Privacy Policy - pursuant to Art. 13 and 14 of Regulation (EU) 2016/679 (GDPR)
Pursuant to Art. 13 and 14 of Regulation (EU) 2016/679 (“GDPR”), the following information is provided regarding the processing of the user’s personal data acquired when completing a form to register for an event organized or promoted by Dedar S.p.A.
1. Purposes of the data processing
The data processing is aimed at booking, registering and subscribing to the various events offered by Dedar S.p.A. and the subsequent participation in the event, including the logistical organisation.
2. Data processing methods
Pursuant to Art. 5 of the GDPR, the personal data being processed (the data that will be entered when filling out the form) shall be processed lawfully and fairly, and shall not fall outside the purposes set out in point 1.
The personal data processed for the purposes referred to in point 1 shall be processed in compliance with the principles of data minimisation and storage limitation, pursuant to Art. 5 no. 1 letter e) of the GDPR and shall be retained for 2 (two) years from the last interaction with the Data Controller, unless otherwise required by law.
In the event that the Data Subject withdraws his/her consent, their data shall be deleted within 3 (three) months of such request, without prejudice to specific legal obligations regarding the retention of accounting and administrative documentation.
The processing is carried out by means of the operations or sets of operations as set out in Art. 4 no. 2 of the GDPR and may be carried out with or without the aid of electronic or automated tools and according to logics that fully respond to the purposes pursued.
The data processing is carried out by the Data Controller, the Data Processor, and/or by persons appointed by the Data Controller and/or the Data Processor. The complete list of Data Processors is available upon request from the Data Controller.
3. Legal basis of the data processing, nature of data provision and consequences of refusal
The provision of personal data for the purposes referred to in point 1 of this Privacy Policy is carried out pursuant to Art. 6 no. 1 letter b) of the GDPR (performance of an agreement or pre-contractual measures), is optional and strictly necessary to allow participation in the event organised or promoted by the Data Controller.
However, it should be noted that any refusal by the Data Subject to provide his/her personal data shall make it impossible to carry out the activities referred to in point no.1.
4. Scope of communication of data
The data, subject to processing, may be communicated to entities acting as external Data Processors pursuant to Art. 28 of the GDPR, including, by way of example and not limited to: external collaborators, logistics services, consultants and, in general, all those subjects to whom communication is necessary for the correct fulfilment of the purposes indicated in point no. 1.
Data Controllers and Data Processors shall process data only if necessary to carry out their assigned tasks.
All this without prejudice to the guarantee of protection of the rights of the Data Subject.
5. Scope of data dissemination
Personal data shall not be disclosed.
6. Transfer of personal data abroad
Personal data may be transferred to European Union countries for the purposes referred to in point no. 1. Furthermore, in the event of use of cloud platforms for the storage and/or transfer of data, the same may be transferred to third countries, in compliance with the provisions of Art. 44 et seq. of the GDPR.
7. Rights of the Data Subject
Pursuant to Art. 15, 16, 17 et seq. of the GDPR, you can exercise your rights by contacting the Data Controller.
In particular, you are entitled to obtain from the Data Controller:
· confirmation of the existence or otherwise of your personal data and provision of the same data in an intelligible form;
· know the origin of the data;
· know the purposes and data processing methods;
· know the logic applied to the data processing;
· know the identifying details of the Data Controller and of the subjects to whom the data may be communicated;
· the updating, correction and integration of the data;
· the deletion, the transformation into anonymous form or the blocking of personal data processed unlawfully;
· the limitation of the data processing;
· oppose the processing of your personal data for direct marketing purposes;
· revoke the consent for the processing of your personal data;
· lodge a complaint with the Italian Authority for the Protection of Personal Data (Garante).
The Data Subject may, for legitimate reasons, object to the processing of data concerning him/her, even if pertinent to the purpose of the collection and, moreover, has the right to data portability pursuant to Art. 20 of the GDPR.
To exercise the aforementioned rights, you can contact the Data Controller by sending a request, including an email, to the addresses indicated below.
8. Data Controller
Data Controller Dedar S.p.A., (Tax Code 03187590157), in the person of its legal representative pro tempore, with registered office in Milan (20121 – MI, Italy), in Piazza della Repubblica, 1/A and operational headquarters in Appiano Gentile (22070 – CO, Italy), in Via della Resistenza, 3, email: info@dedar.com.
The Data Controller has appointed a Data Protection Officer (DPO), who can be contacted at the following email address: dpo@dedar.com.