PRIVACY NOTICE

pursuant to Article 13 of the General Data Protection

Regulation EU no. 2016/679

A. Who are we and why are we giving you this document?  to provide information and advice to the Data Controller or the
The Mondadori Group, a group of companies subject to direction and Data Processor and the employees who carry out processing in
coordination pursuant to Article 2359 of the Civil Code by its holding relation to their obligations pursuant to the Regulation and
company Arnoldo Mondadori Editore S.p.A. (hereinafter “Mondadori other European Union or Member State data protection
Group”), has considered for many years the protection of its customers provisions;
and users’ personal data of utmost importance, by ensuring that such  to monitor compliance with the Regulation, with other
personal data are processed, whether automatically or manually, in full European Union or Member State data protection provisions
compliance with the rights and safeguards provided by the General Data and with the policies of the Data Controller or the Data
Protection Regulation EU 2016/679 of the European Parliament and of Processor in relation to the protection of personal data;
the Council of 27 April 2016 on the protection of natural persons with  to provide support for the management of the Data Subject’s
regard to the processing of personal data and on the free movement of requests;
such data (hereinafter the “Regulation”) and any other laws and  to cooperate with the Garante per la Protezione dei Dati
regulations concerning the protection of personal data. Personali or other competent supervisory authority.
As provided for in Article 38 of the Regulation, you may contact the
For the purposes of this Notice “personal data” is defined in Article 4 (1)
DPO if you have any questions about the processing of your Personal
of the Regulation as “any information relating to an identified or
Data and/or want to exercise your rights as described in Section H of
identifiable natural person (‘data subject’); an identifiable natural
this Notice. You can do this by e-mailing dpo@mondadori.it or by
person is one who can be identified, directly or indirectly, in particular
writing to the Data Protection Officer of the Mondadori Group at the
by reference to an identifier such as a name, an identification number,
address of Arnoldo Mondadori Editore S.p.A., 1 via Mondadori, 20090
location data, an online identifier or to one or more factors specific to
Segrate (MI), Italy.
the physical, physiological, genetic, mental, economic, cultural or social
identity of that natural person” (hereinafter “Personal Data”). You can find all the information about how your Personal Data are
processed, together with the contact details made available to all Data
The Regulation requires that before carrying out a “processing” of
Subjects by the Mondadori Group, in the “Privacy” section of the
Personal Data - meaning, as defined in Article 4 (2) of the Regulation,
Websites at any time.
“any operation or set of operations performed on personal data or sets
of personal data whether or not by automated means, such as collection, D. For which purpose will be processed your Personal Data?
recording, organization, structuring, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or The Data Controller needs to process your Personal Data in order to
otherwise making available, alignment or combination, restriction, allow you to register to one or more of its websites, ask information by
erasure or destruction” (hereinafter the “Processing”) – the person to using the contact form and/or subscribe to the newsletter service. The
whom those Personal Data belong must be informed on the purposes for websites for which the Data Controller will collect your Personal Data
which those data are requested and how they are going to be used. are listed in the Mondadori Media S.p.A. section of the Mondadori
Group Privacy Policy at the following link
The purpose of this Notice is accordingly to provide you, http://www.mondadori.it/privacy-policy (hereinafter “Websites”). The
straightforwardly and intuitively, with all the information you may need Personal Data will be processed by the Data Controller for the following
before providing your Personal Data so that you can understand and be purposes: to allow you to register to the Websites, join in the events
informed on how your Personal Data will be processed as well as organized by the Data Controller, receive newsletters and use the
request and obtain clarifications and/or rectifications at any time. services provided by each of Websites to which you are registered. Such
Processing will be legally based on the contractual relationship between
This Notice (hereinafter the “Notice”) has accordingly been drawn up on you and Data Controller further to your acceptance of Websites General
the basis of the Principle of Transparency and all the requirements set Terms and Conditions.
forth by Article 13 of the Regulation; it is arranged into different
sections (“Sections” or individually “Section”) each of which deals with Moreover, the Data Controller may process your Personal Data to
one specific topic, in order to make it simple, intuitive and easy to comply with legal obligations and respond to requests from the
understand. competent authorities. In such cases, the Processing will be legally
performed on the basis of the compliance with legal obligations to which
B. Who will process your Personal Data? the Data Controller is subject.
The company which will be processing your Personal Data for the
The Data Controller may also disclose o otherwise process your
purposes provided by Section E of this Notice (and which will
Personal Data in the context of transactions, contract assignments,
accordingly be the Data Controller as defined in Article 4(7) of the
transfers of business, transfers of business units and/or restructuring to
Regulation, “the natural or legal person, public authority, agency or
carry out such transactions and comply with the contractual obligations
