PRIVACY POLICY

Updated on 1 December 2025

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 on the protection of personal data (the “GDPR”).

The purpose of this Privacy Policy (the “Privacy Policy”) is to explain the methods and purposes for which users’ personal data, namely information relating, directly or indirectly, to an identifiable user, are collected, processed and used through information society tools and services, such as websites, applications and Single Sign-On systems, hereinafter collectively referred to as the “Tools”, owned by Lega Nazionale Professionisti Serie A, hereinafter “Lega Serie A”, as well as the rights that users may exercise in relation to the processing of such data.

This Privacy Policy, together with the General Terms of Use, constitutes the Terms of Use of the Tools. Use of the Tools implies full acceptance of the Terms of Use. Should new or additional services be developed and introduced which require changes to the way users’ personal data are collected or processed, this Privacy Policy will be updated accordingly and users will be duly informed of the different purposes and methods applicable to the processing of their personal data. Users are also informed that the Terms of Use govern browsing, access to, use of and data processing activities connected with the Tools and the related services, without prejudice to the adoption of specific terms and conditions where required by the particular characteristics of the Tool used.

1. DATA PROCESSING ROLES

Lega Serie A acts as the Data Controller, namely the entity that independently determines the purposes and means of the processing and protection of users’ personal data.

Further information regarding the Data Controller is available on the website: https://en.legaseriea.it/.

Any third party involved shall provide the relevant specific information concerning the manner in which personal data are made available and processed.

The Data Controller has also identified and appointed a Data Protection Officer, commonly referred to as the “DPO”, who may be contacted through the same contact details as the Data Controller or via the dedicated email address dpo@legaseriea.it.

The Tools are owned by Lega Serie A (VAT No. 06637550960), with registered office at Via I. Rosellini 4, 20124 Milan, Italy, which may avail itself of the support, assistance and consultancy of external providers, as specified for each individual Tool.

2. CATEGORIES OF PERSONAL DATA PROCESSED

Through the Tools, users may access various types of services involving the processing of their personal data. Such data may be provided implicitly by the devices and systems used by users to access and use the Tools made available by the Data Controller, or may be actively and voluntarily provided by users themselves.

In particular, the Data Controller will process information relating to users that qualifies as “Common Personal Data”, namely all data provided by users or collected in the course of their activities, excluding the special categories of personal data referred to in Article 9 GDPR and personal data relating to criminal convictions and offences referred to in Article 10 GDPR.

The following specific categories may be identified among Common Personal Data:

“Browsing Data”: The IT systems and software procedures used to operate each website acquire, during their normal operation, certain personal data whose transmission is inherent in the use of Internet communication protocols. This category includes IP addresses, browser type, operating system, domain name, addresses of websites from which access was made or to which the user exited, information regarding pages visited within websites, applications or any other Tools used, location, access time, time spent on individual pages, internal navigation paths, information relating to interactions with content, such as content downloads, streaming activities and playback details, device metrics, and other parameters relating to the user’s operating system and IT environment.

“Login Data”: provided by users when completing and submitting registration forms in order to access services made available through the Tools. In such cases, the Data Controller collects users’ identification and contact details, such as first name, last name, email address, date of birth and language, which are necessary to manage the restricted area and, where applicable, provide the services available to users.

“Communication Data”: provided by users through email correspondence or other forms of communication, such as chat services, with the Data Controller. In this way, the Data Controller collects general identification data, such as first name, last name and email address, as well as any additional information that users choose to include in their communications.

“Contact Data”: provided by users by completing and submitting collection forms through which they may use services, such as subscribing to the Data Controller’s newsletter, or voluntarily participate in initiatives made available through the Tools, including games, quizzes, surveys and competitions.

“Behavioural Data”: are derived from users’ activities and include information relating to choices and/or preferences expressed through use of the Tools, such as favourite clubs and favourite players.

“Tracking Data”: means information that may be collected through specific software and technologies, including active and passive identifiers such as cookies, which perform reading and writing operations on users’ devices in order to collect information. For further and more detailed information, please refer to the Cookie Policy available on the Lega Serie A website.

