Privacy Policy
Porsche Experience Center – Franciacorta

We thank you for your interest in our company and in our products and services. We consider your privacy a key priority. We take the protection of your personal data very seriously and treat your personal data as strictly confidential. Personal data is processed exclusively in compliance with the applicable data protection legislation, and in particular with the provisions of the General Data Protection Regulation of the European Union (EU Regulation 2016/679, hereinafter “GDPR”).

With this privacy policy, we inform you about the processing of your personal data and your rights as an interested party in the use of our website www.porsche-franciacorta.it (hereinafter the “Website“), the registration in order to use the services of the Porsche Experience Center (the “PEC“) and the usage of the services provided through the PEC. For further information concerning other products and services offered by Porsche Italy and by the other companies of the Porsche Group, please refer to the other privacy policies of our Company and of the other companies of the Porsche Group. Should there be links on external social media sites that refer to this privacy statement, the provisions herein will apply only if the data processing operations within these social media actually fall within our area of responsibility and unless there are more specific, and therefore prevalent, privacy indications relating to the treatments carried out on these social media.

1.  Data Controller, Data Protection Officer and Contacts

The Data Controller  pursuant to data protection legislation is:

Porsche Italia S.p.A.

Corso Stati Uniti 35 
35127 Padua  
Italy

If you have any questions or comments about data protection, you may contact our designated Data Protection Officer as follows:

Data Protection Officer (DP0]

Porsche Italia S.p.A.
Corso Stati Uniti 35  
35127 Padua

E-mail: privacy@porsche.it

2. Protection of your personal data

These data refer to all information linked to an identified or identifiable individual (indicated, in the context of the privacy legislation, as data subject). This includes, for example, information such as name, address, e-mail address or telephone number, as well as information necessarily deriving from the use of the Website: this includes, for example, data relating to its start, end and scope of use, and the communication of the user’s IP address or services, such as those relating to admissions to PEC Franciacorta and those relating to the services the user has used.

.

3. Type, scope, purpose and legal basis of automatic data processing

With regard to the Website, please note that, it is generally possible to use the Website without the need to register. Personal data may be processed even if the Website is used without registration.

In the following sections you will find a description of the type, scope, purposes and legal bases of the data processing carried out by us within the Website and in relation to your registration (if any] to use the services of the PEC Franciacorta, access to the PEC Franciacorta and the delivery of related services.

3.1 Processing related to the Website

When the user accesses the Website through their device the Company will automatically process the following data:

• • Date and time of access
• • Duration of the visit
• • Type of device
• • Operating system used
• • Features used
• • Amount of data sent
• • Type of event
• • URL referrer
• • IP address
• • Domain name

Such data are processed by the Company on the basis of Article 6 (1) (f) of the GDPR to provide the service, ensure its technical functioning, identify and correct any errors. In this way, the Company interest the purpose of facilitating and ensuring the long-term use of its Website and the technical operation thereof. When the Website is selected, the processing of such data will be automatic It is not possible to use the services of the Company unless such data are provided. The Company does not use these data to draw conclusions in relation to the users or their identity

3.2 Cookies

When users visit the Website, small files are saved on their device, the so-called “cookies”, which provide the users with an extensive range of functions, simplifying the use of the service and optimizing the Company’s offer. Please refer to the Website’s Cookie Policy for further information about the type, scope, purpose, legal basis and consent regarding the processing of data in relation to cookies.

3.3 Registration

The user can register to use the services by creating a personal profile. Without registration, users it may not be possible to access some of the services available on the Website and provided by the PEC (or may be able to use the Website with a limited number of features and only some of the services provided by the PEC).

Input fields marked with an “*” indicate that the data to be entered are mandator for registration and generally include: title, first and last name, date and place of birth, postal address and email address, tax code or VAT registration number for billing purposes. whether to provide such data

It is not possible to register without entering the mandatory data. When registering, users also have the possibility to deliberately enter, other information such as their company name and driving licence details. This additional information is not required to register and the users alone will decide whether whether to provide such data. However, failure to provide such data may, in certain cases, result in the Company being unable to deliver the services in the best possible way for the benefit of the users.

The Company will use the personal data provided by the users during the registration process to create a linked personal profile and to identify the individual users each time they log in. The applicable legal basis for such data processing procedures is Article 6(1)(b] of the GDPR. Other data may be collected and linked to those of the personal profile, depending on the service for which a user intends to register. When using the offers and services described in detail below, other personal data (e.g. payment details specified when making purchases) may also be collected and processed and disclosed to third parties so that these offers and services that be provided to the users.

