Vers. Mod.: IS – Data Agg. 05/2026

V.HV: INF51 25/05/26

Privacy Notice for the Processing of Personal Data

Articles 13 and 14 of EU Regulation No. 679/2016
Legislative Decree 196/2003 as amended by Legislative Decree 101/2018

1. Introduction: the role of HELLAS VERONA FC S.P.A. and CALICANTUS S.R.L. in the processing of personal data collected through the Website

The following privacy notice is addressed to all individuals making purchases on the official e-commerce website: hvstore.it (hereinafter the “Website”).

Official merchandise bearing the “HELLAS VERONA FC” trademark (hereinafter the “Products”) may be purchased through the Website.

The Website is owned by HELLAS VERONA FC S.P.A. (hereinafter “HELLAS VERONA”), which is also the owner of the domain name and the holder of the “HELLAS VERONA FC” trademarks, as well as the provider of the Website registration service.

The offer and sale of Products on the Website are carried out by CALICANTUS S.R.L. (hereinafter “CALICANTUS”), which, upon authorization and appointment by HELLAS VERONA, manages sales and transactions executed through the Website (for example: order management, sale and delivery of products).

HELLAS VERONA provides the services that enable access, browsing and registration on the Website, necessary to purchase the Products, as well as the related support services. The services described are therefore also provided through a total or partial sharing of purposes and means, as further described below.

HELLAS VERONA and CALICANTUS, in compliance with the provisions of EU Regulation 679/2016 (the “Regulation”) and Legislative Decree No. 196 of 30 June 2003 (the “Privacy Code”), as amended by Legislative Decree 101/2018, shall process the personal data provided by you according to different modalities:

• HELLAS VERONA shall process the following personal data of the user, as Independent Data Controller:

• Management of Website browsing data:

• Common personal data: IP addresses or domain names of the computers and terminals used by users, URI/URL addresses, request time and other parameters relating to the user’s operating system and IT environment.

• Management of data necessary for registration on the Website:

• Common personal data: name, date of birth, place of birth, gender, contact details (physical address, email, phone number), tax code, VAT number.

• Management of cookies and any other trackers installed through the Website:

• Common personal data: cookies and other trackers.

• Management of data collected through the Website for profiling purchasing and browsing habits:

• Common personal data: personal and contact details, details relating to references/sizes/format/prices of purchased products, purchase frequency, browsing data.

• CALICANTUS shall process the following personal data of the user, as Independent Data Controller:

• Management of data necessary for the conclusion of the purchase contract.

• HELLAS VERONA and CALICANTUS shall jointly process, as Joint Controllers (hereinafter the “Joint Controllers”), the following personal data of the user:

• Management of online orders placed through the Website:

• Common personal data: personal and contact details (e.g. purchaser’s name, email address, delivery address, telephone number, etc.); payment method details (last 4 digits of the credit card and transaction ID); details relating to orders placed.

• Management of sales and delivery data relating to products:

• Common personal data: personal and contact details, orders placed and details relating to references/sizes/format/prices of purchased products; purchase date and time; other order-related information communicated by data subjects.

• Customer service management:

• Common personal data: personal and contact details, details relating to orders placed and other information provided by data subjects.

• Special categories of personal data: health-related data, such as product allergies.

In particular:

• HELLAS VERONA shall process the user’s personal data, as Independent Data Controller, in order to manage access to the Website and facilitate the purchase of Products, as well as to allow registration on the Website, provide technical support and pre-sales assistance, and, subject to the data subject’s consent, for general marketing purposes;

• CALICANTUS shall process the user’s personal data, as Independent Data Controller, in order to enable the conclusion of the purchase contract, perform obligations arising therefrom, comply with all legal obligations, including tax and administrative obligations, and for all other purposes connected to such contract and/or the execution of pre-contractual measures, as described in this privacy notice.

2. Joint Controllership Agreement between HELLAS VERONA and CALICANTUS

Why is there joint controllership?

HELLAS VERONA and CALICANTUS are Joint Controllers because they jointly determined the means and, partially, the purposes of the processing of the personal data of data subjects.

For which processing activities does joint controllership apply?

Joint controllership concerns the processing of data for the following purposes:

• Management of online orders placed through the Website;

• Management of sales and delivery data relating to products;

• Customer service management.

Furthermore, as already defined in section 1, HELLAS VERONA and CALICANTUS also carry out certain processing activities as independent controllers.