other body which, alone or jointly with others, determines the purposes
arising therefrom. In such cases, the Processing will be legally
and the means of the processing of personal data”) is:
performed on the basis of the legitimate interest of the Data Controller to
Mondadori Media S.p.A. with registered office at Via Bianca di Savoia carry out such transactions.
12, 20122 – Milan, administrative and operative office at Via Mondadori
Furthermore, the Data Controller may process your Personal Data to
1, 20090 – Segrate (MI), registered at the Companies’ Register of Milan,
establish, exercise or defend legal claims. Such Processing will be
Tax Code no. and VAT no. 08009080964
legally performed on the basis of the legitimate interest of the Data
Controller to protect its rights.
C. Whom can you contact?
The provision of the Personal Data marked with * is necessary to carry
To facilitate dealings between the Data Controller and the data subjects, out the Processing for the purposes above. In case of failure to provide
individually defined in Article 4 (1) of the Regulation as “the identified such Personal Data, the Data Controller will not be able to process your
or identifiable natural person” to whom the Personal Data refer Personal Data and, as a consequence, to allow you to register to the
(hereinafter the “Data Subject”), the Regulation requires, in some Websites and use any other services provided by the Websites which
specific cases, the designation of a person responsible for control and require the provision of your Personal Data. The Personal Data that will
support; one of that person’s tasks is to act as the point of contact for the be collected for the purposes above include but are not limited to: first
Data Subject. name, last name, home address, date and place of birth, e-mail address
and telephone numbers.
The Mondadori Group has instituted the position of Data Protection
Officer (the “DPO”), and has appointed Mr. Ugo Ettore Di Stefano to Where you decide to access to the Websites by using a social login (e.g.
that position in accordance with Article 37 of the Regulation. Facebook, Google, Twitter profile), where allowed, the collection of
your Personal Data will be done by the provider of the relevant social
The DPO’s duties, under Article 39 of the Regulation, include the network that you use to access to our Websites.
following:
You can read this Privacy Notice in the Privacy Section of every following information: (a) the purposes of the Processing; (b) the
Websites. categories of Personal Data concerned; (c) the Recipients or
categories of Recipient to whom the Personal Data have been or
E. To whom may your Personal Data be disclosed? will be disclosed, in particular Recipients in third countries or
Your Personal Data may be disclosed to specific persons regarded as international organizations; (d) where possible, the envisaged
“Recipients” of such Personal Data; Article 4 (9) of the Regulation period for which the Personal Data will be stored, or, if not
defines a “recipient” as “a natural or legal person, public authority, possible, the criteria used to determine that period; (e) the
agency or another body, to which the personal data are disclosed, existence of the right to request from the Data Controller
whether a third party or not. rectification or erasure of Personal Data or restriction of the
Processing of your Personal Data, or to object to such Processing;
In order to correctly carry out all the Processing activities for the (f) the right to lodge a complaint with a supervisory authority; (g)
purposes mentioned in this Notice, your Personal Data may be processed where the Personal Data are not collected from the Data Subject,
by the following Recipients: any available information as to their source; (h) the existence of
automated decision-making, including profiling, referred to in
 third parties which perform part of the Processing and/or Article 22 and, at least in those cases, meaningful information
activities connected with or instrumental to the Processing on about the logic involved, as well as the significance and the
behalf of the Data Controller. Each of such persons has been envisaged consequences of such Processing for the Data Subject.
designated as a “Data Processor”, meaning “a natural or legal All this information can be found in the Privacy section of the
person, public authority, agency or other body which processes website www.mondadori.it.
personal data on behalf of the Data Controller” (Article 4 (8) of
the Regulation);  Right of rectification: under Article 16 of the Regulation you have
 individuals employed or contracted by the Data Controller and the right to obtain from the Data Controller without undue delay
the rectification of inaccurate Personal Data concerning you.
engaged for carrying out one or more specific Processing
Taking into account the purposes of the Processing, you have the
activities. These individuals have been given specific instructions
right to have incomplete Personal Data completed, including by
concerning the safety, security and proper use of Personal Data,
means of providing a supplementary statement.
and are defined, pursuant to Article 4 (10) of the Regulation, as
“persons who, under the direct authority of the controller or the
 Right to erasure: under Article 17 (1) of the Regulation you have
processor, are authorised to process the personal data”
(“Authorized Persons”); the right to obtain from the Data Controller the erasure of your
Personal Data without undue delay and the Data Controller shall
 third parties which carry out Processing activities and/or activities have the obligation to erase your Personal Data without undue
connected with or instrumental to the Processing, as autonomous delay where one of the following grounds applies: (a) the
data controllers, including, but not limited to, consulting Personal Data are no longer necessary in relation to the purposes
companies, consultants, banks and financial institutions, for which they were collected or otherwise processed; (b) you
