Privacy Notice for Those Who Attend Events, Webinars, and Conferences

PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLE 13 OF REGULATION (EU) NO. 2016/679 

Pursuant to Article 13 of Regulation (EU) n. 2016/679 (hereinafter the "GDPR"), Avvale S.p.A. and its affiliates (hereinafter "Avvale" or the "Data Controller") informs you that the personal data (hereinafter the "Data"), provided by you by filling in the forms for participation in conferences, webinars and other events organized by the Data Controller and the participation itself in these events, will be processed in compliance with the provisions of the aforementioned Regulation, D. Lgs. 196/2003 (hereinafter the "Privacy Code”) and further modifications, as well as the provisions issued by the Supervisory Authority (Garante per la Protezione dei dati Personali), as applicable from time to time.

• Data Controller and Data Processors

The Data Controller is Avvale S.p.A. with registered office in Via Melzi D'Eril 34, Milan (20154), Italy, e-mail: privacy@avvale.com 
The updated list of any data processors is available at the Data Controller's registered office.

• Data Protection Officer

The Data Controller has appointed a DPO (Data Protection Officer) in the person of Dr. Ing. Danilo Roggi, who can be contacted at the following e-mail address: dpo@avvale.com

• Types of personal data processed

1. Contact and identification data (name, surname, tax code, address, e-mail, telephone number).
2. Photographs, videos, audiovisual materials containing your image/voice.
   
   

• Purpose and legal basis of the processing

The personal data referred to in point 1) above shall be processed for the following purposes

• purposes of organizing/performing events and purposes of providing ancillary services to events, such as: sending communications of an organizational nature, sending slides and/or electronic presentations used during the event, the legal basis being the performance of a contract to which you are a party, pursuant to Article 6(1)(b) of the GDPR
• to enable participation in events, courses, webinars and conferences organized by the Controller or chaired by the Controller, and has as its legal basis the performance of a contract to which you are a party, pursuant to Article 6(1)(b) of the GDPR
• to send commercial communications on products and services similar to those already purchased (so-called "soft spam"), for promotional and marketing initiatives, including the sending of commercial communications on products and services of the Owner, also by e-mail, sms, mms, fax or similar and/or by postal service or telephone calls with operator; the legal basis of this processing is your consent (optional and revocable at any time) pursuant to art. 6, par. 1, lett. a) of the GDPR
• to carry out profiling activities aimed at performing the activities referred to in the previous letter; the legal basis for this processing is your consent (optional and revocable at any time) pursuant to Article 6(1)(a) of the GDPR.

The data may also be processed in order to fulfil legal obligations to which the Controller is subject; the processing of data for this purpose does not require your consent, pursuant to Article 6(1)(c) of the GDPR.

The processing of the personal data referred to in point 2) above (photographs, videos, audiovisual materials containing your image/voice) is for the purpose of publication/dissemination for advertising and information purposes, even after editing clips or individual frames, through publication on the website of the Owner and/or its affiliates, as well as for publications on the latter's social channels; the legal basis for this processing is your consent (optional and revocable at any time) pursuant to Art. 6, para. 1, letter a) of the GDPR.

The Data Controller’s brand may be present within the shots, so your image may be associated with that of the Data Controller's.

• Provision of data and consequences in the event of failure to provide data

The provision of data is optional. Failure to provide consent will not allow the use of your data for the above-mentioned purposes. You may revoke your consent at any time by sending an e-mail to: privacy@avvale.com

• Method of data processing

The personal data provided will be processed in accordance with current legislation and the principles of correctness, lawfulness, transparency and confidentiality. The processing is carried out with the use of electronic instruments and these activities consist in the collection, recording, organization, structuring, consultation, processing, modification, adaptation, storage, extraction, communication. As well as, for the data referred to in point 2, dissemination by means of computerized tools, paper supports and any other suitable support, within the limits indicated in the following paragraph "Communication and dissemination of data".

• Communication and dissemination of data

Within the limits pertinent to the processing purposes indicated, the data referred to in point 1) - contact and identification data - may be made accessible to the Controller's affiliates (subsidiaries, associates), employees and/or collaborators in any capacity whatsoever of the Controller. 

The data referred to in point 2) - photographs, videos, audiovisual materials - shall be subject to communication, publication and/or dissemination in any form on the Data Controller’s websites (e.g.: Avvale portal, company intranet); on the social channels managed by the Data Controller (e.g.: LinkedIn, Twitter, YouTube); in print/email and/or on any other means of dissemination for internal and external use by the Data Controller (e.g: internal newsletters, external newsletters); citation at conferences and meetings, as well as partial or full use in publications (technical and information publications, newsletters and house organs), websites and press releases; inclusion in advertising (leaflets, brochures) and informative material (presentations in electronic format); marketing campaigns aimed at other Data Controller’s customers and prospects.

• Retention Period

The data collected will be kept for a period of time not exceeding the achievement of the purposes for which they are processed and/or for the time required for legal obligations.   

• Transfer of Data to third countries

The Data Controller operates internationally with offices and affiliates in several countries around the world. Therefore, personal information processed by the Controller may be transferred outside the EEA, to countries that may not provide a level of protection for personal information equivalent to that guaranteed by European data protection legislation. Whenever your personal information is transferred internationally, the Controller takes appropriate measures to ensure its security and confidentiality in accordance with applicable data protection law.

• Rights of access, deletion, restriction and portability

As a data subject, you are entitled to the rights set out in Articles 15 to 20 of the GDPR. By way of example, you may:

• obtain confirmation as to whether or not personal data concerning you are being processed;
• if a processing is taking place, obtain access to the personal data and information relating to the processing as well as request a copy of the personal data;
• obtain the rectification of inaccurate personal data and the integration of incomplete personal data;
• obtain, if one of the conditions provided for in Article 17 of the GDPR applies, the deletion of personal data concerning him/her;
• obtain, in the cases provided for in Article 18 of the GDPR, the restriction of processing;
• in the cases provided for by Article 20 of the GDPR, receive the personal data concerning him/her in a structured, commonly used and machine-readable format and request their transmission to another controller, if technically feasible.
  
  
• Right to object

You have the right to object at any time to the processing of your personal data carried out in pursuit of a legitimate interest of the Data Controller. In the event of an objection, your personal data shall no longer be processed, unless there are legitimate grounds for processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.

• Right to lodge a complaint with the Supervisory Authority

In addition, each data subject may lodge a complaint with the Supervisory Authority (Garante per la Protezione dei dati Personali) if he or she believes that his or her rights under the GDPR have been violated, according to the procedures indicated on the Garante's website accessible at: www.garanteprivacy.it

• Exercise of rights

The above rights may be exercised by sending an e-mail to the Data Controller at the following address: privacy@avvale.com or to the DPO at the following address: dpo@avvale.com .