The Company will implement all processing procedures described in this section on the basis of the user’s consent, to fulfil the contract entered into with the user or on the basis of its legitimate interests, as indicated.

You can find more information on other offers and services in the following section.

3.4 Other contact details

If you provide us with personal data via email or a contact form, this will always be done on a voluntary basis. Your information will be processed by us to follow up your contact request and in accordance with Article 6(1](b) (if your request relates to a possible contract to be entered into with us or a contract already entered into with us] or (f) (for any other type of request) of the GDPR, and in this context they can also be transmitted to third parties (e.g. to our Porsche Centers).

3.5 Processing related to the delivery of PEC services, access to PEC and Free WI-FI

If you use the PEC Services, or register to use them, we will process the personal data that you will provide to us at the time of registration (email address, first name, last name, date and place of birth, address of residence, tax identification number or VAT registration number, unique code to access the Porsche Owner program, copy of driving license, password and login details of the authentication system] and the personal data that we will collect at  the time of your access and as part of your using the services (for example, data relating to goods and services purchased by you and/or which you use at the PEC, time of access to the areas where the services are delivered, as well as the data included in the disclaimers for the use of cars and equipment) (if you do not give consent to profiling, such personal data will be retained only for two weeks and then will be anonymised). Such data will be processed to (i) perform the contract relating to our goods and/or services, , (ii) fulfil your specific requests prior to acceptance of the contract, (iii) enable you to use the Service (Article 6(1)(b) of the GDPR); (iv) comply with legal obligations (in relation to the purchases you have made, we will process your personal data to comply with legal obligations regarding tax and consumer protection, pursuant to Article 6(1](c] of the GDPR]; (v] pursue our legitimate interest in ensuring the security of the areas and facilities of the PEC and the services provided through the PEC, pursuant to Article 6(1](c] and (f]. Any processing for marketing and/or profiling purposes will be carried out only after obtaining your consent, in accordance with the provisions of Article 7 below. 

With regard to the processing of the personal data of the users who intend to connect to the WI-FI network open to the public, available at the PEC, please refer to the provisions set out in the specific disclosure, which can be viewed when accessing the WI-FI service through the link shown at the bottom of the WI-FI service registration form. 

3.6 Data related to audio/photo/video recordings in relation to Track Driving Activities and data related to photographs for kart activities 

With to your free and optional consent (Article 6(1)(a) of the GDPR), we may collect your personal data consisting of audio, photo and video recordings containing your image and/or voice, during the course of the track activities in which you participate at the PEC (hereinafter referred to as the “Track Driving Activities”). In this regard, that both photographs and audio/video recordings (hereinafter collectively referred to as “Recordings”) may be shot during the course of Track Driving Activities. Recordings may be made available to the participants in Track Driving Activities and published on hard copy, websites, social media of Porsche Italia S.p.A. and/or other promotional media. However, if you do not wish to appear in the Recordings, you may refuse to consent to the processing of your personal data and inform the Company’s staff. In this case, you will be given a special badge signifying that you do not wish to be filmed. Your personal data contained in the Recordings will be retained for as long as the Recordings are published on the channels set out in this section 3.6.

With to your free and optional consent (Article 6(1)(a) GDPR), we may take a picture of you and process the personal data contained therein for the sole purpose of displaying your picture in connection with information about the progress/results of Kart activities. The picture, again subject to your free and optional consent (Article 6(1)(a] GDPR] may be stored in our databases and reused in connection with your future Kart activity at the PEC. In the absence of your consent, the picture will be deleted within 48 (forty-eight) hours after completion of your activity.

3.7 Data contained in the waivers for Track Driving Activities, karts and simulators 

The personal data contained in the waivers, of acceptance of regulations and assumption of responsibility will be processed by the Company to (i) execute the waiver or respond to your specific requests before signing the disclaimer, and (ii) where necessary, exercise or defend a right of the Company in court (Article 6 (1) b) and (c) of the GDPR). The data referred to in this paragraph will be processed and retained by the Company until the end of the period of validity and effectiveness of the waivers.