insurance companies, other external entities and/or companies have withdrawn the consent on which the Processing of your
belonging to the Mondadori Group; Personal Data is based, and there is no other legal ground for their
Processing; (c) you have objected to the Processing pursuant to
 where required by the law or necessary for the prevention, Article 21(1 or 2) of the Regulation and, in cases under Article 21
investigation, detection or prosecution of criminal offences, your (1), if there are no longer any overriding legitimate grounds for
Personal Data may be disclosed to public authorities or to courts the Processing of your Personal Data; (d) your Personal Data have
without such public authorities or courts being regarded as been unlawfully processed; (e) your Personal Data have to be
Recipients: under Article 4 (9) of the Regulation, “public erased for compliance with a legal obligation in European Union
authorities which may receive personal data in the framework of or Member State law to which the Data Controller are subject.
a particular inquiry in accordance with Union or Member State In certain cases, as provided for in Article 17 (3) of the
law shall not be regarded as recipients”. Regulation, the Data Controller is allowed not to erase your
F. For how long will your Personal Data be processed? Personal Data if their Processing is necessary, for instance, for
exercising the right of freedom of expression and information; for
One of the principles that applies to the Processing of your Personal compliance with a legal obligation; for reasons of public interest;
Data is the storage limitation. Such principle is provided for by Article 5 for archiving, scientific or historical research purposes in the
(1)(e) of the Regulation, which reads “personal data shall be kept in a public interest; or for the establishment, exercise or defence of
form which permits identification of data subjects for no longer than is legal claims.
necessary for the purposes for which the personal data are processed;
personal data may be stored for longer periods insofar as the personal  Right to restriction of processing : you will be entitled, under
data will be processed solely for archiving purposes in the public Article 18 of the Regulation, to restriction of Processing where
interest, scientific or historical research purposes or statistical purposes one of the following applies: a) you have contested the accuracy
in accordance with Article 89(1) subject to implementation of the of your Personal Data (the restriction will be for a period enabling
appropriate technical and organizational measures required by this the Data Controller to verify the accuracy of the Personal Data);
Regulation in order to safeguard the rights and freedoms of the data b) the Processing is unlawful but you oppose the erasure of your
subject.” Personal Data and request that their use be restricted instead; c)
In the light of this principle, your Personal Data will be processed by the although the Data Controller no longer need them for the
Data Controller for no longer than is needed for the purposes set out in purposes of the Processing, your Personal Data are required for
Section E of this Notice. Specifically, your Personal Data will be stored the establishment, exercise or defence of legal claims; d) you
for the shortest time necessary, as indicated in Recital 39 of the have objected to the Processing under Article 21 (1) of the
Regulation; that is, up to ten years after the termination of the Regulation pending verification whether the legitimate grounds of
contractual relationship between you and the Data Controller, without the Data Controller override your own.
prejudice to a further period of time that may be required or allowed in If the Processing is restricted your Personal Data will, with the
accordance with statutory or regulatory provisions, as provided for in exception of storage, only be processed with your consent or for
Recital 65 of the Regulation. the establishment, exercise or defence of legal claims or for the
protection of the rights of another natural or legal person or for
G. Which are your rights? important reasons of public interest. We shall in any case notify
In accordance with the Regulation, you can exercise at any time towards you before the restriction is lifted.
the Data Controller the following rights:
 Right to data portability : under Article 20 (1) of the Regulation
 Right of access : you will be entitled, under Article 15 (1) of the you will be entitled at any time to ask for and receive all your
Regulation, to obtain from the Data Controller confirmation as to Personal Data processed by the Data Controller in a structured,
whether or not your Personal Data are being processed, and, commonly used and machine-readable format or to ask for it to be
where that is the case, access to the Personal Data and the transmitted to another data controller without hindrance. In such
cases you will need to provide us with full and accurate details of
VERSION 01/2020
 the new data controller to which you would like your Personal contractual clauses provided for by the European Commission; (c)
Data to be transferred, and to give us your authorization in binding corporate rules.
writing.
You may get further details from the Data Controller whenever your
Personal Data have been processed outside the European Union, by
 Right to object: under Article 21of the Regulation, you will be asking for the indication of the specific safeguards in place.
entitled to object at any time to the Processing of your Personal
Data a) if they are processed for purposes of direct marketing *****
including profiling to the extent that it is related to such direct
marketing, or b) on grounds relating to your particular situation, if
the Processing is based on the legitimate interests of the Data
Controller or third parties, unless the Data Controller demonstrate
compelling legitimate grounds for the Processing which override
your interests, rights and freedoms or for the establishment,
exercise or defence of legal claims

