ActivitiesProductsHelpContact
Buy NowMenu

Privacy Policy

PRIVACY POLICY UNDER ARTICLE 13 OF REGULATION (EU) 2016/679 FOR THE PROCESSING OF DATA FOR WHICH VOX MILANO PASS S.R.L. AND THE MILANO & PARTNERS ASSOCIATION ARE JOINT CONTROLLERS
Last updated: February 10, 2025.

This Privacy Policy regulates the processing of personal data and information collected by Vox Milano Pass S.r.l., a single-member company subject to the management and coordination activity exercised by Vox S.p.A., with its registered office at Via Pievaiola 21, Perugia, VAT number 03896580549 (“Vox” or “Data Controller”), as the data controller, for the purposes and in the manner specified below, in compliance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and Council of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data (“GDPR”) and the related implementing regulations.

  1. Personal Data Collected
    The personal data that concerns you is provided directly by you when you access or register on the website citypass.yesmilano.it (“Site”) and/or the “YesMilano Pass” application developed and provided by Vox (“App”; together with the Site, collectively the “Platform”), and subsequently, during its use.
    The App and the Site are designed to offer you a personal digital card (“YesMilano City Pass”) created and managed by Vox on behalf of the Milano & Partners Association in a public-private partnership. The Vox App also offers you: electronic access tickets (“Tickets”) to (i) museums, villas, churches, gardens, attractions, etc. (“Attractions”), (ii) any additional products offered by the Institutions as defined below (“Products”); (iii) additional services, including local public transport (“Accessory Services”), available under the YesMilano City Pass; and (iv) any other product and/or service provided by Vox through the App.
    The updated list of entities managing the Attractions, offering the Products and/or providing the Accessory Services (Institutions) is available at citypass.yesmilano.it. More information on how the Site and the App work, and the services offered, can be found by clicking on citypass.yesmilano.it.
    The personal data collected and processed by Vox includes:
    • The identification data you provide when accessing or registering on the Platform and subsequently during its use. This data may include: first and last name, address, phone number, email address, travel dates, and/or IP address;
    • Any personal data provided when contacting customer service;
    • Automatically collected data such as mobile device and unique device identifier, as well as software and hardware characteristics;
    • Data related to your use of the Platform, such as the content you view, how frequently you use the Platform, the purchase of Tickets, Products, and/or Accessory Services, etc.
  2. Purpose of Data Processing and Legal Basis
    The personal data mentioned in point 1 is processed by Vox and the Association, as joint controllers (“Joint Controllers”), for the following purposes:
    (a) Management of Platform registration, offering and use of the YesMilano City Pass, Tickets, Products and/or Accessory Services, and handling customer service requests sent to Vox’s customer support;
    (b) Fulfillment of obligations related to payments for the YesMilano City Pass and related invoicing;
    (c) Sending periodic updates and commercial and promotional communications from Vox and the Association regarding discounts, offers, services, or events related to the YesMilano City Pass. These communications may be sent via email, SMS, and/or WhatsApp;
    (d) Sending newsletters to your email address regarding products and services similar to those you have already purchased;
    (e) Statistical purposes using anonymized data.