3.8 Processing of personal data collected for the purpose of containing Covid-19 infection

In view of recent events related to the spread of COVID-19 and the need to take the related containment and prevention measures, anyone wishing to enter the PEC will have their body temperature taken at the time of entry. We will process the relevant personal data: (i) ) for the protection of the health of individuals and the containment and prevention of infection by COVID-19, so as to establish whether access to the PEC may be granted (including pursuant to Article 9(2)(i) i) of the GDPR); and (ii) to comply with the legal obligations binding on us, including those related to the implementation of anti-contagious safety protocols (Article 6(1)(c] and Article 9(2)(g] of the GDPR). The processing of data relating to body temperature also falls within the above-mentioned purposes. These data will be used only to take your body temperature in real time in order to establish whether or not you may be granted access to the PEC and they will not be recorded or retained, except that individuals whose body temperature exceeds the permitted limits will not be allowed to access the premises.

4. Protection of legitimate interest 

The Company will also process the user’s personal data to protect its own legitimate interests. In addition to the interests specified in the description of individual offers and services in Sections 3.1, 3.3, 3.4, 3.5, data processing procedures are implemented on the Website or following the completion of the user’s registration, with special reference to the following interests:

• Ensuring the availability, operation and security of technical systems, as well as technical data management;
• Further development of products, services and service offerings;
• Processing of data on a centralised platform dedicated to existing and potential customers, as well as on downstream and upstream systems for sales and customer loyalty purposes in order to offer customised assistance;
• Customer segmentation and customer’s needs analysis, e.g. calculating and assessing affinities, preferences and potential;
• Pursuing our legitimate interest in exercising or defending our rights in or out of court.

These data are processed on the basis of Article 6 (1) (f) of the GDPR.

5 Consent to processing for marketing and profiling purposes

5.1 Marketing

With to your free and optional consent (Article 6(1)(a) of the GDPR), we will process your data for marketing purposes (direct sales, sending advertising material, carrying out market research, commercial communications, sending race rankings at the end of the competitions held at the kart track and customer satisfaction surveys). In this connection, we may send you information and offers regarding products, services and events related to the Porsche brand (including products and services offered by Porsche-authorised service centres), by post, email, SMS, fax, fixed/mobile phone with or without operator, WhatsApp and social media (such as, for example, Facebook, Instagram and Twitter). The consent to the processing of your personal data is free and optional and failure to provide such consent will neither prevent you from entering into a contract with us nor will it result in you suffering any detrimental consequences. You may withdraw your consent to the processing of your data for marketing purposes at any time and free of charge, without any consequences, by contacting us through the modalities indicated in paragraph 11 below, also selectively, stating that you no longer wish to be contacted via one or more contact methods.

5.2 Profiling

With to your free and optional consent (Article 6(1)(a) of the GDPR), we will process your personal data (personal data; contact details; data relating to the purchase of goods and services; data optionally provided by you in relation to your personal characteristics, tastes and habits) for profiling purposes, in order to (i) be able to send you promotional communications that are personalised and consistent with your profile (for example, if you have purchased a service or an experience at the PEC, we will send you promotional communications relating to the experiences that you can enjoy at the PEC through the use of our cars and other equipment made available to you, as well as promotional communications relating to the cars offered for sale by us; if you have provided information regarding your age, we will send you promotional communications regarding products and services that are suitable for people of your age), (ii) perform statistical analysis and processing regarding the personal characteristics of Porsche vehicle owners and customers of services and experiences delivered at the PEC, and (iii) perform evaluations and analyses, such as segmentation and analysis of potential sales, analyse and improve our offer and customer service programmes, and analyse purchasing habits and behaviour to support sales and customer service. If you do not consent to the processing of your personal data for profiling purposes or to provide the requested data for profiling purposes will neither prevent you from entering into a contract with each Data Controller nor the possibility of entering into a contract with each Controller shall not in any way be affected nor shall you suffer any adverse consequences.

You may in any case freely withdraw your consent and object to the processing of your personal data for profiling purposes at any time and free of charge, without any consequences, by submitting a request to each Data Controller as specified in paragraph 11 below.

6.6. Personal data recipients

Internal recipients: The only people within Porsche Italia who have access to personal data include individuals who need such access for the specified purposes.

External recipients: The Company will only disclose your personal data to recipients outside Porsche Italia if this is necessary for the handling or processing of your request, if there is another legal authorisation or if the Company has received your consent to disclose your data.