To exercise any of the above rights you may contact the Data Controller
using the channels provided in Section D of this Notice.

You are reminded that you can also contact the Mondadori Group’s
DPO at any time, as explained in Section D of this Notice.

You also have the right to lodge a complaint with a supervisory

authority: without prejudice to any other administrative or judicial
remedy, you have the right to lodge a complaint with the Garante per la
Protezione dei Dati Personali or other competent supervisory authority
if you believe that the Processing of your personal data by the Data
Controller is in violation of the Regulation and/or other applicable laws.

To make it easier for you to unsubscribe from one of the following

Mondadori Group web sites, please click on the links below or follow
the steps below:

 Altervista: go to this link

 Androidworld: go to this link

 Soldionline: go to this link

 Studenti: you need to login to www.studenti.it by clicking on

the icon that represents a man in the top right corner. Once
logged in, you need to click on “Delete account” in the
navigation menu of the panel in the top right corner

 Filmtv: go to this link

 Focus: you need to login to www.focus.it by clicking on the

icon that represents a man in the top right corner. Once
logged in, you need to click on “Remove from focus” at the
bottom of the page presenting its data

 O2O: You need to login to www.o2o.it in the upper right

corner by clicking on the link “login”. After logging in, select
“Profile” and then “Remove account”

 Giallozafferano: you need to login to

www.giallozafferano.it by clicking on the icon that
represents a man in the top right corner. Once logged in, you
need to click on “Modify your data” in the navigation menu
of the upper right panel and then “Remove my account”

We remind you that you can also contact the DPO of the Mondadori
Group in the manner provided by Section D of this Notice.

H. Where will your Personal Data be processed?

Your Personal Data will be processed by the Data Controller within the
European Union.

In case for technical and/or operational issues, it is necessary to engage

persons outside the European Union, those persons, where they process
Personal Data on behalf on the Data Controller, will be appointed as
Data Processors in accordance with Article 28 of the Regulation; the
transfer of your Personal Data to those persons, which will be limited to
the performance of specific Processing activities, will be carried out in
accordance with the provisions of Chapter V of the Regulation. All the
necessary safeguards will accordingly be taken to guarantee the
protection of your Personal Data; to such extent the transfer in question
will be based on: (a) decisions of the European Commission as to the
adequacy of the recipient non-EU country in question; (b) standard