3. PURPOSES OF PROCESSING PERSONAL DATA

In accordance with the GDPR, data collected through the Tools or in connection with the provision of the related services, as well as data otherwise provided directly by users, are processed through the Data Controller’s information systems using digital and analogue methods by duly authorised and trained personnel. In relation to the purposes of processing, users are informed as follows:

Browsing Data: Browsing Data will be processed to enable the use and management of the Tools, to generate aggregated information regarding use of the Tools, namely to understand how users generally interact with the Tools, to improve them and, where applicable, to offer more targeted services, to verify their proper functioning and, where applicable and subject to consent, to carry out profiling activities for the communication of personalised information.

Login Data: Login Data will be used to: a) identify users; b) allow users to exercise the available options by registering for, managing and cancelling them; c) allow users to manage and pay for the services selected in relation to each Tool, including services provided by third parties, provided that they are activated through the Data Controller’s identification system, and accessible through login credentials; d) carry out promotional activities.

Communication Data: Communication Data will mainly be used to: a) respond to requests and manage communications received; b) maintain records of correspondence.

Contact Data: Contact Data will be processed: a) to allow users to access the services they have selected or the options they have indicated, as well as to send any communications relating to interests expressed by them; b) to send commercial information, newsletters, special offers and promotional materials from the Data Controller, including on behalf of third parties, or from the entities identified in the relevant consent form, where consent is required; c) to profile users in order to improve the offering addressed to them and to carry out the marketing activities referred to in Section 4 below.

Behavioural Data: Behavioural Data will be processed: a) to personalise and improve the use of services and to select information and offers considered to be of interest to users; b) to carry out promotional activities.

Tracking Data: Tracking Data will be processed: a) with regard to strictly necessary cookies, to ensure the proper functioning of the relevant device and services; b) with regard to other tracking technologies, for the purposes defined and described in the Cookie Policy available on the Lega Serie A website.

4. LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

The legal basis for the processing of users’ personal data depends on the specific purpose of the relevant processing activity.

With regard to Browsing Data, processing for the purposes set out in the preceding section is based on the necessity of providing the browsing service pursuant to Article 6(1)(b) GDPR, as well as on the legitimate interest of the Data Controller, pursuant to Article 6(1)(f) GDPR, in analysing data relating to the Tools in order to understand how users interact with them and to improve them. Where Browsing Data are used for indirect marketing and promotional purposes, including through profiling techniques, the legal basis for processing is the user’s consent pursuant to Article 6(1)(a) GDPR.

With regard to Communication Data, where processed, the legal basis is the necessity of responding to a user’s request, taking pre-contractual measures at the user’s request and/or performing agreements entered into by the user, such as participation in competitions and quizzes, pursuant to Article 6(1)(b) GDPR. Processing may also be based on the legitimate interest of the Data Controller, pursuant to Article 6(1)(f) GDPR, in communicating information regarding its initiatives and promoting its activities. Where Communication Data are used for indirect marketing and promotional purposes, including through profiling techniques, the legal basis for processing is the user’s consent pursuant to Article 6(1)(a) GDPR.

With regard to Contact Data, the legal basis for processing is the necessity of responding to a user’s request pursuant to Article 6(1)(b) GDPR, as well as the legitimate interest of the Data Controller, pursuant to Article 6(1)(f) GDPR, in communicating information regarding its initiatives and promoting its activities.

Where Contact Data are used for indirect marketing and promotional purposes, including through profiling techniques, the legal basis for processing is the user’s consent pursuant to Article 6(1)(a) GDPR.

With regard to Login Data, the legal basis for processing is the necessity of performing a contract to which the data subject is a party or taking pre-contractual measures pursuant to Article 6(1)(b) GDPR. Where Login Data are used for direct marketing purposes, processing is based on the legitimate interest of the Data Controller, pursuant to Article 6(1)(f) GDPR, in engaging, through the provision of information, with data subjects who have demonstrated an interest in its activities and offerings. For indirect marketing purposes, including activities carried out through profiling techniques, the legal basis for processing is the user’s consent pursuant to Article 6(1)(a) GDPR.

With regard to Behavioural Data, the legal basis for processing is the user’s consent to the use of data derived from the activities performed by the user, pursuant to Article 6(1)(a) GDPR.