External recipients include:

a) Data Processors

Group companies within Porsche Italia or external service providers on whom the Company relies for the supply of services, e.g. in the areas of maintenance and technical infrastructure for the Porsche Italia offering or the provision of content. The Company carefully selects and regularly audits such data processors to ensure privacy protection. Service providers may use the data only for the purposes specified by the Company and in accordance with the Company’s instructions.

b) Public entities

Public authorities and bodies, such as public prosecutors, courts or financial authorities to which the Company is required to disclose personal data for legal reasons. The data are disclosed pursuant to Article 6(1)(c) of the GDPR.

c) Private entities

Porsche dealers and service companies, partners, service providers or persons to whom data are disclosed based on consent, for the performance of a contract entered into with the user or for the protection of legitimate interests, e.g. other Porsche dealers and Porsche Service Centres, lending institutions, providers of other services or transport service providers. The data are disclosed pursuant to Article 6(1) (a), (b) and/or (f) of the GDPR.

d) Other companies belonging to the Porsche Group for marketing and profiling purposes

With to your optional consent (Article 6(1](a] of the GDPR], we will disclose your personal data to other companies belonging to the Porsche Group* for marketing purposes (direct sales, sending of advertising material, conduct of market research, commercial communication and customer satisfaction surveys] and to send you information and offers regarding our own or the Porsche Group’s products and services Porsche that may be of interest to you, via post, email, SMS, fax and fixed/mobile phone with or without operator, WhatsApp and social media (such as, for example, Facebook, Instagram and Twitter). In addition, the other companies of the  Porsche  Group may process such data in pursuit of their legitimate interests, including for (i) profiling purposes, in order to (i) offer you goods and services that are consistent with your profile, including by processing for such purposes personal data already in their possession, such as data relating to purchases of goods and services previously made by you, and (ii) perform assessments and analyses, such as segmentation and analysis of potential sales, to study and improve our offer and customer service programmes and analysing purchasing habits and behaviour with a view to supporting sales and customer service. Your consent to the disclosure of your personal data to such third parties is entirely optional, If you do not give your consent, you will not suffer any detrimental consequences. Even if you give your consent, you may withdraw it at any time by notifying us as specified under 11 below. You may also freely withdraw your consent to the processing of your data by these third parties for marketing purposes or object to the processing of your data for profiling purposes by such third parties by contacting them directly or by contacting  Porsche Italia. 

“These companies include: (J) Dr. Ing. h.c. F.  Porsche  AG (registered office at  Porscheplatz 7, 70435 Stuttgart – Germany. Contact details for the exercise of rights: datenschutz@porsche.de. Contact details of the Data Protection Officer Dr. Ing. h.c. F.  Porsche  AG Data Protection Officer,  Porscheplatz 7 – 70435 Stuttgart – Germany; datenschutz@porsche.de); (2)  Porsche  Smart Mobility GmbH (registered office at  Porscheplatz 7, 70435 Stuttgart – Germany; dataprotectionofficer.smartmobility@porsche.com); (3)  Porsche  Financial Services GmbH (registered office  PorscheStrasse 1. D-74304 Bietigheim-Bissingen, Germany). D-74304 Bietigheim-Bissingen, Germania). Unless otherwise specified in the privacy policies of such companies, the provisions of this privacy policy shall — insofar as they are compatible — apply to the processing carried out by them.

7. Processing of data in third party countries

Where data are disclosed to entities whose headquarters or place of data processing is not located in a Member State of the European Union or in another country outside the European Union that is a signatory to the Treaty,

the Company ensures that, prior to the forwarding of the data and apart from exceptional cases permitted by law concerning the recipient, an appropriate level of data protection exists e (e.g., through an adequacy decision by the European Commission under Article 45 of the GDPR], by ensuring appropriate protection measures as under Article 45 of GDPR or by entering into so-called EU standard contractual clauses with the data importer under Article 46(2)(c] GDPR, or, alternatively, by fulfilling the obligations and providing the protections under Article 49(1] of GDPR], or (ii] you have given your consent to such data transfer pursuant to Article 49(1)(a) of the GDPR.  The Company may provide you with a summary of recipients located in third countries and a copy of the regulations specifically agreed to ensure the appropriate level of data protection. To receive such summary, please refer to the contact details provided in paragraph 11 below.

8. Retention period and deletion

Insofar as the description of the individual offers and services does not contain any specific information about the retention period or deletion of data, the following provisions shall apply.

