Articles 13 and 14 of EUROPEAN REGULATION (EU) 2016/679

Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018

Dear Data Subject,

INTERMEETING srl, with registered office at Via Fornaci 239/A – 35129 Padua (PD), Italy, Tax Code and VAT No.: 02227260284, in its capacity as “Data Controller”, hereby informs you, pursuant to Articles 13 and 14 of European Regulation (EU) 2016/679 (hereinafter the “EU Regulation”), that your data will be processed as set out below:

1. Subject of the Processing

The Data Controller informs you that identifying personal data relating to you (for example, first name, last name, company name, address, telephone number, e-mail address, bank and/or payment details, etc.), hereinafter referred to as “personal data” or simply “data”, provided by you, including verbally, directly or through third parties, in connection with the establishment of a contractual relationship, may be processed in full compliance with the EU Regulation.

Processing of data means any operation or set of operations concerning the collection, recording, organisation, storage, consultation, elaboration, modification, selection, extraction, comparison, use, interconnection, blocking, communication, dissemination and destruction of such data.

2. Nature of the Data Processed, Legal Basis and Purposes of the Processing

Nature of the data processed. In relation to the contractual relationship, or to all the phases preliminary to the conclusion of the contract, only “personal data” such as the following will be processed, by way of example:

• personal details (first name, last name, etc.), address of residence and/or domicile and contact details (telephone, mobile phone, e-mail);
• data relating to professional qualification and role in the company;
• bank data and/or data for payment purposes.

Legal basis and purposes. EU Regulation 2016/679, Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

The processing of your personal data, whether requested and/or provided verbally, is based on the provisions of Article 6 of EU Regulation 2016/679, on your consent or on the legitimate interest of the Data Controller, including defending its rights in any dispute, as well as on the performance of a contract to which you are party or of pre-contractual measures (e.g. preparation of an offer, etc.) requested by you, and is necessary:

1. A) without your express consent (Article 6 of the EU Regulation) – primary purposes:

• for the performance of a contract to which the data subject is party, or of pre-contractual, contractual and tax measures adopted at the data subject’s request (Article 6(1)(b));
• to comply with obligations laid down by law, by a regulation, by EU legislation or by an order of an Authority (such as, for example, in the field of anti-money laundering) to which the Data Controller is subject (Article 6(1)(c));
• to comply with civil, accounting, tax and public security regulations, as well as for the administrative management of the relationship (invoicing, any document management, etc.) and for the fulfilments related to the performance of the contract with appointed Professionals;
• to provide the Data Subject with the information requested by them on events, exhibitions, courses and/or equipment;
• to send communications relating to events, exhibitions, courses, etc. for which the data subject has registered;
• to exercise the rights of the Data Controller, for example the right of defence in court;
• to pursue the legitimate interest of the Data Controller;
• for credit management;
• for statistical analysis, market research and quality control;
• for insurance management;
• for the organisation and holding of events and meetings, including those of a promotional nature;
• for technical assistance.

1. B) Only subject to your specific and separate consent (Article 7 of the EU Regulation) – Secondary purposes – Promotional, advertising and marketing purposes.

The personal data collected for the primary purposes may also be processed (together with other additional and optional contact information, such as e-mail addresses, mobile phone numbers and geographical addresses, which may additionally be requested from the data subject in the registration forms) by automated/electronic means, for the purposes specified below as required by the General Provision of the Italian Data Protection Authority of 4 July 2013 setting out the Anti-Spam Guidelines: commercial promotion, advertising communication and marketing in the broad sense.

By giving consent to Processing for Marketing Purposes, the data subject specifically acknowledges these promotional, commercial and broadly marketing purposes of the processing (including the resulting management and administrative activities) and, once consent has been given according to the procedures provided for, expressly authorises such processing, both because the Data Controller may use for Marketing Purposes means such as telephone calls with an operator or other non-electronic, non-telematic means or means not supported by automatic, electronic or telematic mechanisms and/or procedures, including manual contact methods and paper mail, and because the Data Controller may use for Marketing Purposes means such as e-mail, fax, SMS, MMS, WhatsApp messages, social media (Facebook, etc.), automated systems without operator intervention and similar, including electronic platforms and other telematic means.

In order to carry out Processing for Marketing Purposes, it is mandatory to obtain specific, separate, express, documented, prior, informed, free and entirely optional consent.

