INFORMATION ON PERSONAL DATA PROCESSING
under the REGULATION (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation or GDPR)
This information describes the processing of the personal data uploaded to or collected on the website fctorpedokutaisi.com and any other website on which it is published (“Website”). This information provides also information on the processing of the personal data which were uploaded to or collected through Applications which are made available by FC Torpedo Kutaisi on third-party platforms or websites, or through contests, forms, interviews or other different channels.
Aggregate Data. Means the information on groups or categories of persons, which do not identify and cannot be reasonably used to identify a single individual.
Anonymous data. Means the information which does not identify and cannot be reasonably employed to identify a single individual.
Application. Means a program or a service managed by Torpedo Kutaisi (or on behalf of Torpedo Kutaisi ) which can be displayed in different environments and on-line platforms, mobile or otherwise, including those managed by third parties which allows us to directly interact with our users.
Data Subject. Means the natural person to whom personal data refer, who can be identified, directly or indirectly, by reference to specific information or elements, or by cross-reference of personal data.
Minor. Means the individual identified by us as minor who is not able, according to the law, to grant its consent to the collection and the processing of personal data.
Controller. Means the natural or legal person, which determines the purposes and means of the processing of personal data. The personal data controller responsible for the personal information collected by the Website, the Applications or any other data collection channel is FC Torpedo Kutaisi with registered office, Kutaisi, Akaki Khorava Street 1.
Processor. Means a natural or legal person, which processes personal data on behalf of one or more controllers, authorized to carry out the data processing only according to the instructions of the controller.
Data Protection Officer (DPO). Means the role required by the General Data Protection Regulation (GDPR) under art. 37. It is the natural or legal person, appointed by the controller or the processor, responsible for overseeing data protection strategy and implementation to ensure compliance with GDPR requirements. The responsibilities include support, control, consultative, training and information functions regarding the application of the said Regulation. It cooperates with the Authority and is the point of contact, also with respect to the data subjects, for issues related to the processing of personal data.
IP Address. Means the address associated with the access point through which the Internet connection is carried out and it is usually controlled by the Internet Service Provider (ISP) of the user.
Notice. Means a notice that may be sent by e-mail at the last e-mail address indicated by the individual, or through the publishing of amendment notices on the Websites or the Applications or using other means according to the current laws.
Parent. Means the holder of the parent responsibility on the Minor.
Personal data. Means the information which identify (directly or indirectly) a specific individual, for example, the name, the postal address, the e-mail address, the telephone number, the navigation data, the IP address, factors specific to the physical, physiological, genetic, mental economic, cultural or social identity, data related to choices and habits.
Public forums. Means message walls, conversation pages, chat rooms, social community environments, profile pages and other forums where the public is not limited. If personal data are provided during the use of such functions, such information may be made public or otherwise disclosed without any limit to their use by us or any third party. To request the removal of your data from a public forum or one of our websites or applications, please contact [email protected].
Website. Means the website fctorpedokutaisi.com
Websites. Means the Website, the official online Torpedo Kutaisi Store at fctorpedokutaisi.com and any other website published by FC Torpedo Kutaisi on any other platform to promote specific initiatives.
TYPE OF PERSONAL DATA
We collect two basic types of information: personal data and anonymous data; furthermore, we may use either personal or anonymous data for the creation of a third type of information: aggregate data. We collect the following categories of personal data:
- registration data uploaded when you create an account, which include name and surname, gender, date of birth, state of birth, language, telephone/mobile, e-mail address and password;
- data of the transaction uploaded when one of our products or services is purchased on our Website or through our Applications, which include information on the purchased products/services, the postal address, the telephone number, and the payment information;
- data relating to your characteristics, choices and habits;
- information that you provide us by communicating with us by telephone, e-mail or through our Website, or when you contact us to report a problem;
- information on events in which you participate, as well as your personal information and preferences, to the extent that such information relates to the organization and management of such events;
- data uploaded in public forums on the Websites and Applications;
- personal data sent by one user to another within a closed group, through messaging, chat, message publication or similar functions, provided that the service is active AND allowed by the applicable legislation;
- personal data uploaded while using the Websites, our Applications, our Applications on third-party platforms or websites, such as social networking sites or when the user links his profile on one third-party website or platform through his registration account;
- information on the location of the user at the moment of the visit to our Website or the use of our Application or related do the IP address of the user, provided that the processing of such data is allowed by the applicable legislation;
- use, display and technical data, including the device identification code or the IP address of the user, the moment in which the user visits the Website, use our Applications on third-party websites and platforms or opens our e-mail messages.
