PRIVACY

PRIVACY

NOTICE REGARDING THE PROCESSING OF PERSONAL DATA OF THE COLLABORATORS

Pursuant to art. 13 of EU Regulation 2016/679 of 27/04/2016

Pursuant to Article 13 of EU Regulation 2016/679 of 27/04/2016, hereinafter referred to as RGPD (General Regulation for the Protection of Personal Data), this Notice is provided to inform you of the following:

Owner and manager of the processing

The Data Controller is FANATICS ITALY S.R.L., Via Privata Pietro Magistretti, 10, 20128 Milano MI.

Purpose of the processing

The personal data provided are collected when you place an order and purchase goods and while you are browsing or using the services offered on www.bolognafcstore.com.

FANATICS ITALY S.R.L. may therefore collect data about you such as, for example, personal details (name and surname), shipping address and billing address, navigation data and your purchasing habits.

Your personal data are processed for the following purposes:

(a) to conclude and execute the contract for the purchase of goods offered on www.bolognafcstore.com;

b) to provide the services of www.bolognafcstore.com such as newsletter subscription;

c) allow you to register on the Site and the use of services reserved for registered users;

d) handle your requests submitted to our Customer Service;

e) marketing and promotional activities for products and services, commercial communications, both by automated means without operator intervention (e.g. sms, fax, mms, e-mail etc.) and traditional means (via telephone, mail);

f) statistical surveys and analysis with data in aggregate form to understand how users interact and use the Site, to improve our offer and our services.

Legal basis of the data processing

In the cases referred to in letters a) to d), the processing of your personal data does not require your express consent as the legal basis of the processing is art. 6 lett. b) ("processing is necessary for the performance of a contract to which the data subject is party or for the performance of pre-contractual measures taken at the request of the data subject") and e) ("processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller") of the RGPD.

In the cases referred to in letters e) and f) above, the legal basis for the processing of personal data is your express consent (art. 6 letter a) and art. 7 of the RGPD). This consent concerns both the automated and the traditional methods of communication described above. You will always have the right to object easily and free of charge, in whole or in part, to the processing of your data for said purposes, excluding, for example, the automated methods of contact and expressing your wish to receive commercial and promotional communications exclusively through traditional methods of contact.

Mandatory or optional nature of the conferment of data and the consequences of an eventual refusal to provide personal data

The data requested for the purposes referred to in paragraphs a), b), c) and d) above must be provided for the fulfillment of legal obligations and / or for the conclusion and execution of the contractual relationship and the provision of services required. Therefore, your refusal, even partial, to provide such data would make it impossible for the Supplier to establish and manage the relationship itself and to provide the requested service.

The provision of personal data necessary for the purposes referred to in paragraphs e) and f) above is optional, therefore, your refusal to provide such data would make it impossible to carry out the activities described therein.

Methods of data processing

The processing of personal data is carried out by means of the operations indicated in art. 4 n. 2) RGPD, for the aforementioned purposes, both on paper and computer, by means of electronic or automated tools, in compliance with the current legislation in particular regarding confidentiality and security and in compliance with the principles of correctness, lawfulness and transparency and protection of the Customer's rights.

The processing is carried out directly by the owner's organization, by its managers and/or delegates.

Communication and Dissemination

Your personal data may be communicated, within the limits strictly pertinent to the obligations, tasks and purposes referred to above and in compliance with current legislation on the subject, to the following categories of subjects:

1. subjects to whom this communication must be made in order to fulfill or require the fulfillment of specific obligations under laws, regulations and/or EU legislation;

2. companies belonging to the Data Controller's Group or controlling, controlled or associated companies pursuant to Art. 2359 of the Italian Civil Code, which act as data processors or for administrative and accounting purposes (purposes connected with the performance of activities of an internal organisational, administrative, financial and accounting nature, in particular, functional to the fulfilment of contractual and pre-contractual obligations)

3. individuals and/or external legal entities that provide services instrumental to the activities of the Owner for the purposes referred to in paragraph 1. above (eg call centers, suppliers, consultants, companies, organizations, professional firms). These subjects will operate as data processors.

