SUBSCRIPTION TO THE NEWSLETTER AND THE  “CONTACT US” AREA OF IEG

INFORMATION NOTICE REGARDING THE HANDLING OF PERSONAL DATA

 

Pursuant to articles from 12 to 22 of EU Regulation 679/2016 ("GDPR") we inform you that personal data provided by the interested party and / or acquired by Italian Exhibition Group S.p.A. ("IEG") in relation to the same, on the occasion of the  subscription to the newsletter and / or the "contact us" area of ​​the IEG site and the sites connected to it, are subject to treatment in compliance with the principles of lawfulness, fairness, correctness, proportionality, necessity, exactness, completeness and safety and of the other legal obligations in force, as follows.

Categories of interested parties. Processing of personal data and collection methods.

The data processed may concern all those (intended as individuals over the age of 16 who act on their own as interested in receiving the newsletter and as internal referents of legal entities, bodies or other organizations that are interested in receiving the newsletter) that ask to register and receive the newsletter and / or to stay in contact with IEG by filling out the forms made available on the site. The individual categories of data collected are from time to time better indicated in the IEG collection forms, the content of which must therefore be considered an integral part of this information.

Treatment means: collection, registration, storage, organization, processing, modification, selection, extraction, comparison, reclassification, use, interconnection, blocking, communication, dissemination, cancellation, destruction of personal data.The collection is done via online forms. The processing will take place with electronic and paper means and with logics related to the individual purposes stated below.

The data collected may be processed by the Authorized first and second level, appointed in writing by IEG, who need to be aware of it in the performance of their activities (eg legal, commercial, marketing, communication, administrative, logistics, IT , management control, etc.).

Purpose of the treatment                

The processing will be done by computer, manual and paper means for the following purposes:

  1. Planning and organizational management of the newsletter subscription and sending it to interested parties who have accredited with the appropriate form on the site and / or registration in the "contact us" area and sending the answers to the related questions.

Legal basis of the processing and obligatory or optional data communication by the interested party

The treatment for the aforementioned purposes bases its legal standing in the legitimate interest of IEG to organize and plan all the activities instrumental in sending the newsletter to those who request it, as well as answers to requests from the "contact us" area, as well as consequent activities.

For these purposes, therefore, IEG not required to receive a prior consent from the interested party.

The interested party is free not to provide the data, but in this case he / she will not be able to receive the newsletter nor receive feedback from the requests made through the "contact us" area.

Communication and dissemination of data

The data will not be disclosed. The data may be communicated by IEG to suppliers of the development, management and maintenance services of IT systems, websites and databases of IEG, the subjects in charge of the conception and / or maintenance of materials intended for inclusion in the newsletters communicated by IEG.

A list of co-owners, independent owners and external data processors is available upon request by the interested party (for the relevant procedures, see the "rights of the data subject" section of this statement).

Transfer of data abroad

The data will be transferred abroad, in particular to HUBSPOT Inc. - American company registered with the American competent body according to the EU-US convention called "Privacy Shield" (For the privacy policy of the third provider HubSpot INC. please visit'URL: https://legal.hubspot.com/privacy-policy)

Duration of Treatment

In the case of the purposes listed in point 1, as specified above, IEG processes the data for 10 years from the date of collection of the data. The data necessary for IT security purposes (eg log-in registrations, failed logs and log-outs, when accessing reserved areas on IEG websites related to the Events), are processed by IEG for 1 year from collection, in order to allow the security checks and to document the results. Registration of logs relating to events such as reading of IEG online privacy information or IEG communication of the data subject's consent through the website or email messages are kept by IEG for the whole time necessary for the related proof to the Supervisory Authorities or to the interested party who may request it (6 years from collection).In the event of a dispute between IEG (or third party IEG providers) and the data subject, the data will be processed for as long as is necessary to protect the rights of the Data Controller or third party suppliers, ie until the issue of a provision having judicial value between the parties or a transaction. Once the aforementioned duration has ceased, the personal data will be deleted, destroyed or made anonymous through appropriate security measures.

Rights of the data’s subject.

IEG encourages the interested party to read the information found at the following link www.iegexpo.it/privacyinformation (sezione “diritti dell’interessato”)

We inform that the interested party will have the right to:

-  ask the Controller to confirm whether or not personal data processing is being performed and, in this case, to obtain access to personal data and the following information: a) the purposes of the processing; b) the categories of personal data in question; c) the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients of third countries or international organizations; (d) where possible, the retention period of the personal data provided or, if not possible, the criteria used to determine this period; e) the existence of the right of the interested party to request the data controller to rectify or delete personal data or limit the processing of personal data concerning him or to oppose their treatment; f) the right to lodge a complaint with a Supervisory Authority; g) if the data are not collected from the data subject, all information available on their origin; h) the existence of an automated decision-making process, including profiling and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the data subject.

- if the personal data are transferred to a third country or to an international organization, the data subject has the right to be informed of the existence of adequate guarantees regarding the transfer;

- request, and obtain, without undue delay, the correction of inaccurate data; taking into account the purposes of the processing, the integration of incomplete personal data, also by providing an additional declaration;

- request the deletion of data if a) personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; b) the interested party revokes the consent on which the treatment is based and there is no other legal basis for the treatment; c) the interested party opposes the processing, and there is no legitimate overriding reason to proceed with processing, or opposes the processing performed for direct marketing purposes (including functional profiling for such direct marketing); d) personal data have been processed unlawfully; e) personal data must be deleted to fulfil a legal obligation under Union or Member State law to which the controller is subject; f) personal data have been collected in regard to the provision of information society services.

 - request the limitation of processing that concerns the data subject when one of the following hypotheses occurs: a) the interested party disputes the accuracy of personal data, for the period necessary for the data controller to verify the accuracy of such personal data; b) the processing is illegal and the interested party opposes the cancellation of personal data and asks instead that its use is limited; c) although the data controller no longer needs it for processing purposes, personal data are necessary for the data subject to verify, exercise or defend a right in court; d) the interested party objected to the processing performed for direct marketing purposes, pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party;

- obtain from the data controller, upon request, the communication of the third recipients to whom the personal data have been transmitted;

- revoke at any time the consent to the processing where previously communicated for one or more specific purposes of their personal data, it being understood that this will not affect the lawfulness of the treatment based on the consent given prior to the revocation.

- to receive, in a structured format, in common use and readable by automatic device, personal data concerning the data subject provided by the data controller and, if technically feasible, to transmit such data directly to another data controller without impediments on the part of the Owner to whom he has provided them, if the following (cumulative) condition occurs: a) the processing is based on the consent of the interested party for one or more specific purposes, or on a contract of which the party is a party and whose execution of the treatment is necessary; and b) the processing is carried out by automated means (software) (total right to so called "portability"). The exercise of the right to the portability is subject to the right to cancellation specified above;

- the interested party has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects that concern him or which would have a similar impact on his person.

- the interested party at any time can also lodge a complaint with the competent Supervisory Authority on the basis of the GDPR (that of his place of residence or domicile).

The interested party may exercise his rights by writing to the Data Controller Italian Exhibition Group SpA, Data Protection Officer, with registered office in Via Emilia, 155 - 47921 Rimini (Italy) or to the e-mail address: privacy@iegexpo.it.

In order to ensure compliance with the GDPR and the laws applicable to the processing of personal data of the data subject, IEG has appointed an independent third party to that activity (Data Protection Officer). The Data Protection Officer of IEG is the Att. Luca De Muri, as above domiciled for the position at Italian Exhibition Group S.p.A.