As joint data controllers, the company Ducati Motor Holding S.p.A. (“Ducati”) and the Ducati Foundation (together the “joint controllers”) hereby inform you of the following regarding the processing of your personal data (the “Data”) pursuant to art. 13 of EU Regulation 2016/679 on the protection of personal data (the “Regulation”). 

1. Data Processing Purposes

The joint data controllers process the personal data that you provide us within the context of the procedures for online booking and access to the Company’s premises and locations (Museum, Physics in Motion workshop, and Factory), by filling out a form in which the following types of information are requested: name, surname, country, telephone number, email address, etc.

Personal data may also be collected by the reception staff directly at the time of admission to the Company’s premises. 

The Privacy Policy of the Site is published at the following web page: https://www.ducati.com/it/it/home/privacy. We process your personal data for the following purposes.

a) Purposes necessary to Customer relationship management

The joint data controllers process the personal identification data that you provide (e.g. name, surname, address, telephone number, email address – hereinafter referred to “personal data” or even merely “data”) using both paper and electronic means, filled out and signed for the following respective purposes: 

Ducati Motor Holding processes the data to carry out graphics activities and Ducati community activities, as well as to offer canteen services and any other service that may be required or necessary.

The Ducati Foundation processes the data in order to manage the guided tours (including the booking procedures carried out both on the internet and via the concierge/answering service).

The personal data collected upon admission to the building are only used to identify the Data Subjects for corporate security and access control purposes. These processing activities are based on the Company’s legitimate interest in ensuring the protection of the people who are admitted to the premises, and the protection and integrity of the company’s property and assets. 

The joint data controllers process your data in order to correctly carry out the obligations arising from a contract with you, or else pre-contractual activities at your request, even by transmitting data between Ducati and the Ducati Foundation.

The joint data controllers processes your personal data to comply with laws and regulations relevant to the above specified activities and to exercise legal claims.

The provision of your personal data is necessary for these purposes, and any refusal would prevent you from being admitted to and visiting the Company's premises.

2. Method of processing and legal grounds for processing

The joint data controllers process the personal identification data that you provide (e.g. name, surname, address, telephone number, email address – hereinafter referred to “personal data” or even merely “data”) using both paper and electronic means, filled out and signed by the data subject in order to use the services requested, based on logics and procedures consistent with the purposes indicated, and in compliance with the Regulations, including the confidentiality and security profiles.

In compliance with the Regulations, your personal data is used to update and rectify the information collected previously.

Your personal data are processed based on your consent, a legitimate interest of Ducati for the performance of commercial activities, obligations arising from a contract entered into between you and Ducati, or legal obligations.

You have however the right to withdraw the consent given at any time, thus withdrawal however not affecting the legitimacy of any previous processing.

3. Recipients of your personal data

Personal data are accessed by our duly authorized personnel on a need-to-know basis and disclosed to third parties in the following cases: (i) when disclosure is required by applicable laws and regulations with respect to legitimate third party recipients of communications such as authorities and public bodies for their respective institutional purposes; (ii) when disclosure is necessary to perform a contract or pre-contractual activities activated by your request, e.g. communication of your data to one of our Dealers or business partners to enable it to provide you with the information, products or services requested by you; (iii) in case of disclosure to third parties in the event of extraordinary transactions (e.g. mergers, acquisitions, sale of business, etc.). 

Your personal data are also shared with our service providers, such as the company that manages the reception and concierge service, who act as Data Processors for the Foundation based on the instructions received from the same. An updated list of the Data Processors and subjects to whom the data are disclosed can be obtained by submitting a request to the Data Controller or the Data Protection Officer, as identified below. The personal data will not be disseminated in any way. 

4. Transfer of personal data outside the European Union

Some of the companies of the Ducati Group, the sales network or third parties contractually linked to the Joint Data Controllers that may access your personal data are also established outside the European Union, in countries that do not guarantee an adequate level of protection of personal data according to the standards established by the Regulation. Ducati takes the necessary precautions for a legitimate transfer of data (e.g. through the implementation of Standard Contractual Clauses approved by the European Commission). You may request information on the cross-border transfer of your personal data at any time by contacting Ducati or Ducati's Data Protection Officer at the addresses provided below. 

5. Storage of personal data

Your personal data are kept by Ducati for the time strictly necessary to pursue the purposes for which they are collected and for the fulfilment of the obligations of law (e.g. for administrative-accounting purposes)

Conservation for longer periods occurs only if permitted by law and in the event of legal defence of rights.

When the purposes are exhausted, personal data will be automatically deleted or made anonymous.

Upon request to the Data Controller and Data Protection Officer, the Data Subject may receive detailed information on the storage times of personal data processed by Ducati pursuant to the Regulation.

6. Data Controller and Data Protection Officer

The Joint Data Controllers are Ducati Motor Holding S.p.A., with registered offices at Via Cavalieri Ducati, 3 - 40132 Bologna (BO) Italy, and Fondazione Ducati, with registered offices at Via Cavalieri Ducati, 3 – 40132 Bologna (BO) Italy. The Data Protection Officer is domiciled at the headquarters of the Data Controllers and can be contacted at the following email address: privacy@ducati.com.

7. Your rights

You can contact Ducati as Joint Data Controller or Data Protection Manager at the above addresses to get an updated list of our data processors (i.e. our service providers), of the parties to whom the data are disclosed and to exercise the following rights as per art. 15 et seq. of the Regulation; to get access to your data to verify their existence and other information related to them, to obtain their rectification or cancellation, to request data portability, to obtain limitation of processing and to lodge a claim to the Supervisory Authority (the Authority for the Protection of Personal Data).

In addition, you may, at any time, object to the processing of your personal data processed for direct marketing purposes and, if required by a particular situation, you may object to the processing of your personal data on the basis of the Joint Data Controllers' legitimate interest unless the Joint Data Controllers have prevailing legitimate reasons for proceeding with the processing (e.g. the exercise or defence of a right in court).