Consequently, where the data subject decides to give this specific consent, they must be informed in advance and be aware that the purposes pursued by the processing are of a specifically commercial, advertising, promotional and broadly marketing nature. In the interest of full transparency, please note therefore that the data will be collected and subsequently processed on the basis of specific consent:

1. to send advertising and informational material (e.g. newsletters) of a promotional nature;
2. to send commercial information; to carry out interactive commercial communications by paper, automated or electronic means and, in particular, by ordinary mail or e-mail, telephone (e.g. calls, WhatsApp messages, SMS, MMS), fax and any other IT channel (e.g. websites, mobile apps);
3. to send invitations to events, exhibitions and meetings of an informational and promotional nature;
4. to send updates on promotional initiatives or on technical news concerning equipment, services, training or assistance and/or to survey the degree of satisfaction with quality;
5. to send commercial and/or promotional communications of third parties (for example, shareholders, business partners, companies and/or natural or legal persons collaborating with the Company) by paper, automated or electronic means and, in particular, by ordinary mail or e-mail, telephone (e.g. calls, WhatsApp messages, SMS, MMS), fax and any other IT channel (e.g. websites, mobile apps).

By giving the optional consent, the data subject therefore specifically acknowledges and authorises these further, possible secondary processing operations.

3. Methods of Processing – Existence of Automated Decision-Making,
   including Profiling

Your personal data is processed by means of the operations indicated in Article 4(2) of the EU Regulation, namely: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, and blocking. The processing of data will be based on the principles of fairness, lawfulness and transparency and may be carried out by manual, IT and telematic means, on paper and/or digital media. The processing will be carried out in such a way as to guarantee the security and confidentiality of the data.

Subject to your express consent, your personal data (collected for the purposes indicated above) will be processed for profiling purposes, in particular for the creation of a profile of you and/or for the analysis of your preferences, including by combining such personal data with other information collected through the profiling cookies you have accepted. The data thus processed may be used to send you dedicated commercial information and personalised promotional initiatives.

The processing of your personal data for profiling purposes will take place using the tools and methods indicated above.

4. Data Retention Periods and Other Information

The processing will be carried out by automated and/or manual means, in compliance with Article 32 of the EU Regulation on security measures, by specifically appointed persons and in accordance with Article 29 of the EU Regulation, as well as with Article 130 of Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

Please note that, in compliance with the principles of lawfulness, purpose limitation and data minimisation, pursuant to Article 5 of the EU Regulation, subject to your free and explicit consent, your personal data will be retained for the period of time necessary to achieve the purposes for which it is collected and processed, or until the specific consent is withdrawn by the data subject, and therefore:

– with regard to the primary purposes, the data will be retained for no longer than is strictly necessary to fulfil legal and contractual obligations;

– with regard to the secondary purposes, the data processed for Marketing and Profiling purposes will be retained by the Company from the moment the data subject gave their consent until such consent is withdrawn. If consent is withdrawn, the Data may no longer be processed for the aforesaid Marketing and Profiling purposes, but may still be retained in order to handle any claims and/or disputes. The retention period of the Data for Marketing and Profiling purposes set by the Company complies with local regulations and with the provisions of the Italian Data Protection Authority.

The specifications on the retention periods for each category of data can be consulted at the company at the request of the data subject.

The personal data provided is collected and subsequently processed for the needs connected with achieving the purposes for which it is provided and for fulfilling the resulting legal and contractual obligations.

The processing is carried out exclusively by the Data Controller or by persons appointed pursuant to Articles 28 and 29 of the EU Regulation, who operate using IT and telematic tools with logic strictly related to the stated purposes and, in any case, in such a way as to guarantee the security and confidentiality of the data.

In accordance with Article 5 of the EU Regulation, the data being processed are:

* processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);

* collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (“purpose limitation”);

* adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);

* accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”);

* kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to implementation of the appropriate technical and organisational measures required by the Regulation in order to safeguard the rights and freedoms of the data subject (“storage limitation”);

* processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”).

The personal data you provide will be processed “lawfully, fairly and transparently”, protecting your confidentiality and your rights.

It should be noted that, in the absence of significant contact for a period of ten years, or if the rights granted to the data subject by the EU Regulation are exercised (e.g. the right to erasure/to be forgotten or to restriction), the personal data will be transferred to a special encrypted digital and/or paper archive (protected archive), making it accessible exclusively to the Data Controller, or will be destroyed without any copy being kept, unless otherwise provided by the law in force.

A periodic review is carried out once a year on the data processed and on the possibility of erasing it if no longer necessary for the stated purposes.

5. Access to Data (categories of recipients to whom the data may be disclosed)

We further inform you that the data collected will never be disseminated and will not be disclosed without your explicit consent, except for the necessary disclosures that may involve the transfer of data to public bodies, consultants or other parties for the fulfilment of tax and legal obligations or for the achievement of the primary and secondary purposes (where authorised), subject to our letter of appointment imposing on them the duty of confidentiality and security in the processing of personal data.