Personal data will not be disseminated in any way.

Retention period of the personal data

In compliance with the provisions of art. 13 paragraph 2 lett. a) of the EU Reg., all the aforementioned data may be kept for the entire duration of the contract entered into with the Data Controller concluded which data will be retained for the completion of the terms provided by law for the storage of administrative documents after which they will be deleted.

Transfer of data

Personal data is stored on servers located within the European Union. In any case, it is understood that the Data Controller, if necessary, will have the right to move the servers even outside the EU. In this case, the Data Controller hereby ensures that the transfer of data outside the EU will take place in accordance with the applicable legal provisions, subject to the stipulation of the standard contractual clauses provided for by the European Commission.

Rights of the interested party

As an interested party, pursuant to art. 15 GDPR you have the right to:

1) obtain from the data processing owner confirmation as to whether or not the personal data concerning you is being processed and, in this case, to obtain access to the personal data and to the following information:

a) the purposes of the processing;

b) the categories of such personal data;

c) The recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular if they are recipients of third-party countries or international organizations;

d) when possible, the retention period of the personal data provided or, if not possible, the criteria used to determine such period;

e) the existence of the right of the interested party to ask the data processing owner for the correction or deletion of the personal data or for the limitation to the processing of the personal data concerning him, or to oppose to its handling;

f) the right to lodge a complaint with a supervisory authority;

g) if the data is not collected from the data subject, all available information on its origin;

h) the existence of an automated decision-making process, including the profiling referred to in Article 22, paragraphs 1 and 4, and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the interested party.

2) If personal data is transferred to a third-party country or to an international organization, the interested party has the right to be informed of the existence of adequate guarantees pursuant to Article 46 relating to the transfer.

3) The data processing owner provides a copy of the personal data that is being processed. In case further copies are requested by the interested party, the data processing owner may charge a reasonable fee based on the administrative costs. If the interested party submits the request by electronic means, and unless otherwise indicated by the interested party, the information is provided in a commonly used electronic format.

4) The right to obtain a copy referred to in paragraph 3 must not affect the rights and freedom of others.

5) Where applicable, you also have the rights referred to in art. 16-21 RGPD (Right of rectification, right to oblivion, right to limitation of processing, right to data portability, right of opposition), as well as the right of complaint to the Guarantor Authority.

Privacy Notice Regarding the Processing of Personal Data

Effective Date: 17/11/2025

Fanatics Italy S.R.L. and Bologna Football Club 1909 S.p.a. (“Bologna FC”) act as independent data controllers for their respective personal data processing activities on this website.

This privacy notice (“notice”) applies only to processing of your personal data on Fanatics’ sites, apps, or other digital properties, but also through in-venue/event purchases we offer or in-person/online events we may organize (“Properties”) by Fanatics Italy S.R.L. ("Fanatics,” “we,” “our,” or “us”).

In particular, Fanatics S.R.L. is the data controller of personal data for the purposes illustrated below, while Bologna Football Club 1909 S.p.a. is the data controller of personal data for marketing and profiling purposes.

The privacy notice of Bologna FC can be consulted at this link: Privacy Policy – Bolognafc.

Sources of your Personal Data

As the data controller, we collect personal data when you engage with our digital properties, including our websites, mobile apps, and other online platforms, as well as when you make purchases, contact us by phone or email, interact with us on social media, or respond to our advertising.

We may also collect information about you from our Fanatics group entities (such as our affiliates and subsidiaries), services providers, advertising networks, public sources, social media platforms and networks, and data enrichment services, organizations that prepare events with/for us, and other third parties.

We may combine information that we receive and make inferences to create a profile about you reflecting your preferences and characteristics.

