DATA CONTROLLER

Atalanta Bergamasca Calcio S.r.l., via Giorgio e Guido Paglia n. 1/D, 24122 Bergamo Tax code 80000130163 and VAT number 00699780169, Email: privacy.atalanta@percassi.com; and

Hereinafter also referred to as the “Company” and/or the “Data Controller” and/or “Atalanta”.

DATA PROTECTION OFFICER (DPO)

The DPO can be contacted at the following email address: dpo.atalanta@percassi.com

PERSONAL DATA PROCESSED

Data provided directly by you: personal details, contact details, details of purchases made by filling in the relevant form in store, possibly with the assistance of store staff, as well as any additional sections you may fill in on the website (including, but not limited to: mobile phone number, preferences).

In the case of authentication via social log-in (Google or Apple account), the Company, in accordance with the principles of necessity and proportionality, may process your personal data based on your authorization to transfer such data provided to the social network through which you can log in.

PURPOSE OF THE PROCESSING

1. Purchase of goods or services, including any related activities (customer care, collection of purchases, etc.)

LEGAL BASIS FOR PROCESSING: Execution of a contract to which you are a party.

DATA RETENTION PERIOD: Contractual duration and, after termination, for the ordinary limitation period of 10 years.

2. Participation in any loyalty programs and/or initiatives organized by the Company, including through social media pages.

LEGAL BASIS FOR PROCESSING: Performance of a contract to which you are a party.

DATA RETENTION PERIOD: Contract duration and, after termination, for the ordinary limitation period of 10 years.

3. Management of reports, complaints, and customer care activities, including through the verification of your identity.

LEGAL BASIS FOR PROCESSING: Performance of a contract to which you are party.

DATA RETENTION PERIOD: Contract duration and, after termination, for the standard limitation period of 10 years.

4. Standard operation of the operating system and IT environment

LEGAL BASIS FOR PROCESSING: Execution of a contract to which you are a party.

DATA RETENTION PERIOD: For the entire duration of navigation.

5. Compliance with obligations under applicable national and supranational regulations and legislation.

LEGAL BASIS FOR PROCESSING: Need to comply with legal obligations.

DATA RETENTION PERIOD: Duration required by law (10 years for administrative and accounting purposes).

6. If necessary, to establish, exercise, or defend rights (e.g., for debt collection).

LEGAL BASIS FOR PROCESSING: Legitimate interest (legal protection).

DATA RETENTION PERIOD: In the event of litigation, for the entire duration of the dispute, until the time limits for bringing legal action have expired.

7. Direct marketing by Atalanta: for example, sending - by automated means of contact (such as SMS, MMS, e-mail, social networks, instant messaging apps, push notifications) and traditional means (such as telephone calls with an operator and traditional mail) - of newsletters, promotional and commercial communications relating to services/products offered by the Company or notification of company events, sending a barcode and identification code for each customer, as well as measuring customer satisfaction, conducting market surveys and statistical analyses.

LEGAL BASIS FOR PROCESSING: Consent of the data subject (optional and revocable at any time).

DATA RETENTION PERIOD: Personal data (identification and contact details) will be processed for this purpose until consent is revoked. Purchase data will be processed for this purpose for 24 months.

8. Communication/transfer of data: your personal and contact details will be communicated to the third-party company Odissea S.r.l., as well as to its subsidiaries or affiliates, including indirectly, belonging to the retail sector (both physical and digital), the food sector, and the real estate sector (Womo S.r.l., Bullfrog S.r.l., Odissea S.r.l., Percassi Retail S.r.l., Percassi Management S.r.l., Hexagon SpA and its foreign subsidiaries: Victoria's Secret; Bath and Body Works; L'Innominato SpA and its foreign subsidiaries: Nike; Lego; Armani; AX; Saint Laurent; Garmin; Siren Coffee Srl: Starbucks; Food Management Srl: 30 Polenta; New Oak S.r.l.: Oakley), to their franchisors/licensors/partners/sponsors and/or to subsidiaries, parent companies or companies subject to common control of the latter, to allow these companies to carry out marketing activities (for example, sending - using automated contact methods such as SMS, MMS, e-mails, social networks, instant messaging apps, and traditional methods such as operator-assisted phone calls and traditional mail - of newsletters, promotional and commercial communications relating to services/products offered by the companies or notification of company events, as well as conducting market research and statistical analysis) concerning their products.

LEGAL BASIS FOR PROCESSING: Consent of the Data Subject (optional and revocable at any time).