What have HELLAS VERONA and CALICANTUS agreed upon?

Within the scope of jointly managed processing activities, the parties agreed on how to jointly or individually comply with the obligations provided for by the Regulation.

What does this mean for data subjects?

Below is the content of the agreement between HELLAS VERONA and CALICANTUS concerning security measures, privacy notices and the exercise of rights:

• both Joint Controllers are responsible, each within their own area of competence, for adopting the security measures necessary to guarantee the protection of data subjects’ data;

• both Joint Controllers are responsible for making this Website privacy notice available to data subjects;

• data protection rights may be exercised against HELLAS VERONA, against CALICANTUS, or against both Joint Controllers, according to the procedures indicated below.

3. Identity and Contact Details of the Data Controllers

3.1 Identity and contact details of HELLAS VERONA FC S.P.A. as Independent Controller and Joint Controller

HELLAS VERONA is the Independent Controller of the data provided during registration on the Website, browsing activities, and the collection of data for profiling and marketing purposes, for the purposes described in this privacy notice.

HELLAS VERONA is Joint Controller of the data provided for the management of online orders through the Website, management of sales and delivery data relating to products, and management of Customer Service.

The identification and contact details of HELLAS VERONA are as follows:

HELLAS VERONA FC S.P.A.
Via Olanda 11, 37135 Verona (VR)
Tax Code and VAT No.: IT02284490238
Website: https://www.hellasverona.it/
Certified email (PEC): veronafc@legalmail.it

The Data Controller has appointed:

• Data Protection Officer (DPO): Data Consult S.r.l., represented by Mr. Daniele Laghi, contactable at: dpo@hellasverona.it

• Authorized personnel: the updated list is kept at the registered office of the Data Controller.

• Data Processors: the updated list is kept at the registered office of the Data Controller.

3.2 Identity and contact details of CALICANTUS S.R.L. as Independent Controller and Joint Controller

CALICANTUS is the Independent Controller of the data provided in connection with the conclusion of a purchase contract through the Website, for the purposes described in this privacy notice.

CALICANTUS is Joint Controller of the data provided for the management of online orders through the Website, management of sales and delivery data relating to products, and management of Customer Service.

The identification and contact details of CALICANTUS are as follows:

CALICANTUS S.R.L.
Via Luigi Mazzon 28-30, 30020 Quarto D’Altino (VE)
Tax Code and VAT No.: IT03757590272
REA VE-335872
Website: https://calicant.us/
Certified email (PEC): calicantussrl@dadapec.com

The Data Controller has appointed:

• Data Protection Officer (DPO): Mr. Nicola Ghinello, contactable at: nicola.ghinello@dpo-rpd.com

• Authorized personnel: the updated list is kept at the registered office of the Data Controller.

• Data Processors: the updated list is kept at the registered office of the Data Controller.

4. Purposes of Processing

4.1 Processing by HELLAS VERONA FC S.P.A. – Management of browsing data on hvstore.it

HELLAS VERONA, as Independent Controller, shall process users’ data for the purpose of managing the Website.

The legal basis for this processing is:

• the performance of contractual obligations relating to the use of the Website (arising from the general terms of use) pursuant to Article 6(1)(b) of the Regulation.

The provision of data for this purpose is mandatory, as processing is necessary to allow browsing on the Website. Refusal to provide such data may prevent or negatively affect browsing and use of the Website.

For this purpose, HELLAS VERONA shall process user data for a maximum period of 30 days.

4.2 Processing by HELLAS VERONA FC S.P.A. – Management of cookies and other trackers installed through the Website

HELLAS VERONA, as Independent Controller, shall process users’ data for the management of cookies and other trackers installed through the Website for the purposes described in the cookie policy.

The legal basis for this processing is:

• performance of contractual obligations relating to the use of the Website (for technical cookies) pursuant to Article 6(1)(b) of the Regulation;

• consent of the data subject (for non-technical cookies and trackers) pursuant to Article 6(1)(a) of the Regulation.

The provision of data for this purpose is mandatory insofar as it is necessary to allow browsing of the Website.

For this purpose, HELLAS VERONA shall process user data until expiry of the periods specified in the cookie policy published on the Website.

4.3 Processing by HELLAS VERONA FC S.P.A. – Marketing communications

HELLAS VERONA, as Independent Controller, shall process users’ data for sending marketing communications (mass email marketing campaigns, direct mail marketing, etc.) relating to HELLAS VERONA sports club, including communications regarding sporting events, cultural events and promotions.

