ItalianoPursuant to and for the purposes of Regulation (EU) No. 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, as well as on the free movement of such data (General Data Protection Regulation, hereinafter also referred to as “Regulation” or “GDPR”) and repealing Directive 95/46/EC, we inform you that the personal data you voluntarily made available to Lombardy Energy Cleantech Cluster will be processed in compliance with the current legislation on the protection of personal data and, in any case, inspired by the principles of confidentiality that the activity of the association is.
1. Data Controller
The data controller is LOMBARDY ENERGY CLEANTECH CLUSTER - LE2C (C.F. 92040690155), with registered office in Milan (MI) in Via Pantano, 9, cap.20122 Phone: +39 02 58370814, e-mail: info@energycluster.it (hereinafter “LE2C”).
2. Types of data
'Personal data', as defined in Article 4 of the Rules of Procedure, indicates 'any information concerning an identified or identifiable natural person'. 'Data belonging to the particular categories', according to the definition inferred from Article 9(1) of the Regulation, shall be construed as those that 'reveal the racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as treating genetic data, biometric data intended to uniquely identify a natural person, data relating to the health or sexual life or sexual orientation of the person'.
Therefore, in this context, personal data is to be understood as any information concerning you and is referable to you (hereinafter the 'Data').
In detail, the following data will be processed:
- Data collected at the time of enrolment in the event. You will be asked for your Identification Data, including your first name, last name, e-mail address, company and preference regarding how you participate in the event (in person or remotely).
- Data collected through video footage, sound recordings and photographs (movies, voice recordings and images may be collected depending on the type of event organised).
Purpose of the Processing and legal basis
Your personal data will be processed for the pursuit of the following purposes and with the legal bases indicated below:
- The processing is aimed at the management of the invitation, the management of the registration, the sending of organisational communications as well as the management of access control and participation in the event; the legal basis for the purpose indicated is represented by the need for the processing for the conclusion and correct execution of the contract to which the interested party and / or for the execution of pre-contractual measures adopted at the request of the same, as provided for in Article 6 para. 1 letter b) of the GDPR;
- The processing is aimed at communicating to partner subjects of the association who have collaborated in the realisation of the event, exclusively for the purpose of fulfilling reporting obligations where provided; aggregated data may always be communicated to these subjects for statistical purposes; the legal basis is represented by the need to fulfil a legal obligation to which the owner and / or the partner who participated in the realisation of the event is subject, as provided for by art. 6 par. 1 letter c) of EU Regulation 2016/679.
- The processing is aimed at the possible publication and/or dissemination in any form, for information and / or promotional purposes, of videos, voice recordings and images that portray you during the activities carried out in the context of the event on the association's website, in print and / or on any other means of dissemination (depending on the type of event organised) to testify to the realisation of the event and promote the activity carried out in this context by LE2C; the legal basis for this type of processing is represented by the legitimate interest of the Data Controller association to witness the realisation of the event and promote the activity carried out in this context as provided for by art.6 para. 1 letter f) of the GDPR;
- The processing is aimed at sending emails and / or newsletters and communications concerning the services and activities offered and promoted by the controller, of the same type previously used by the interested party, except for the refusal to processing by the same, enforceable at any time; the legal basis for this type of processing is represented by the legitimate interest of the Data Controller as required by art. 6 par. 1 letter f) of the GDPR.
5. Nature of the Data provision and consequences of any refusal
With respect to the purposes indicated in point 3., points 1), 2) and 3) above, the provision of your Data is necessary for the purpose of participation in the event and reporting by the partners of the association who collaborated in the realisation of the event. Therefore, any refusal to provide your Data will result in the impossibility of participating in the event itself.
With respect to the purpose indicated in point 3., point 4) above, the provision of your Data is optional. Any refusal from you will not prevent you from participating in the event, but will simply result in the impossibility for LE2C to process your Data in order to send you communications about events and services of the same type that you have already used.