With regard to Tracking Data, the legal basis for processing is: a) for strictly necessary cookies, the legitimate interest of the Data Controller in communicating through and operating a website; b) for other categories of tracking technologies, the user’s consent. Further details are provided in the Cookie Policy available on the Lega Serie A website.

5. METHODS OF PROCESSING AND RETENTION OF PERSONAL DATA

The collected data will be processed in compliance with the principles set forth in Article 5 GDPR and, in particular, the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

Processing for the identified purposes will be carried out through automated and manual methods, using electronic tools or paper-based records, according to criteria logically related to the purposes for which the data were collected and in compliance with the confidentiality and security requirements established by the GDPR and the relevant national implementing legislation. In any event, pursuant to Article 32 GDPR, the Data Controller has adopted appropriate security measures to protect personal data and to prevent risks arising from processing, including destruction, loss, unlawful use and unauthorised access.

Processing operations will be carried out exclusively by duly trained, instructed and authorised personnel, as well as by data processors appointed pursuant to Article 28 GDPR, in respect of whom further information may be requested from the Data Controller.

With regard to the retention of personal data, users are informed as follows:

Browsing Data do not persist for more than seven days from collection, without prejudice to any need for the competent judicial authorities to investigate criminal offences.

Contact Data and Communication Data will be retained for the period necessary to respond to users’ requests or communications. Where such data are processed for communication and promotional purposes, they will be retained for three years from the user’s last interaction, unless the user exercises the right to object before the expiry of that period.

Login Data will be retained for the period necessary to provide the services or comply with applicable legal or regulatory obligations and, in any event, for the period necessary to protect and enforce the rights of the Data Controller.

Behavioural Data will be retained for the period necessary to accommodate the choices and/or preferences expressed through use of the Tools, or to comply with any applicable legal or regulatory obligations strictly to the extent required by law and, in any event, for the period necessary to protect and enforce the rights of the Data Controller.

Tracking Data collected through strictly necessary cookies will be retained for the duration of the browsing session. For all other categories of tracking technologies, please refer to the retention periods defined and described in the Cookie Policy available on the Lega Serie A website.

6. WITH WHOM DO WE SHARE YOUR DATA?

The Data Controller may disclose the collected data to third parties where such disclosure is necessary to pursue the purposes of the processing, subject, where applicable, to the data subject’s consent, where disclosure is required by law, where it is necessary under the Terms of Use or in the performance of other agreements in force with the user, or in order to protect the rights, assets and safety of the Data Controller or third parties. Where users’ personal data are transferred to countries outside the European Union, such transfers will take place exclusively in accordance with one of the mechanisms provided for under Chapter V of the GDPR.

7. OPTIONAL NATURE OF DATA PROVISION

Users are free to decide whether or not to provide their personal data. However, failure to provide such data may prevent the proper use of the Tools and the provision of any requested services or information.

In any event: a) where processing is based on consent, consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before the withdrawal was communicated; b) where processing is based on the legitimate interests of the Data Controller, users may object to such processing at any time, without affecting the lawfulness of processing carried out before the objection was communicated.

8. DATA SUBJECT RIGHTS

In the cases provided for by law, data subjects have the right to obtain access to their personal data from the Data Controller and to request the rectification or erasure of such data, the restriction of processing concerning them, or to object to the processing, pursuant to Articles 15 et seq. GDPR. The relevant request may be submitted to the Data Controller by contacting the Data Protection Officer through the contact details provided above.

9. RIGHT TO LODGE A COMPLAINT

Data subjects who believe that the processing of their personal data through the Tools infringes the GDPR have the right to lodge a complaint with the competent supervisory authority, as provided for under Article 77 GDPR, or to seek an appropriate judicial remedy pursuant to Article 79 GDPR.

10. CHANGES TO THIS PRIVACY POLICY

The Data Controller reserves the right to amend this Privacy Policy at any time by notifying users on this page and, where possible, through information society tools and services, such as websites, applications and SSO systems, as well as, where technically and legally feasible, by sending a notification to users through one of the contact details available to the Data Controller.

Users are therefore encouraged to review this page regularly and to refer to the date of the latest update indicated at the top of this Privacy Policy. Where any amendments affect processing activities whose legal basis is consent, the Data Controller will obtain renewed consent from the user where required.