The legal basis for processing your personal data is:
• The execution of a contract for the purposes listed in (a) and (b). This processing is therefore lawful under Article 6.1(b) of the GDPR;
• Your prior consent for the purposes of (d). You can withdraw your consent at any time to stop receiving communications, but this will not affect the lawfulness of the processing based on your consent before such withdrawal;
• The legitimate interest of the Joint Controllers for the purposes of (a), as permitted under Article 130, co. 4, of Legislative Decree 196/2003. You can object at any time to receiving such communications by opting out immediately at the time of access/registration to the Platform, by clicking on the link in the related email, or by contacting the Joint Controllers at the email address listed below.
Please note that any consent you have given for the purposes of (d) extends to commercial and promotional communications via email, SMS, and WhatsApp. You can choose to withdraw your consent to not receive any further commercial communications via any of these channels (email, SMS, WhatsApp), or withdraw it partially for specific communication methods. To withdraw consent, you can send a communication to privacy@milanocitypass.com.
Your consent is not required for the processing of anonymized data for the purpose of (e).
Providing your data is optional. However, refusing to provide the necessary data for registration on the Platform, invoicing, customer support, and payment management as outlined in (a) and (b) will prevent you from registering on the Platform and using all or part of the services and products offered by Vox. Even any later opposition or withdrawal of consent for processing these personal data for the aforementioned purposes will result in immediate suspension of the use of the related services.
Refusing to consent to processing for additional purposes such as sending updates and promotional communications listed in (c), or refusing consent for commercial communications from third-party companies partnering with Vox, will have no consequences, except for the inability to receive such marketing and promotional communications, as well as other commercial communications or content of your interest.
If you consent to the profiling activity outlined in (d), this will involve automated activities to place you into a category of subjects with homogeneous characteristics based on services you have used, your usage habits of the Platform, Tickets, Products, and/or Accessory Services you have purchased.

  1. Methods of Data Processing
    The processing of your data for the purpose described in paragraph 2 will take place through paper, automated, and electronic methods, based on logical criteria that are functional to the purposes for which the data was collected, and in any case, in compliance with all necessary precautions to ensure the security and confidentiality of the information under the GDPR.
  2. Communication of Personal Data
    Within the organizations of the Joint Controllers, your data may be processed by employees who need to know and/or use it only for the performance of their duties and for the provision of services. These individuals are designated in writing by Vox and the Association as data processors and are trained on the obligations set out by the GDPR. In the course of their activities, the Joint Controllers may share your personal data with the following third parties: Vox group companies, partners, and service providers who offer services on behalf of the Joint Controllers, mailing companies, and consultants. These entities are appointed as data processors for purposes for which you have given consent. A complete list of the data processors appointed by the Joint Controllers can be easily and freely obtained by sending a request to the address specified in paragraph 7 of this Privacy Policy.
    Finally, the Joint Controllers may disclose your data to judicial authorities to respond to subpoenas, fulfill orders issued by courts or other legitimate requests from competent authorities; to enforce or defend our rights or in legal proceedings; for investigative, prevention, or crime-fighting purposes, and in any other case required by law. Except as noted above, your data will not be shared with any other third parties or otherwise disclosed.
  3. Data Retention
    Your personal data will be stored on the servers of the Joint Controllers, located within the European Union. The Joint Controllers will not transfer your personal data to countries outside the European Union. Personal data collected for the processing purposes outlined in point 2 will be retained until you withdraw consent to receive commercial and promotional communications, or request the deletion of your data, except in exceptional cases where it is necessary to retain the data to defend the rights of the Joint Controllers in relation to ongoing disputes at the time of the request or as directed by public authorities. Please note that regardless of your withdrawal of consent or requests for deletion, your data will be retained for a maximum of one year from the date of collection, unless you intend to renew consent for such processing.
  4. Your Rights
    Finally, we inform you that you have the right to exercise the rights conferred under Articles 15-21 of the GDPR; namely, the right to obtain from the Joint Controllers access to, rectification, erasure, limitation of processing, withdrawal of consent, as well as data portability and the right to object to the processing of your data.
    We also remind you that you have the right to contact the Data Protection Authority (whose contact details are available at the following link: https://www.garanteprivacy.it/home/footer/contatti) to assert your rights regarding the processing of your personal data. For the purposes of this point 6, you may send a request to the Joint Controllers by email to privacy@milanocitypass.com or by registered letter to the registered office of Vox indicated in point 7 below.
  5. The Data Controllers
    The data controllers are Vox Milano Pass S.r.l., a single-member company subject to the management and coordination activity exercised by Vox S.p.A., with its registered office at Via Pievaiola 21, Perugia, VAT number 03896580549, and the Milano & Partners Association, with its registered office at Piazza della Scala 2 - 20121 - Milano (MI), VAT number 11016320969. The Joint Controllers can be contacted for requests or reports at the following email address: privacy@milanocitypass.com.
    The essential contents of the joint controller agreement between Vox and the Association are available here.