METHOD OF DATA COLLECTION
- We collect personal data when products, services or information are requested or when you sign up on the Website, take part in public forums or other activities on our Websites and Applications, contact our contact centre, reply to questionnaires or surveys, take part in a promotion, a game or a contest or otherwise interact with us.
- The IT systems and the software procedures employed for running the Website collect, during their normal course of operation, some personal data whose transmission is implied by the use of the Internet communication protocols. Such information is not collected to be associated to identified concerned persons, but, due to their own nature, may, through processing and the association with data held by third parties, allow the identification of the users. This category of data includes IP addresses or domain names of computers used by users who connect to the site, URI addresses (Uniform Resource Identifier) of requested resources, the time of the request, the method utilized to submit the request to the server, the size of the file obtained in reply, the numerical code indicating the status of the response from the server (successful, error, etc.) and other parameters related to the operating system and the IT environment of the user. Such data are used only to obtain anonymous statistical information on the Site and to check its correct functioning and are stored for the time defined by the relevant legislation. The data may be used to ascertain responsibility in case of hypothetical computer crimes against the Website.
PURPOSES OF DATA PROCESSING, LEGAL GROUNDS AND RETENTION
Access to and browsing the Websites are free, but the possibility to receive certain online services offered on the Websites is allowed only subject to sign-up. The sign-up process consists of the filling of an online form in which you are requested to state your personal data – some of which is required – for activating the authentication credentials (e-mail + password) through which, then, you will access to all the areas and the services of the Website which are reserved to registered users. Thus, firstly, the primary purpose of the processing is to allow the requested procedures of prior online registration and the creation of an account and to enable the generation and the subsequent technical and administrative management by the Websites administrators (including the provision of technical support and assistance upon request) of the account, of the activation codes, of the passwords and similar authentication credentials to be used on the Websites.
Once they have signed in on the Website, registered users are then enabled to receive all the services offered online by the Website. Such services are organized in the following areas and can be received based on the separate contractual terms available on the Website:
- online purchase of tickets for matches;
- Membership services for receiving the services connected to membership;
- Contact area for receiving help and assistance;
- The e-commerce website fctorpedokutaisi.com for the purchase of Torpedo Kutaisi official merchandise;
- Any other services available from time to time within the Websites and receivable only by registered users.
Thus the processing of the personal data (including their recording in the FC Torpedo Kutaisi database) seeks to achieve the following primary purposes:
- a) guarantee the registration to the Website, enable you to access to the web pages of the Website where it is possible to receive specific online services, guarantee the correct provisions of the services requested from Torpedo Kutaisi through the Websites, the Applications and any other channel and, therefore, perform in a correct and a timely manner all the obligations arising from the contractual relationship established with you. The legal ground of this processing is the need to give effect to the requestor to fulfil contractual or legal obligations. The personal data will be stored for 10 years from the date of termination of the contractual relationship;
- b) for administrative and accounting purposes, including the transmission, if any, by e-mail of business invoices by FC Torpedo Kutaisi and/or any company connected thereto during the supply of the service, for the delivery of Notices with regard to your account or the transactions carried out with Torpedo Kutaisi. The legal ground of this processing is the execution of contractual or legal obligations. The personal data will be stored for 10 years from the date of collection;
- c) to comply with laws and regulations, including tax, or to carry out an order of judicial authorities or police or supervisory bodies. The legal ground of this processing is the execution of legal obligations to which Torpedo Kutaisi is subject. The personal data will be stored for 10 years from the date of collection;
- d) to recognize you and to cross-reference information about your interactions with Torpedo Kutaisi in order to provide timely and personalized assistance and to make you feel, as a Torpedo Kutaisi “supporter”, at the centre of attention, to monitor your satisfaction and ensure better meeting of your needs. Legal ground of this processing is the legitimate interest pursued by Torpedo Kutaisi to strengthen the link with fans and meeting their expectations. The personal data will be stored for 10 years from the date of collection.
In all the cases under points a), b), c), d) and e) above, Torpedo Kutaisi shall not be obliged to obtain any specific consent from you. All the processing detailed above seek, actually, primary purposes for which the current legislation excludes the need to obtain specific consent from the data subject, either because the processing is required for complying with an obligation set by the Law, by a regulation or by the EC legislation, or because the processing is required for carrying out any duty arising from an agreement in which the data subject is one of the parties, or for meeting, before the execution of the agreement, specific requests of the data subject, or for the purposes of the legitimate interests pursued by Torpedo Kutaisi, also taking into account the reasonable expectations of the data subjects.