Categories of Personal Data Processed

We may process the following categories of personal data:

Contact details: name, title email address, phone number, shipping/billing address
Identification data: gender, date of birth, pictures
Account information: username and encrypted password (if account registration is available), information about your interaction with the account
Transaction data: purchase details, delivery details, payment confirmations, order history, refund information
Communication data: content of customer service interactions, complaints, inquiries, surveys or product reviews
Technical, device and observed data: IP address, browser type, operating system, session time, cookie identifiers, browsing behavior, and preferences on our site, other information about your interaction with our site and communications (e.g., date and time you access/open them, link that has brought you to our website/advertisement). We may also infer information about you, such as a geographical region, based on your IP address; income and gender based on your geographical region or purchases, and how you feel about our brand, e.g., based on social media data.
Marketing preferences: opt-ins and opt-outs for newsletters, email marketing, and personalized advertising, any preferences we have observed and/or inferred (e.g., types of offers that interest you, areas of website that you visit, likelihood that you will interact with our site in a certain way)

We do not intend to collect special categories of personal data (such as information on racial or ethnic origin, political opinions, data concerning health, or other information considered sensitive by law). To the extent you may inadvertently share such data with us, we will only retain such personal data we will only process it where relevant and necessary.

Purpose of Processing and Legal Basis

Each processing activity is matched to its legal basis and relevant data categories:

Purpose	Legal Basis	Personal Data Used
a) Fulfill purchase contracts (including processing of payments, share data with payment services providers to assess whether you qualify for their payment options and to tailor the payment options for you, and delivery of goods, warranty) Your interactions with payment services providers, including how they process your personal data, are governed by their respective privacy policies.	Performance of contract with you	Identification data, contact details, transaction data
b) Account registration, access, and management (including confirmation of your identity)	Performance of contract with you Legal obligation (e.g., where age verification is legally required) Legitimate interest (where we decided to limit access to our services based on age)	Identification data, contact details, account credentials
c) Customer service support (through our customer service center or where you request notifications from us to inform you about certain products)	Performance of contract with you Legitimate interest (when outside of our contractual obligations) Consent (when you request, e.g., a notification that certain product is back in stock)	Contact details, communication data
d) Marketing communications (including to assess and monitor your interaction with them)	Consent Legitimate interest (where consent is not required, for example if you provide us with your Contact Information in the course of a sale – you can always opt-out of these communications via the unsubscribe link on any communication from us)	Contact details, marketing preferences, technical, device and observed data
e) Improve and broaden marketing activities (including sharing details of customers with social media companies to show Fanatics products, create ‘lookalike’ audiences, build a more complete picture of the type of individuals who may be interested in our products and focus our marketing activity on those individuals; and when we need to share limited personal data with service providers for the above purposes to test/ensure quality of their services)	Consent Legitimate interest (where consent is not required)	Contact details, marketing preferences, technical, device and observed data, communication data
g) Manage competitions, promotions and other public outreach activities	Performance of contract with you (e.g., to provide discount where you participate in a promotion) Consent (e.g., if you participate in a competition and we would like to use your picture for promotional purposes) Legitimate interest (where consent is not required)	Contact details, identification data, communication data, marketing preferences
h) Business administration (including to minimize risk of fraud against genuine customers and our business, keep records required by law or to evidence our compliance with laws, including tax laws, consumer protection laws and data protection laws, and provide information to law enforcement agencies or other authorities where we are required to do so)	Legal obligation Legitimate interest (to protect you and our business)	Contact details, Identification data, Account credentials, Transaction data, Communication data, Technical, device and observed data

We may also collect your personal data through cookies or other tracking technologies and infer certain Technical, device and observed data for the purposes listed in our Cookie Policy.

Children’s Data

This website is not intended for children under 16. If we become aware that we have collected personal data from a child under 16, we will delete it. Please refer to our Terms & Conditions for age restrictions, which may require use by individuals over 18.