DATA RETENTION PERIOD: Until consent is revoked.

9. Profiling: analysis of your preferences, habits, behaviors, interests, or other data in order to send you personalized commercial communications/targeted promotional actions/offers and services tailored to your needs/preferences.

LEGAL BASIS FOR PROCESSING: Consent of the data subject (optional and revocable at any time).

DATA RETENTION PERIOD: Personal data (identification and contact details) will be processed for this purpose until consent is revoked.

Purchase data will be processed for this purpose for 24 months.

***

Once the above retention periods for each of the aforementioned purposes have expired, the Data will be destroyed, deleted, or anonymized, in accordance with the technical procedures for deletion and backup and with the accountability requirements of the Data Controller.

Please note that the Data Controller will create a personal profile for you within its management system (CRM). If you wish to request the deletion of this personal profile from the CRM, you may exercise your right to erasure in the manner provided for in the “Rights of the data subject” section of this policy.

Furthermore, following your possible revocation of consent in relation to the purposes referred to in points 7, 8, and/or 9, the Company will continue to process your Data for the sole purpose of having evidence that such activities should no longer be carried out in relation to you.

MANDATORY PROVISION OF DATA

Personal and contact details are mandatory for the conclusion of contractual relationships and to ensure the provision of the requested services.

Any browsing data is necessary to implement IT and telematic protocols; therefore, failure to provide such data would prevent the website from functioning.

The provision of data for direct marketing, profiling, and communication of data to third parties is entirely optional: such processing activities will only be carried out with your express and unequivocal consent, without prejudice to your right to withdraw your consent at any time. Please note that the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

DATA RECIPIENTS

The data may be processed by external parties acting as independent data controllers, including, but not limited to, supervisory and control authorities and bodies, entities offering electronic payment services on their own circuits, social networks present or referenced on the website you are visiting, as well as entities offering services necessary for the operation of the website.

The data may also be processed on behalf of the Company by external parties designated as data processors, who are given appropriate operating instructions. These parties essentially fall into the following categories:

a. companies offering email delivery services;

b. companies that offer services instrumental to the pursuit of the purposes indicated in this policy (media agencies, IT suppliers, shippers, etc.);

c. companies that offer support in conducting market research;

d. individuals, professional firms, or companies that offer professional services in accounting, tax, legal, banking, and payment services, anti-fraud services, etc.

PERSONS AUTHORIZED TO PROCESS DATA

The data may be processed by employees of the company departments responsible for pursuing the purposes indicated above, who have been expressly authorized to process the data and who have received adequate operating instructions.

TRANSFER OF PERSONAL DATA TO COUNTRIES OUTSIDE THE EUROPEAN UNION

Your personal data may be transferred outside the European Union to the subjects indicated in the paragraph “Data Recipients” if required for the purposes indicated in this policy.

The Company guarantees that your personal data will be processed by these Recipients in accordance with the applicable data protection legislation. Such transfers may be based on an adequacy decision or on Standard Contractual Clauses approved by the European Commission. For further information, please contact the following address: privacy.atalanta@percassi.com

RIGHTS OF THE DATA SUBJECT - COMPLAINT TO THE SUPERVISORY AUTHORITY

By contacting us by post at Atalanta Bergamasca Calcio S.r.l., via Giorgio e Guido Paglia n. 1/D 24122 Bergamo, for the attention of the Privacy Officer, or by email at privacy. atalanta@percassi.com , data subjects may ask the Data Controller for access to data concerning them, its deletion, the correction of inaccurate data, the integration of incomplete data, the limitation of processing, as well as opposition to processing, and exercise any other right provided for by the GDPR.

If you exercise your right to erasure, the Data Controller may take steps to verify your identity.

Furthermore, if the processing is based on consent or on a contract and is carried out using automated tools, data subjects have the right to receive the data in a structured, commonly used, and machine-readable format and, if technically feasible, to transmit it to another controller without hindrance.

Data subjects have the right to withdraw their consent at any time for marketing and/or profiling purposes, as well as to object to the processing of data for such purposes, either in its entirety or limited to automated methods.

Data subjects have the right to lodge a complaint with the competent supervisory authority in the Member State in which they habitually reside or work or in the State in which the alleged violation occurred.

MODIFICATION OF THIS POLICY

The Company reserves the right to modify this Privacy Policy, in whole or in part, or simply to update its contents, for example in the event of changes to the applicable law. The Company therefore invites you to consult this Privacy Policy regularly to find out the most recent and updated version of the same.