In the case where the user does not intent do provide in any case the requested personal data, which are required based on the above, this would lead to the impossibility to complete the registration to the Website and to receive all the services for which the registration and the provision of the data are in any case required based on technical and contractual reasons.
It would remain in any case possible to browse the Website as a non-registered user or an anonymous user and to display only the contents and the materials available without registration.
Within the limits of the current legislation relating to personal data protection, personal data may be also processed for the following secondary purposes:
- f) for registering to Torpedo Kutaisi mailing lists, for carrying out market surveys and polls (also by telephone, online, and using forms), the delivery of advertising and information material on the products and services offered byTorpedo Kutaisi by the Club partners, solicitations of purchase, through automated systems, such as e-mail, fax, SMS or MMS, or traditional methods (for example traditional post letters), or by telephone with an operator (hereinafter, globally “Processing for Marketing purposes”). The legal ground for this processing is the data subject consent. The personal data shall be stored for the time strictly necessary for the management of the relationship with the data subject, taking every care to prevent the retain indefinitely of his data and encouraging the exercise of his rights;
- g) for the processing of the data subject’s market profile (by sampling the consumption patterns), seeking, both to monitor the satisfaction degree of customers for ensuring the best satisfaction of their needs, both to send customer-specific information and/or advertising material, using automated systems, such as e-mail, fax, SMS or MMS or by ordinary post. The personal data shall be stored for the time strictly necessary for the management of the relationship with the data subject, taking every care to prevent the retain indefinitely of his data and encouraging the exercise of his rights.
In all the cases detailed under points f) and g) above, the personal data may be processed only if a specific consent is granted. The lack of any declaration of consent shall be held as a denial.
Then, by granting your optional consent, you specifically acknowledge and authorize such further possible processing. In any case, even if you have granted your consent to seek the purposes listed under points f) and g), you shall remain in any case free to revoke it in any moment, by sending a clear notice on the matter to Torpedo Kutaisi through the contact form on the Website fctorpedokutaisi.com or at the following e-mail address [email protected].
The denial will not involve any consequence, except for the impossibility of being included in statistical analysis and/or profiling and to receive promotions, discounts and focused communications, based on the provided data, or to be informed on any marketing and promotional/advertisement initiatives. Therefore, for such further purposes, the processing shall be carried out only according to the purposes and based on the specific consent granted by data subject, which can still be revoked at any time.
SOFT SPAMMING AND EMAIL ADDRESS
Limited to the e-mail address provided by YOU while purchasing a service through the Website, the provided data may be employed for allowing the direct offer by Torpedo Kutaisi of similar products and services (so-called soft spamming), without prejudice for your right to oppose at any time and without formalities to such processing, expressing your willingness in a suitable and unequivocal manner. The cancellation request can be freely exercised by you by contacting Torpedo Kutaisi simply upon receipt of the newsletter through the contact form on the Website or by writing to: [email protected].
The data processing will be carried out in hard copy and/or by electronic means and, anyway, in the manner and with the appropriate tools to ensure the security and confidentiality of the data in accordance with the current legislation relating to data protection. In particular, technical, informational, organizational, logistical and procedural security measures are implemented to prevent the data from being lost, used unlawfully and/or inappropriately, and accessed without authorization.
CATEGORIES OF RECIPIENTS, COMMUNICATION AND DISSEMINATION OF PERSONAL DATA
For the purposes above your personal data may be accessed or disclosed to:
- Torpedo Kutaisi employees and collaborators, in their capacity as authorized processing personnel, in accordance with their respective duties and in compliance with the instructions received by Torpedo Kutaisi. Such individuals have agreed to maintain the confidentiality of this information;
- third-party service providers which perform activities on behalf of Torpedo Kutaisi or which are entrusted by the Club with certain task or parts thereof, that are required for supplying or distributing the services offered through the Website (for example hosting companies, project managers, programmers, system experts and database administrators), or whose activity is connected, instrumental or supportive of that performed by Torpedo Kutaisi (for example, subjects to whom the Club can assign customer care activities; subjects who carry out technical or organizational type of activities, such as press services, mailing, transmission, transport, and sorting of communications; consultants). In such cases, these subjects will be appointed as the personal Data Processor. The full list of Data Processors is available upon request to Torpedo Kutaisi, by writing to [email protected].
- to any entity (Public Authorities includes) which may access to the personal data based on statutory and administrative provisions;
- to any public and/or private subject, individuals and/or entities (legal, administrative and tax consultancy firms, Judicial Authorities, Chamber of Commerce, Labour Authorities, etc.), if the disclosure is required or functional for the correct performance of the contractual obligations, and also of the statutory obligations;
- to banks and to companies which manage National and International payment circuits through which the online payments of the products purchased through the Website are carried out.