The Company will retain the personal data of the user exclusively for the period of time necessary to pursue the intended purpose or, if a consent has been given, until such consent is withdrawn. If you revoke your consent to the processing of personal data, then the Company will delete such data unless the relevant legal provisions require further processing. The Company will also delete personal data if it is required to do so for other legal reasons.

 In line with these general principles, in general the Company will delete personal data immediately if:

• If the legal basis on which the processing is based should no longer apply, unless further retention is necessary in order to comply with legal obligations or in order to pursue other legitimate processing purposes. If the latter is the case, we will delete the data after the further legal basis also no longer applies;

• If they are no longer required for the purposes of preparing and performing a contract or pursuing legitimate interests and no other legal basis exists (such as if further retention is required to comply with legal obligations regarding taxation or the retention of company records). If another legal basis exists, then we will delete your data when such other legal basis no longer applies.

For example, personal data belonging to the following categories will be retained for the periods as stated below:

1. Your data, collected during registration, will be retained as long as your account remains active and will be deleted after your account is closed.
2. The data relating to purchases made at the PEC and the relative payments will be kept until completion of the administrative/accounting procedures and expiry of the limitation periods for any disputes as well as in accordance with the obligations as laid down by applicable tax law provisions;
3. If you have contacted us in relation to a purchase made on the Website or from the PEC via one of the contact channels available on the Store, we will retain any correspondence exchanged between you and us for 10 years, as required under applicable laws on retention of company records and correspondence.
4. The data referred to under 3.6 (Data relating to audio/photo/video recordings in relation to Track Driving Activities and data relating to photographs for Kart activities), 3.7 (Data contained in the disclaimers for Track Driving Activities, karts and simulators) and 3.8 (Processing of personal data collected for the purposes of containing COVID-19 infection] will be retained for the periods as specified in the relevant sections;
5. The data relating to the time of access to the various services of the PEC recorded automatically at the time of access will be retained for 15 (fifteen) days for security reasons and then will be anonymised and used solely for statistical purposes and internal analysis;
6. Where you have consented to the processing of your personal data for marketing purposes, your personal data will be processed until you withdraw your consent to the processing of your data for marketing purposes. Contact details will be retained in any case in order to pursue any other purposes for which they are processed.
7. Information on how long cookies are stored can be found in our Cookie Policy.

9. Rights of the data subjects

As a data subject, users have a number of rights. In particular, by contacting us as set out in section 11 below: 

Right of Access: Users have the right to obtain information from the Company in relation to their data held by the Company.

Right of rectification and cancellation: Users have the right to obtain from the Company the rectification of inaccurate personal data and the cancellation of their personal data, provided that legal obligations are complied with.

Restriction of processing:

Users have the right to request the Company to limit the processing of their data, provided that legal obligations are complied with.

Right to data portability: Where the processing of your personal data is based on consent or on a contract and is carried out by using automated means, you have the right to obtain, without any impediment, the data concerning you in a structured, commonly used and machine-readable format and the right to transfer such data to another data controller.

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you pursuant to Article 6(1)(f) (processing based on a legitimate interest), including profiling based on such provision. Where the personal data are processed for direct marketing purposes, data subjects have the right to object at any time to the processing of their personal data carried out for such purposes, including profiling insofar as it is related to such direct marketing;

Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the relevant supervisory authority if you believe that the processing of your data violates the applicable law. You may contact the Data Protection Authority (“www.garanteprivacy.it] or any other Supervisory Authority of the Member State of the European Union where you live or work..

10. Integration of third-party offers

Websites and services provided by other providers, which are linked to our Website, are structured and operated by third parties. The Company does not have any influence on the structure, content or role of such third party services. The Company explicitly distances itself from the content of all third party offers related to its Website. Third party offerings linked to the Website may install their own cookies on your device or collect personal data. The Company has no influence on this aspect. Please contact the providers of such offerings linked to the Website, as required, for the relevant information.

11.How to contact us

You may contact us free of charge for any questions regarding the processing of your personal data and to exercise your rights. Please contact us by email at privacy@porsche.it or by post at the address above in point 1. Make sure you identify yourself clearly. Porsche Italia has appointed a Data Protection Officer (DPO), who can be contacted by post at the Porsche Italia address listed above (specifying for the attention of the DPO) or by email at privacy@porsche.it.       

12. Privacy Policy Version

The latest version of this privacy policy dated 21/7/2021 applies