The legal basis for this processing is the data subject’s consent pursuant to Article 6(1)(a) of the Regulation.

The provision of data for this purpose is optional.

For this purpose, HELLAS VERONA shall process user data for up to 24 months from the date consent is given, unless renewed.

4.4 Processing by HELLAS VERONA FC S.P.A. – Profiling and personalized advertising

HELLAS VERONA, as Independent Controller, shall process users’ data for enriching the user profile with sales data and analyzing user behavior in order to send personalized advertising.

The legal basis for this processing is consent pursuant to Article 6(1)(a) of the Regulation.

The provision of data for this purpose is optional.

For this purpose, HELLAS VERONA shall process user data for up to 12 months from the date consent is given, unless renewed.

4.5 Processing by HELLAS VERONA FC S.P.A. and CALICANTUS S.R.L. – Verification of sales reporting data and quantities of products sold

HELLAS VERONA and CALICANTUS, as Joint Controllers (with regard to the use of means and purposes), shall process users’ data for the purpose of verifying the execution of the contract in force between the Joint Controllers and, therefore, for reporting purposes, verifying the quantities of products sold, determining the economic compensation between the parties, and managing any disputes between them.

The legal basis for this processing is the legitimate interest in performing the contract in force between the Joint Controllers pursuant to Article 6(1)(f) of the Regulation.

For this purpose, HELLAS VERONA and CALICANTUS shall process user data for 10 years, without prejudice to any longer retention periods required by law or justified by legitimate interests (for example, pending litigation).

4.6 Processing by HELLAS VERONA FC S.P.A. – Verification of quality standards in sales management

HELLAS VERONA, as Joint Controller (with regard only to the use of means but with separate purposes), shall process users’ data to verify the maintenance of adequate quality standards and the level of diligence required in sales management, as established in the sales management agreement in force with CALICANTUS.

The legal basis for this processing is the legitimate interest in ensuring that order management activities are carried out diligently and in compliance with quality and reputational standards associated with the HELLAS VERONA brand pursuant to Article 6(1)(f) of the Regulation.

For this purpose, HELLAS VERONA shall process user data for the entire duration of the subscription to the e-commerce service related to the Website.

4.7 Processing by HELLAS VERONA FC S.P.A. and CALICANTUS S.R.L. – Management of complaints and customer service requests

HELLAS VERONA and CALICANTUS, as Joint Controllers, shall process users’ data for the management of complaints and requests received through customer service, including technical support requests, returns, refunds, and disputes.

The legal basis for this processing is:

• for HELLAS VERONA:

• performance of contractual obligations relating to the use of the Website pursuant to Article 6(1)(b) of the Regulation;

• legitimate interest in responding to commercial inquiries regarding products sold on the Website pursuant to Article 6(1)(f);

• explicit consent for processing special categories of data pursuant to Article 9(2)(a).

• for CALICANTUS:

• performance of contractual obligations arising from its role as online seller pursuant to Article 6(1)(b);

• legitimate interest in retaining data in the event of disputes pursuant to Article 6(1)(f);

• explicit consent for processing special categories of data pursuant to Article 9(2)(a);

• establishment, exercise or defense of legal claims pursuant to Article 9(2)(f).

For this purpose, HELLAS VERONA and CALICANTUS shall process user data for 6 months, without prejudice to any longer retention periods required by law or justified by legitimate interests.

4.8 Processing by CALICANTUS S.R.L. – Conclusion and performance of the purchase contract

CALICANTUS, as Independent Controller, shall process personal data in order to allow the conclusion of the purchase contract through the Website (for example: adding Products to the cart and selecting payment methods).

The legal basis for this processing is the performance of contractual obligations pursuant to Article 6(1)(b) of the Regulation.

For this purpose, CALICANTUS shall process user data for 10 years, without prejudice to longer retention periods established by law.

4.9 Processing by CALICANTUS S.R.L. – Administrative, accounting and tax purposes

CALICANTUS shall process users’ data for administrative, accounting and tax obligations connected with the purchase contract concluded through the Website, including bookkeeping and invoice issuance.

The legal basis for this processing is compliance with legal obligations pursuant to Article 6(1)(c) of the Regulation.

