Information on the processing of personal data pursuant to Article 13 EU Regulation 679/2016
With reference to the hybrid event with online connection on the ZOOM platform mentioned above, the Institute for Competitiveness (I-Com), as the Data Controller, hereby intends to provide participants with the necessary information regarding the manner and purpose whereby personal data will be processed.
1. Ownership of data treatment
Pursuant to Articles 4 and 24 of the GDPR, the Data Controller and Processor is the Institute for Competitiveness (I-Com) P.IVA 08678131007, with its registered office in Piazza dei Santi Apostoli n° 66, Rome (00187), tel.: (+39) 06 4740746, e-mail: firstname.lastname@example.org, PEC: (email@example.com).
The Data Controller is flanked by the company I-Com Servizi S.r.l. (P.I. 13128851006) with its registered office in Piazza dei Santi Apostoli n° 66, Rome (00187), tel.: (+39) 06 4740746, e-mail: (firstname.lastname@example.org), PEC: (email@example.com), which acts as the Data Controller pursuant to Article 26 of the GDPR (hereinafter referred to as the “Data Controller(s)” or jointly as the “Data Controllers”).
Data subjects may exercise their rights vis-à-vis each of the Co-Processors by contacting them at the references above.
The Joint Data Controllers, in order to facilitate the relationship between the participant and each Data Controller, have designated a Privacy Contact Person in the person of Attorney Silvia Compagnucci, who can be contacted at: firstname.lastname@example.org.
2. Purpose and legal basis of data processing
The personal data of data subjects may be used for the following purposes:
- Event organisation and management: event registration management, sending communications to the organisation and participants of the event;
- Event dissemination: publication of photographic and/or video material, as part of press communications, on I-Com’s website and social media, with full respect for the dignity and decorum of the subject portrayed;
- Marketing: sending newsletters, communications, invitations to events, informative and illustrative material related to the services and activities of I-Com.
For the purpose referred to in point 2.a) (Event participation management), data processing is carried out for the time strictly necessary to achieve the said purposes. For the purposes under 2.b) (Event Dissemination) and 2.c) (Marketing), the Data processing is carried out on the basis of Art. 1.a) of the Regulations and, therefore, on the basis of consent.
3. Type of data processed
To achieve the purposes under 2.a), 2.b) and 2.c), I-Com may process contact data such as personal data, e-mail and/or cell phone number and video and photographic material bearing personal images.
4. Methods of data processing.
The Processing is carried out in a lawful, correct and transparent manner, respecting the principle of “minimisation”.
The Processing of Personal Data is carried out by means of the operations indicated in Art. 4. 2 of the GDPR – carried out with or without the aid of computer systems and specifically for the: collection, recording, organisation, structuring, updating, storage, adaptation or modification, extraction and analysis, consultation, use, communication by transmission, dissemination or any other form of making available, comparison, interconnection, limitation, deletion or destruction.
The security of the Personal Data and, in general, the confidentiality of the Personal Data processed shall be ensured by implementing all necessary technical and organisational measures appropriate to ensure their security.
5. Communication and dissemination of data
To the extent strictly pertinent to the above obligations, tasks or purposes, Personal Data may be communicated and, therefore, known and used by:
- collaborators, employees and interns of I-Com, in their capacity as authorisd data processors (so-called Data Processors) or appointed Data Processors. With reference to said persons there is a legal obligation of confidentiality;
- companies or professionals that I-Com uses to fulfil obligations for the performance of professional services or in order to protect its own right;
- third parties who provide services to I-Com and also act as Data Processors, i.e., persons, companies or professional firms that provide assistance or consultancy to I-Com in administrative, financial, tax, labour law matters, or subjects delegated to carry out technical management and maintenance activities (including the maintenance of network equipment and electronic communication networks);
- subjects with whom it is necessary to interact for the organisation or participation in events/conferences/seminars;
- judicial or supervisory authorities, administrations, public agencies and bodies (domestic and foreign), for the fulfilment of legal obligations or for the prevention of abuse or fraud or by order of such entities.
Please note that publication on social media may constitute a form of dissemination.
6. Retention Period.
The processing of Data for the purpose sub. 2.a) shall be carried out for the time necessary to fulfil it. The processing for the purposes sub 2.b) and 2c) is to be carried out for the time necessary for the fulfilment of the same and, in any case, for a maximum period of 5 years. This is without prejudice to the possibility of requesting at any time to withdraw subscription from the newsletter service or the removal from I-Com’s contact list.
7. Transfer of Data
Personal Data will not be transferred to third countries or international organisations unless this is necessary due to obligations required by law or regulations.
If, for such reasons, it becomes necessary to transfer Personal Data to third countries or international organisations, the requirements of Chapter V of the GDPR will be observed.
8. Rights of the Data Subject.
In relation to the purposes of the Processing, the Data Subject is entitled to exercise the rights provided for in Articles 15 et seq. of the GDPR. In particular, the right to:
- access, i.e., to obtain confirmation of the existence or non-existence of Personal Data concerning him/her, to know its origin, as well as the logic and purposes on which the Processing is based, the recipients or categories of recipients to whom the data may be communicated, the determination of the storage period if it is possible to define it;
- rectification of inaccurate data;
- deletion (so-called right to be forgotten), where the data is no longer necessary for the purposes of collection and subsequent Processing, or where the data subject has withdrawn consent to Processing (where such consent is provided as optional or where there is no other legal basis for Processing);
- limitation, when one of the following cases referred to in Art. 18 GDPR: (a) the Data Subject has disputed the accuracy of his or her Personal Data (the restriction will continue for the period necessary for the Data Controllers to verify the accuracy of such Personal Data); (b) the Processing is unlawful but the Data Subject has objected to the deletion of his or her Personal Data, requesting, instead, that its use be restricted; c) although the Data Processors no longer need it for the purposes of the Processing, the Data Subject’s Personal Data is needed for the establishment, exercise or defence of a right in a court of law; d) the Data Subject has objected to the Processing pursuant to Article 21(1) GDPR and is awaiting verification as to whether the Data Processors’ legitimate reasons prevail over his or her own. In the case of the restriction of Processing, Personal Data will be processed, except for storage, only with the consent of the Data Subject or for the establishment, exercise or defence of a right in court or to protect the rights of another natural or legal person or for reasons of important public interest. The Data Subject shall be informed in each case before such limitation is lifted;
- portability, i.e., the right to receive in a structured, commonly used and machine-readable format the Personal Data concerning the Data Subject, with the possibility of transmitting it to another Data Controller. This right does not apply to non-automated processing (e.g., archives or paper records) and, furthermore, only Data processed with the consent of the Data Subject and only if the Data has been provided by the Data Subject is subject to portability;
- opposition, i.e., the right to object to the Processing for reasons related to the particular situation of the User;
- complaints pursuant to Article 77 et seq. of the GDPR, to be sent to the Guarantor for the Protection of Personal Data, Piazza Venezia n° 11 – 00187 Rome (email@example.com; telephone (+39) 06 696771; fax (+39) 06 696773785).
Pursuant to Article 7, paragraph 3 of the GDPR, the right to revoke consent at any time is recognised by sending an e-mail to the Data Controller at firstname.lastname@example.org and/or to the Privacy Contact at email@example.com. Revocation of consent does not affect the lawfulness of the Processing based on the consent before revocation.
9. Processing of data for a purpose other than that for which it was collected
If the Data Controller intends to further process Personal Data for a purpose other than the purpose for which it was collected, prior to such further processing, I-Com will provide the Data Subject with information regarding this other purpose and any further relevant information, as referred to in Art. 13 paragraph 2 of the GDPR.