6(1) (a), (b) and/or (f) of the GDPR.
d) Other companies belonging to the Porsche Group for marketing and profiling purposes
Subject to your optional consent (Article 6(1](a] of the GDPR], we will disclose your personal data to other companies belonging to the Porsche Group* for marketing purposes (direct sales, sending advertising material, conduct of market research, commercial communication and customer satisfaction surveys] and to send you information and offers regarding our own or the Porsche Group’s products and services Porsche that may be of interest to you, via post, email, SMS, fax and fixed/mobile phone with or without operator, WhatsApp and social media (such as, for example, Facebook, Instagram and Twitter). In addition, the other companies of the Porsche Group may process such data in pursuit of their legitimate interests, including for (i) profiling purposes, in order to (i) offer you goods and services that are consistent with your profile, including by processing for such purposes personal data already in their possession, such as data relating to purchases of goods and services previously made by you, and (ii) perform assessments and analyses, such as segmentation and analysis of potential sales, studying and improving offerings and customer service programmes and analysing purchasing habits and behaviour with a view to supporting sales and customer service. Your consent to the disclosure of your personal data to such third parties is entirely optional, and failure to provide such consent will not result in you suffering any detrimental consequences. Even if you give your consent, you may withdraw it at any time by notifying us as specified under 11 below. You may also freely withdraw your consent to the processing of your data by these third parties for marketing purposes or object to the processing of your data for profiling purposes by such third parties by contacting them directly or by contacting Porsche Italia.
7. Processing of data in third party countries
Where data are disclosed to entities whose headquarters or place of data processing is not located in a Member State of the European Union or in another country outside the European Union that is a signatory to the Treaty, prior to the transfer the Company will, except where permitted by law regarding recipients, make sure that (i] an adequate level of data protection is in place (e.g., through an adequacy decision by the European Commission under Article 45 of the GDPR], by ensuring appropriate protection measures as under Article 45 of GDPR or by entering into so-called EU standard contractual clauses with the data importer under Article 46(2)(c] GDPR, or, alternatively, by fulfilling the obligations and providing the protections under Article 49(1] of GDPR], or (ii] you have given your consent to such data transfer pursuant to Article 49(1)(a) of the GDPR. The Company may provide you with a summary of recipients located in third countries and a copy of the regulations specifically agreed to ensure the appropriate level of data protection. To receive such summary, please refer to the contact details provided under 11 below.
8. Retention period and deletion
Insofar as the description of the individual offers and services does not contain any specific information about the retention period or deletion of data, the following shall apply.
The Company will retain the personal data of the user exclusively for the period of time necessary to pursue the intended purpose or, if a consent has been given, until such consent is withdrawn. If the user withdraws his or her consent to the processing of personal data, then the Company will delete such data unless the relevant legal provisions require further processing. The Company will also delete personal data if it is required to do so for other legal reasons.
In line with these general principles, in general the Company will delete personal data immediately if:
- The legal basis on which the processing is based should no longer apply, unless further retention is necessary in order to comply with legal obligations or in order to pursue other legitimate processing purposes. If the latter is the case, we will delete the data after the further legal basis also no longer applies;
- They are no longer required for the purposes of preparing and performing a contract or pursuing legitimate interests and no other legal basis exists (such as if further retention is required to comply with legal obligations regarding taxation or the retention of company records). If another legal basis exists, then we will delete your data when such other legal basis no longer applies.
For example, personal data belonging to the following categories will be retained for the periods as stated below:
- Your data, collected during registration, will be retained as long as your account remains active and will be deleted after your account is closed.
- The data relating to purchases made at the PEC and the relative payments will be kept until completion of the administrative/accounting procedures and expiry of the limitation periods for any disputes as well as in accordance with the obligations as laid down by applicable tax law provisions;
- If you have contacted us in relation to a purchase made on the Website or from the PEC via one of the contact channels available on the Store, we will retain any correspondence exchanged between you and us for 10 years, as required under applicable laws on retention of company records and correspondence.
- The data referred to under 3.6 (Data relating to audio/photo/video recordings in relation to Track Driving Activities and data relating to photographs for Kart activities), 3.7 (Data contained in the disclaimers for Track Driving Activities, karts and simulators) and 3.8 (Processing of personal data collected for the purposes of containing COVID-19 infection] will be retained for the periods as specified in the relevant sections;
- The data relating to the time of access to the various services of the PEC recorded automatically at the time of access will be retained for 15 (fifteen) days for security reasons and then will be anonymised and used solely for statistical purposes and internal analysis;
- Where you have consented to the processing of your personal data for marketing purposes, your personal data will be processed until you withdraw your consent to the processing of your data for marketing purposes. Contact details will be retained in any case in order to pursue any other purposes for which they are processed.
9. Rights of the data subjects
As a data subject, users have a number of rights. In particular, by contacting us as set out in section 11 below:
Right of Access: Users have the right to obtain information from the Company in relation to their data held by the Company.
Right of rectification and right to erasure: Users have the right to obtain from the Company the rectification of inaccurate personal data and erasure of their personal data, provided that legal obligations are complied with.
Restriction of processing: Users have the right to obtain from the Company restriction of processing of their own data, provided that legal obligations are complied with.
Right to data portability: Where the processing of your personal data is based on consent or on a contract and is carried out by using automated means, you have the right to obtain, without any impediment, the data concerning you in a structured, commonly used and machine-readable format and the right to transfer such data to another data controller.
Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you pursuant to Article 6(1)(f) (processing based on a legitimate interest), including profiling based on such provision. Where the personal data are processed for direct marketing purposes, data subjects have the right to object at any time to the processing of their personal data carried out for such purposes, including profiling insofar as it is related to such direct marketing;
Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the relevant supervisory authority if you believe that the processing of your data violates the applicable law. You may contact the Data Protection Authority (“www.garanteprivacy.it] or any other Supervisory Authority of the Member State of the European Union where you live or work..
10. Integration of third-party offers
Websites and services provided by other suppliers, which are linked to our Website, are designed and operated by third parties. The Company does not have any influence on the structure, content or role of such third party services. The Company explicitly distances itself from the content of all third party offers related to its Website. Third party offerings linked to the Website may install their own cookies on your device or collect personal data. The Company has no influence on this aspect. Please contact the providers of such offerings linked to the Website, as required, for the relevant information.
11.How to reach us
You may contact us free of charge for any questions regarding the processing of your personal data and to exercise your rights. Please contact us by email at firstname.lastname@example.org or by post at the address under 1 above. Make sure you identify yourself clearly. Porsche Italia has appointed a Data Protection Officer (DPO), who can be contacted by post at the Porsche Italia address listed above (specifying for the attention of the DPO) or by email at email@example.com.