4.10 Processing by CALICANTUS S.R.L. – Payment purposes

CALICANTUS shall not store users’ credit card data.

CALICANTUS maintains contractual relationships with payment service providers, acquirers and banks in order to provide payment collection services. The association between CALICANTUS as seller, the user as debtor, and the payment service providers occurs through a secret code (“token”) generated via modules and/or plug-ins supplied directly by the payment providers.

Credit card data may be stored and managed, subject to the user’s consent, by payment service providers, acquirers or banks in order to facilitate subsequent purchases or refunds.

Any transfer of personal data outside the European Union shall take place in compliance with Articles 44 et seq. of the Regulation and subject to adequate safeguards.

4.11 Processing by CALICANTUS S.R.L. – Exercise of rights

CALICANTUS shall process users’ data in order to:

• respond to requests relating to withdrawal rights, legal guarantees of conformity and other contractual or statutory rights;

• perform activities necessary following the exercise of such rights, including refunds;

• respond to requests concerning the exercise of data protection rights under the Regulation.

The legal basis for this processing is compliance with legal obligations pursuant to Article 6(1)(c) of the Regulation.

4.12 Processing by CALICANTUS S.R.L. – Establishment, exercise or defense of legal claims

CALICANTUS shall process users’ data for the establishment, exercise or defense of legal claims before any competent authority.

The legal basis for this processing is the legitimate interest of the Controller pursuant to Article 6(1)(f) of the Regulation.

User data may be retained for evidentiary purposes relating to the purchase contract, legal claims, complaints, responses to requests, or compliance with legal obligations, for the retention periods specified by law or indicated in this privacy notice.

5. Disclosure of Personal Data

5.1 Categories of recipients to whom HELLAS VERONA FC S.P.A. discloses personal data

HELLAS VERONA may disclose personal data to:

• employees and collaborators for marketing, administrative and IT support activities;

• companies, consultants or professionals responsible for installation, maintenance and management of hardware and software, including cloud computing and chat service providers;

• public authorities where required by law;

• public or private entities, including legal, administrative and tax advisors, where disclosure is necessary for contractual or legal compliance or for the establishment, exercise or defense of legal claims.

5.2 Categories of recipients to whom CALICANTUS S.R.L. discloses personal data

CALICANTUS may disclose personal data to:

• employees and collaborators for administrative, accounting, IT and logistics support;

• technology service providers and consultants;

• logistics, warehousing, packaging, shipping and delivery providers;

• payment service providers, acquirers and banks;

• public authorities and professional advisors where required by law or necessary for contractual compliance or legal defense.

5.3 Transfers outside the European Union

Personal data collected through the Website may be transferred outside the European Union where necessary for the purposes described in this notice. In such cases, HELLAS VERONA and CALICANTUS undertake to adopt the safeguards required under Articles 45 et seq. of the Regulation.

5.4 Rights of the data subject

The data subject has the right to obtain from HELLAS VERONA and/or CALICANTUS, within the limits established by the Regulation:

• access to personal data;

• rectification or completion of inaccurate or incomplete data;

• erasure of personal data;

• restriction of processing;

• objection to processing;

• data portability.

Requests may be submitted without formalities using the contact details provided in section 3 of this notice.

The data subject also has the right to:

• object at any time, on grounds relating to their particular situation, to processing based on the legitimate interests of the Controller;

• obtain confirmation as to whether personal data concerning them are being processed;

• receive personal data in a structured, commonly used and machine-readable format;

• transmit such data to another controller without hindrance.

Where the right to object is exercised, the Controllers shall refrain from further processing unless compelling legitimate grounds exist or processing is necessary for the establishment, exercise or defense of legal claims.

5.5 Time limits and methods for responding to requests

The Controller shall provide information regarding actions taken in response to requests concerning data subject rights without undue delay and, in any case, within one month of receipt of the request.

This period may be extended by two additional months where necessary, taking into account the complexity and number of requests.

If the Controller does not comply with the request, the data subject shall be informed within one month of the reasons for the refusal and of the possibility to lodge a complaint with a supervisory authority or seek judicial remedy.

Responses and actions undertaken following the exercise of rights shall be provided free of charge unless requests are manifestly unfounded or excessive.

5.6 Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, the data subject who believes that the processing concerning them infringes the Regulation has the right to lodge a complaint with a supervisory authority, particularly in the Member State of their habitual residence, place of work or place of the alleged infringement.