6. Processing methods
In accordance with the provisions of Article 5 of the Regulation, the personal data being processed will be:
- (i) Treated in a lawful, fair and transparent manner;
- (ii) Collected and recorded for specific, explicit and legitimate purposes, and subsequently processed in terms compatible with those purposes;
- (iii) Appropriate, relevant and limited to what is necessary in relation to the purposes for which they are addressed;
- (iv) Accurate and, if necessary, updated;
- (v) Treated in such a way as to ensure an adequate level of safety;
- (vi) Preserved in a form that allows the identification of the interested party for a period of time not exceeding the achievement of the purposes for which they are processed.
The processing will be carried out both via manual and / or computer and telematic tools with organisational and processing logic strictly related to the purposes themselves and, in any case, in order to guarantee the security, integrity and confidentiality of the data themselves in compliance with the organisational, physical and logical measures provided for by the provisions in force.
LE2C emphasises that the processing of the Data you provide at the time of registration for the event takes place through Eventbrite's event organisation platform. By registering for the event, you consent to the storage of your Data on Eventbrite servers.
With reference to sending newsletters, LE2C emphasises that its service is managed through MailChimp, a communication platform for sending newsletters from MailChimp companies. By agreeing to receive our newsletter, you also consent to the storage of your Data on the MailChimp server.
The processing of your Data will be managed by specially trained and trained personnel, precisely to ensure adequate security and confidentiality, as well as to avoid risks of loss and / or destruction and access by unauthorised persons.
7. Communication and Data dissemination
Your Data may be communicated:
- Entities within the association specially authorised, who carry out activities related to and instrumental to the management of the services requested;
- Entities specifically appointed as processors;
- To partners of the association involved in the realisation of the event, exclusively for reporting purposes.
Within the limits relevant to the aforementioned processing purposes, your Data (films / voice recordings / images) may be published and / or disseminated in any form on the association's website, on the association's social channels (Facebook, YouTube, LinkedIn, Instagram, Twitter) and/or on any other means of dissemination. The Owner informs that no use of the images will be made that prejudices the personal dignity, honour, reputation and/or decorum of the person portrayed.
8. Data Retention Period
In general, Personal Data will be kept for the time strictly necessary to pursue the purposes for which they were collected and subjected to Processing, including the retention period required by applicable legislation and, in any case, for a maximum period of 10 years from the termination of our relationship in relation to the purposes of contractual fulfilment and legal obligations, except for the possible need of the Data Controller to defend his or her right in court.
9. Subject's Rights
Pursuant to Article 15 et seq. of EU Regulation 2016/679, the interested party may, in the manner and within the limits provided for by current legislation, exercise the following rights:
- Request confirmation of the existence of Personal Data concerning them (right of access);
- Know its origin;
- Receive intelligible communication
- Have information about the logic, methods and purposes of the processing;
- Request the updating, rectification, integration, cancellation, transformation into anonymous form, blocking of the Data processed in violation of the law, including those no longer necessary for the pursuit of the purposes for which they were collected;
- And, more generally, to exercise all the rights granted to it by the current legal provisions.
The exercise of rights can take place by sending a request that must be addressed without any formalities to the Data Controller at the addresses indicated above.
Before providing an answer, the Owner may need to identify the interested party, by requesting to provide a copy of his identity document.
A written reply will be provided without undue delay and, in any case, no later than one month from the receipt of the request.
11. Complaint
If you deem that the processing of your Data violates the provisions contained in the Regulation, you have the right to lodge a complaint with the Guarantor for the protection of personal data or, alternatively, to appeal to the competent Judicial Authority.
12. Data transfer abroad
For the purposes indicated above, Personal Data will be processed within the European Economic Area (EEA). If they are transferred to Third Countries, in the absence of an adequacy decision by the European Commission, the requirements of the applicable legislation on the transfer of Personal Data to third countries, such as the Standard Contractual Clauses provided by the European Commission, will still be complied with.
13. Automated decision-making
Data is not processed by automated decision-making.