With reference to Article 13(1)(e) of the EU Regulation, the following is an indication of the persons or categories of persons (duly identified and instructed) who may become aware of the user’s personal data as processors or authorised persons, listed by category:

• Shareholders, employees and collaborators of the Data Controller in Italy and abroad, in their capacity as authorised persons and/or internal processors (e.g. commercial, technical, administrative, legal and press offices) and/or system administrators;

Your personal data may also be disclosed to external parties who are the recipients of the matters concerning you, in the course of the activities described above, and to external parties who interact with the Company, always and exclusively for activities functional to the purposes described above; these categories are:

1. Consultants (such as, for example, accountants and/or tax advisers and/or employment consultants) for matters that may concern you and in the manner provided by law;
2. Companies operating in the IT sector (Data Centres, Cloud Providers, companies providing IT services, including back-up and/or maintenance of equipment and software, including applications, etc.), including those resident abroad, but in any case always established in and/or using equipment located in the European Union, for the care of data security and confidentiality;
3. Professionals and/or Companies operating in the field of occupational safety;
4. Consultants and Law Firms for any disputes;
5. Public administrations for the performance of institutional functions, within the limits established by law and regulations;
6. Social security and welfare bodies and Certification Bodies;
7. Insurance Companies as well as loss adjusters, consultants and experts appointed by them;
8. Business consultants;
9. Partner companies and/or suppliers of services ancillary to the purposes indicated in point 2 above;
10. Public authorities and administrations for purposes connected with the fulfilment of legal obligations, or parties entitled to access by virtue of provisions of law, regulations or EU legislation;
11. Banks, financial institutions or other parties to whom the transfer of such data is necessary for the performance of our activity in relation to the fulfilment of the contractual obligations we have assumed towards you.

For the sake of brevity, the detailed list of these parties is available at our premises and is at your disposal.

6. Disclosure and Transfer of Data

Without the need for express consent (Article 6(1)(b) and (c) of the EU Regulation), the Data Controller may disclose your data for the purposes referred to in point 2.A) above to supervisory bodies and judicial authorities, as well as to those parties to whom disclosure is mandatory by law for the fulfilment of the aforesaid purposes.

These parties will process the data in their capacity as independent data controllers.

During and after browsing, your data may be disclosed to third parties, in particular to:

– See the cookie policy.

Your data will not be disseminated.

The personal data is stored on devices located at the premises of the Data Controller or at providers within the European Union. The data you provide may be transferred to countries outside the EU, as we use external Data Processors who, in performing their services (such as provision of e-mail accounts, other types of cloud or other types of services), may carry out such transfer, including through their sub-processors.

The data may also be transferred to parties who, on behalf of the Company or independently, provide for:

• the management and/or maintenance of the websites and the electronic and/or telematic tools used by the Company;
• the processing of statistical and market research;
• the organisation and holding of events and exhibitions, including those of a promotional nature;
• legal, tax, social security, accounting, organisational and commercial assistance;
• auditing activities.

To ensure the security of such transfers, we use only parties offering the necessary guarantees to implement appropriate technical and organisational measures so that the processing complies with EU Regulation 2016/679 (for example, by assessing the existence of adequacy decisions or by governing the relationship through standard contractual clauses).

It is in any case understood that the Data Controller, where necessary, has the right to move the data also to non-EU countries. In such a case, the Data Controller hereby ensures that the transfer of data outside the EU will take place in accordance with the applicable legal provisions, subject to the execution of the standard contractual clauses (the standard contractual clauses are available at the following link: http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm) and the standard checks provided for by the European Commission (specifically, the conditions set out in CHAPTER V of the EU Regulation will be complied with).

Any transfer to non-EU countries will in any case be carried out in such a way as to provide appropriate and suitable safeguards pursuant to Articles 46, 47 or 49 of EU Regulation 2016/679.

Both with regard to the data on its own devices and to any data held at providers, the Data Controller has implemented appropriate technical and organisational measures to guarantee a suitable level of security, in full compliance with the EU Regulation.

Browsing: your browsing data may also be transferred, limited to the purposes set out above, to the following countries:

– See the cookie policy.

Cookie management: should you have any doubts or concerns about the use of cookies, you can always intervene to prevent them from being set and read, for example by changing the privacy settings in your browser in order to block certain types.

Since each browser, and often different versions of the same browser, differ considerably from one another, if you prefer to act independently through your browser preferences you can find detailed information on the necessary procedure in your browser’s guide.

8. Nature of the Provision of Data and Consequences of Refusal to Respond

The provision of data for the purposes referred to in the above “Point 2.A) – Primary purposes” of this notice is necessary for the establishment of the contractual relationship and for the correct performance of the contract. Please note that if you refuse to provide such data or fail to authorise its processing for such purposes, it will be impossible for our Company to fulfil its legal and contractual obligations towards you.

In such a case, failure to provide the data will in fact make it impossible to establish or continue the contractual relationship, to the extent that such data is necessary for us to carry out correctly the formalities connected with the management of the contract.

