Privacy Policy

1. Data controller and Data Protection Officer (DPO)

Data controller: La Sicilia Investimenti S.p.A., with registered office at Viale Vittorio Veneto, 172 – 95127 Catania (CT), Italy.

Data Protection Officer (DPO): reachable at the email address [email protected].

You may contact the Controller and the DPO for any request concerning the processing of your personal data carried out through the La Sicilia Digital Newsstand website (hereinafter, the "Site") and the services connected to it.

2. Scope

This notice describes how the personal data of users of the Site is processed. The Site, accessible from a browser, allows users to browse the catalog of digital editions, read the editions, manage a personal account and buy single editions.

The Site relies on a proprietary La Sicilia back end and on the third-party services listed in Section 6. The account is shared with the "La Sicilia: News & Edicola" app, for which a dedicated notice is available. The processing carried out by lasicilia.it and by the other sites reachable through links is governed by their respective notices.

3. Categories of personal data processed

4. Purposes and legal basis of the processing

• Creation and management of the account, authentication, password recovery and access to the services. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Provision of the digital newsstand: browsing the catalog and reading subscribed or purchased editions. Legal basis: performance of a contract.
• Management of single-edition purchases and verification of active subscriptions. Legal basis: performance of a contract.
• Handling of support requests. Legal basis: performance of a contract / legitimate interest in improving the service.
• Compliance with legal obligations (e.g. tax and accounting obligations, requests from authorities). Legal basis: legal obligation (Art. 6(1)(c)).
• Security of the Site, prevention of abuse and fraud (e.g. unlawful use of access to the editions). Legal basis: legitimate interest of the Controller (Art. 6(1)(f)).
• Sending of promotional/marketing communications. Legal basis: consent (Art. 6(1)(a) — optional and revocable).

5. Processing methods and retention period

Data is processed with IT and telematic tools, following logics strictly related to the purposes indicated and, in any case, in a way that guarantees its security and confidentiality.

Data is retained for the time necessary to pursue the purposes indicated above and, in particular:

• account data is retained for the entire duration of the contractual relationship and, after the account is deleted, for the period indicated by the provider of the account management and data storage services;
• tax/accounting data relating to purchases is retained for the period required by the applicable tax legislation;
• session cookies last as long as the login session and are deleted when you log out of the account;
• the reading authorization issued to the PressReader reader expires after one hour;
• browsing data is retained for the time strictly necessary for the security of the service [period to be confirmed with the hosting provider];
• marketing consent is retained until the user withdraws it. As of the date of this notice the Site does not offer a function to withdraw marketing consent: withdrawal can be requested by writing to the contact addresses indicated in Section 1.

6. Recipients of the data and third-party services

To provide its services, the Controller relies on the following third-party providers, to which personal data may be disclosed to the extent strictly necessary:

• Application back-end provider — user profile, session tokens, profile photo. Purpose: provision of the service.
• Site hosting provider [to be specified] — browsing data. Purpose: technical provision of the Site.
• VirtualNewspaper — personal details, consents, order and subscription data. Purpose: account and subscription management.
• PressReader — pseudonymous reader identifier, opened edition and technical reading data; IP address for loading the covers from its distribution service. Purpose: provision of the digital newsstand.
• RevenueCat — user identifier for purchases (app_user_id), purchased edition, payment outcome; checkout page. Purpose: purchase management.
• Stripe — payment data entered at checkout. Purpose: payment processing.
• Google (Google Sign-In) — ID token and Google profile data when signing in with Google. Purpose: authentication.
• Apple (Sign in with Apple) — ID token, email/name (if authorized) when signing in with Apple. Purpose: authentication.

Depending on the case, these parties act as data processors pursuant to Art. 28 GDPR or as independent data controllers for the purposes of their respective services.

Data is not disseminated. Personal data is not sold to third parties for advertising purposes: the Site does not integrate advertising or ad tracking tools.

7. Transfer of data to countries outside the EEA

Some of the providers indicated above (in particular Google, Apple, RevenueCat, Stripe and PressReader) are based or have infrastructure also outside the European Economic Area (EEA), in particular in the United States and Canada. The transfer of data to these countries, where it takes place, is based on an adequacy decision of the European Commission and/or on the adoption of the Standard Contractual Clauses approved by the European Commission, together with supplementary measures where necessary.

8. Cookies and similar technologies

The Site only uses technical cookies, necessary for its operation, for which consent is not required (Art. 122 of the Italian Privacy Code):

• ls_access_token and ls_refresh_token — keep the session active after login. httpOnly cookies, transmitted only over a secure connection, valid for the duration of the session.
• ls_profile — contains the name and profile photo to display them in the Site header; it does not give access to the account. Same duration as the session.

Some features involve third-party services that may set cookies or use browser storage according to their own notices: the "Sign in with Google" and "Sign in with Apple" buttons, when used; the PressReader reader, while reading an edition; the RevenueCat and Stripe checkout page, which opens on its own domain.

You can delete or block cookies from your browser settings; in that case, access to the account and reading the editions will not be available. For details, please refer to the Cookie Policy.

9. Analytics and measurement tools

As of the date of this notice, the Site does not use statistical analysis tools, nor third-party tools for behavioral advertising, cross-site tracking or advertising attribution. Should such tools be introduced, this notice will be updated and, where required, the user's consent will be collected before they are used.

10. Rights of the data subject

As a data subject, you have the right to obtain from the Controller, in the cases provided for, access to your personal data and the following:

• confirmation of the existence of processing and access to personal data (Art. 15 GDPR);
• rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR);
• erasure of data ("right to be forgotten"), in the cases provided for by Art. 17 GDPR;
• restriction of processing in the cases provided for by Art. 18 GDPR;
• data portability, where applicable (Art. 20 GDPR);
• objection to processing based on legitimate interest (Art. 21 GDPR);
• withdrawal of consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
• lodging a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it).

Profile data can be corrected directly from the personal area of the Site. To exercise the other rights, including account deletion, you can use the "La Sicilia: News & Edicola" app or contact the Controller or the DPO at the addresses indicated in Section 1.

11. Minors

The Site is not intended for minors under [to be specified, e.g. 14 years of age pursuant to Art. 2-quinquies of the Italian Privacy Code for consent to information society services, unless a different commercial policy applies]. The Controller does not knowingly collect data of minors below this threshold. Should it become aware of unauthorized processing of a minor's data, the Controller will delete that data.

12. Data security

The Controller adopts appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including: transmission of data over encrypted connections (HTTPS/TLS); storage of session credentials in httpOnly cookies, which the page's scripts cannot read and which are transmitted only over a secure connection; access keys to the providers' services kept exclusively server-side; short-lived reading authorizations; storage of passwords exclusively in protected form server-side.

13. Changes to this notice

This notice may change over time. Any changes will be published on this page with the date of the last update and, if substantial, communicated to users by email or other appropriate channels.

14. Contacts

La Sicilia Investimenti S.p.A.

Viale Vittorio Veneto, 172 – 95127 Catania (CT), Italy

DPO / Privacy: [email protected]