Mandatory vs. Optional Data Provision

Data required for fulfilling orders, providing services, and customer support is mandatory.
Data for marketing and analytics purposes is optional. Refusal to provide optional data will not affect your ability to use the core services.

Communication and Dissemination

Your data may be shared with:

Our partners, such as:

Bologna FC, in its role as independent controller, for its respective processing activities.

Third-party service providers, such as:

Fulfillment partners and courier services
Payment gateways and fraud prevention services
Event support organizations
Cloud and IT service providers supporting platform operations
Data analytics providers
Advertising services providers (such as providers that help us verify whether you purchased something on our Properties, based on your interaction with one of our advertisements, third-party affiliates, which help us better understand our customers, by providing additional information collected about them)

Regulatory, tax, law enforcement, or judicial authorities, where required by law
Professional advisors such as lawyers, accountants, auditors, translators, and other professionals, where they advise us on our relationship
Affiliated Fanatics companies or subsidiaries who provide some services for us, or where they process personal information for their own purposes (e.g., where you provide consent for them to send you marketing communications)
Prospective purchasers or purchasers of any part of our business, or otherwise in connection with a sale, merger, change of control, bankruptcy, or similar transactions
With other third parties with your consent

Retention Period of Personal Data

We retain personal data for as long as we need to fulfil the purposes set out in this notice and for as long as we have a legal requirement to do so. The retention periods are generally based on the following criteria:

Account data: retained until the account is deleted
Purchase data: retained for the duration of the applicable legal limitation period (e.g., 10 years for contractual / civil claims in Italy)
Marketing data: retained until consent is withdrawn, or as long as you have may reasonably expect our processing of your personal data, where we rely on a legitimate interest
Otherwise retained for legal compliance / establishment, exercise or defense of legal claims: retained as required by law, e.g., for taxation, accounting, and legal risk management purposes

If you would like to know more about retention periods applicable to your particular circumstance, you can contact us using details provided below.

Transfer of Data

Where your personal data is transferred outside the European Economic Area (EEA), we ensure adequate protection through mechanisms such as (as applicable):

Standard Contractual Clauses approved by the European Commission (such as when we transfer personal data within our group of companies)
Adequacy decisions from the European Commission (where applicable – e.g., when transferring personal data to the UK)
Binding Corporate Rules, approved by competent supervisory authorities
Statutory derogations for certain specific transfers, such as based on your explicit consent, contractual necessity, in order to establish, exercise or defend legal claims, and others.

A copy of relevant safeguards and further information may be requested using contact information below.

Rights of the Data Subject

To the extent your personal data is covered by EEA data protection laws, you may exercise the following rights subject to conditions therein:

Right of access – obtain information about processing, access your personal data and obtain a copy if the same.
Right to rectification – request correction of inaccurate or incomplete personal data.
Right to erasure – request deletion of your personal data under certain conditions.
Right to restrict processing – limit how your personal data is used in specific scenarios.
Right to object – object to processing for direct marketing or where based on certain legitimate interests.
Right to data portability – receive your personal data in a structured, commonly used and machine-readable format.
Right to refuse or withdraw consent – at any time where consent is the legal basis for processing of your personal data without any adverse consequences. The lawfulness of any processing of your personal data that occurred prior to the withdrawal of your consent will not be affected.
Right to Not Be Subject to Automated Decision-making. You have the right not to be subject to a decision based solely on automated processing and to be given more information about why any such decision was made.

To exercise any of these rights, please contact us using information below. You also have the right to lodge a complaint with your local supervisory authority or with authority where the conduct that is the subject of your complaint occurred.

Updates to This Privacy Policy

This privacy policy may be updated periodically. Please refer to the “Last Updated” date to stay informed of changes.

Third Party Websites

Our site may contain links to other websites or digital resources. We are not responsible or liability for, or have any control over, those other sites or resources. We suggest that you read the privacy policy and terms of use of each such website, which govern your interaction with them and their use of your personal data.