The provision of data for the purposes referred to in the above “Point 2.B) – Secondary purposes” of this notice is instead optional. You may therefore decide not to provide any data or to deny at any time the possibility of processing data already provided.

The provision of personal data to the Data Controller and the giving of both consent to Processing for Marketing Purposes and consent to disclosure to third parties for Processing for Marketing Purposes, for the purposes and in the manner illustrated above, are entirely optional (and may be withdrawn without formalities even after being given, by sending an e-mail to the Company (see point 10)) and failure to provide them will have no consequences other than the impossibility for the Data Controller and for any third party to carry out the aforesaid marketing processing and therefore to inform you directly of product news and technical services.

If you refuse marketing consent, there will be no interference with and/or consequence for the possibility of taking part in the Promotional Initiatives organised from time to time, but it will not be possible to communicate them to you directly.

Some information fields on the website may be marked with the character *. Completing these fields is mandatory when entering your data. The consequence of not providing the information is that you will be unable to use the service for which the information is required.

Following receipt of a request to withdraw the consent given (opt-out), the Data Controller will promptly remove and delete the data from the databases used for Processing for Marketing Purposes and inform for the same purposes of erasure any third parties to whom the data has been disclosed. The mere receipt of the erasure request shall automatically serve as confirmation of the erasure having taken place.

9. Rights of the Data Subject

As a data subject, you have the rights under Articles 15 to 22 of the EU Regulation set out below, and specifically you have the right to:

– obtain confirmation of the existence and processing of personal data concerning you, as well as a written (electronic) copy thereof in a clear and understandable form (so-called right of access);

– obtain information on the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed and, where possible, the retention period;

– obtain the rectification of data concerning you (so-called right to rectification);

– obtain the erasure of data concerning you (so-called right to be forgotten);

– obtain restriction of processing (so-called right to restriction of processing);

– where the data are not collected from the data subject, obtain all available information on their source;

– obtain the portability of the data, namely to receive them from a data controller in a structured, commonly used and machine-readable format and to transmit them to another data controller without hindrance (so-called right to data portability);

– object to the processing at any time, including in the case of processing for direct marketing purposes (so-called right to object). Specifically and separately, as required by Article 21 of the EU Regulation, please note that where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for such purposes and that, where the data subject objects to processing for direct marketing purposes, the personal data may no longer be processed for such purposes;

– object to automated decision-making relating to natural persons, including profiling;

– withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

– lodge a complaint with a supervisory authority (Italian Data Protection Authority – Garante per la Protezione dei Dati Personali).

There may be conditions or limitations on the rights of the data subject. It is therefore not certain, for example, that the right to data portability applies in all cases; this depends on the specific circumstances of the processing activity.

10. How to Exercise Your Rights

You may exercise your rights at any time by sending, without any formality, a clear communication to this effect:

– by registered letter with return receipt to the Company (see the address shown on the letterhead);

– by e-mail to amministrazione@intermeeting.net.

11. Minors

What is offered by the Data Controller and forms the subject of the relationship with you does not involve the intentional acquisition of personal information relating to minors. Should information on minors be unintentionally recorded, the Data Controller will promptly delete it at the request of the data subject.

12. Personal Data Not Obtained from the Data Subject

It may happen that the Company is not the Data Controller to whom you gave your personal data, but is a joint controller or an external processor, and that your data has therefore reached the Company at a later stage by virtue of a contract governing the parties. In such a case, please note that the Company will do its utmost to ensure that you have been informed and have given your consent to the processing. You may at any time ask the Company for the source from which your Data was acquired.

13. Data Controller, D.P.O. and Authorised Persons

Below is some information that needs to be brought to your attention, not only in order to comply with legal obligations, but also because transparency and fairness towards our staff/collaborators are a fundamental part of our business.

Data Controller. The Data Controller of your personal data is INTERMEETING srl, on whose behalf Mr Mario Carlo Baccaglini signs, who is responsible towards you for the legitimate and correct use of your personal data and whom you may contact for any information or request at the following contact details: telephone +39 049 7386856, e-mail: amministrazione@intermeeting.net

D.P.O. (Data Protection Officer). You may also contact the Data Protection Officer to obtain information and submit requests concerning your data or to report any inefficiency or problem encountered.

The Data Controller has appointed Mr Nicola Ghinello as Data Protection Officer, who may be contacted at the following contact details: telephone +39 348 3165267, e-mail: nicola.ghinello@dpo-rpd.com.

Authorised Persons. The updated list of persons authorised to process data is kept at the premises of the Data Controller.

Contact us

Intermeeting srl welcomes comments on this privacy notice.

Please contact us at the following address: amministrazione@intermeeting.net.