We do not collect personally identifying information for sale to third parties for consumer marketing purposes.
In any case, the personal data shall not be disclosed to the public at large and/or to an indefinite amount of entities.
POSSIBLE DISCLOSURE BY DATA SUBJECT OF THIRD-PARTY PERSONAL DATA
The user acknowledges that the possible indication (for example in the management of the Membership section) of personal and contact data of any third party different from the interested person shall be held as a personal data processing, with regards to which they shall act as independent controller, undertaking all the obligations and responsibilities provided for by the current legislation with reference to personal data protection. To that effect, the User guarantees to the Club that any third-party data which shall be indicated in such way by the user (and which shall be accordingly handled as if the third party granted his informed consent to the processing and the disclosure of the data to FC Torpedo Kutaisi) was collected by the user themself in full compliance with the current legislation with reference to personal data protection. In this regard, the user grants the widest indemnification with regards to any objection, claim, request for compensation of any damage arising from the processing, etc. which may be received by Torpedo Kutaisi from any third party interested based on the provision of the data indicated by the user violating the applicable provisions on personal data protection.
INTERNATIONAL TRANSFER, STORING AND PROCESSING OF THE PERSONAL DATA.
The management and storage of personal data take place within Georgia. It is possible that FC Torpedo Kutaisi stores personal data in a cloud, which means that data may be processed by a cloud service provider on behalf of the Club. In any case, it will be required that cloud-service providers that store personal data on servers are compliant with the data protection regulations of the European Union.
If our activity implies the transfer of personal data to third parties located in different places worldwide, for the purposes described in this privacy information, wherever the personal data are transferred, stored or processed by us, we shall adopt suitable organizational and contractual measures for safeguarding the personal data and we shall impose similar requirements, which are not less restrictive, to the providers of the cloud services, including the obligation to process the personal data only for the purposes listed above. Furthermore, when we use or disclose personal data transferred from countries which entered into Safe Harbor Agreements with the USA, we comply with the Safe Harbor principles as defined by the US Department of Commerce, we use standard contractual clauses approved by the European Commission, we adopt other measures under the legislation of the European Union for ensuring an appropriate protection, or we obtain the consent of the user.
THE PRIVACY RIGHTS OF MINORS
With regards to the functionalities of the Website, we do not intentionally collect personal data of Minors. According to the applicable Laws, the Parent must grant their consent to the collection of the personal data of the Minor; the registration to the Website by the Minor shall be therefore be authorised by the Parent and carried out under the supervision of the Parent themself, for that reason, the e-mail address supplied must be the e-mail address of the Parent. The parent has the right to review and to request the removal of the personal data of the Minor.
The products/services on the Website can be purchased only by persons over 18 years of age using a valid credit card.
CONTROLLER AND DATA PROTECTION OFFICER
The Data Controller is FC Torpedo Kutaisi with registered office in Kutaisi, Akaki Khorava Street 1 has designated a Data Protection Officer (DPO), which can be contacted by email at: [email protected].
DATA SUBJECT RIGHTS
Within the limits and under the conditions established by law, the controller is obliged to respond to the data subject’s requests regarding his/her personal data. In particular, based on current legislation:
- The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:
(a) the purposes of the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
(f) the right to lodge a complaint with a supervisory authority;
(g) where the personal data are not collected from the data subject, any available information as to their source;
(h) the existence of automated decision-making, including profiling;
- The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
- The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay within the limits and under the conditions established by the current legislation.
- The data subject shall have the right to obtain from the controller restriction of the processing.
- The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.
- The data subject shall have the right to lodge a complaint to the Supervisory Authority which is concerned with personal data protection.
For any questions or complaints about this privacy information or the way the personal data are processed, or for the exercise of one of the rights set out above, the data subject shall present a request through the following point of contact to which he or she may also contact the data protection officer (DPO): Kutaisi, Akaki Khorava Street 1, email: [email protected].
If you are a registered user you may update your personal information via on the Website: log in using your account credentials and update your information and your consent. You may also contact us at: [email protected].
AMENDMENTS TO THIS PRIVACY INFORMATION
Occasionally, we may amend this policy in order to include new technologies, industry practices and statutory requirements, or other purposes. We shall inform the data subject through a relevant Notice in the case where such amendments are significant and we shall obtain the consent of the User if so required by current laws.
Last update: February 2020