INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679 (“GDPR”)
Last update 2026/02/27
The ASSOCIAZIONE FABBRICA INTELLIGENTE LOMBARDIA (AFIL), with registered office in Via Oldofredi Ercole 23, 20124 Milan, Tax Code and VAT No. 08192390964 (the “Controller”), in its capacity as data controller, hereby informs you, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”), that your personal data – or the personal data of your representatives, to whom this notice must be provided – will be processed for the purposes and under the conditions set out below.
- Purpose of the Processing and Source of the Data
The Controller processes common personal data (identification and contact details) relating to you or your designated representatives, as communicated at the time the membership relationship is established or collected during the course of such relationship, including data relating to any offices held within the Association’s Governing Bodies.
The Controller may also process personal data voluntarily provided by your additional representatives when they subscribe to the Association’s newsletter or participate in events organised by the Association.
The Controller may further collect and process photographic images and video recordings depicting you or your representatives, captured by authorised personnel of the Controller or by appointed photographers/videomakers during events or activities organised by the Association, or provided directly by you in the context of the membership relationship.
- Purposes and Legal Bases of the Processing
2.1 Establishment and Management of the Membership Relationship
Purpose: establishment, management, renewal and termination of the membership relationship; institutional communications; statutory activities.
Legal bases: performance of a contract to which the data subject is party (statutory obligations); compliance with legal obligations; the Controller’s legitimate interest in ensuring effective representation of its Members and their engagement, as well as for the establishment, exercise or defence of legal claims.
2.2 Management of the Board of Directors and Other Governing Bodies
Purpose: convening meetings, drafting minutes and fulfilling institutional obligations; publication of images of Board members when necessary.
Legal bases: performance of a contract to which the data subject is party (statutory obligations); compliance with legal obligations; the Controller’s legitimate interest in ensuring the proper functioning of the Association’s governing bodies, including for the establishment, exercise or defence of legal claims.
2.3 Institutional Communications and Newsletters to Members and Former Members
Purpose: sending institutional, technical, project‑related and event‑related communications via email newsletters.
Legal bases: the Controller’s legitimate interest in ensuring member engagement and soft‑spam communications (Art. 130(4) Italian Privacy Code) for sending messages similar to the membership relationship even after its termination, unless the data subject objects.
2.4 Collection and Publication of Photographs/Video
Purpose: institutional communication and promotion of the Association’s activities and events, including publication on the Controller’s website or social media pages.
Legal bases:
- legitimate interest (unless objected to) for non‑individualising contextual images;
- consent for individualising photographs/video or personal interviews.
2.5 Communication of Data to Property Owners/Managers of the Premises Where the Controller’s Offices Are Located
Purpose: management of access to the premises where the Controller’s offices are located.
Legal basis: legitimate interest.
- Method of Processing and Retention Periods
Your personal data will be processed in accordance with the principles of lawfulness, fairness, transparency and data minimisation, using electronic, digital and – where necessary – paper‑based tools, and applying appropriate technical and organisational measures.
Personal data processed by AFIL for the management of governing bodies, member activities, the Board of Directors, working groups and strategic communities are retained for the time necessary to fulfil statutory, administrative, accounting and legal obligations, and in any case for the period required by applicable laws. Institutional documents (such as minutes and resolutions of the Board of Directors) may be retained permanently, whereas administrative and operational communications are retained for standard statutory periods.
Images collected in institutional or associative contexts are retained for a maximum of ten years, unless the data subject objects. Individualising images or images published based on consent are retained until consent is withdrawn, and in any case no longer than ten years.
Personal data processed for access‑related communications to the premises may be retained for 30/90 days, unless longer retention is necessary for evidentiary purposes.
No automated decision‑making processes, including profiling, pursuant to Article 22(1) and 22(4) of Regulation (EU) 2016/679, are carried out as part of the processing activities described.
- Access to Personal Data
Your personal data or the data of your representatives, strictly limited to what is necessary and proportionate to the purposes set out in Article 2, may be accessed by:
- employees and collaborators of the Controller, in their capacity as authorised personnel or data processors;
- third‑party companies or individuals (e.g. professional firms, IT consultants, event organisers, photographers/videomakers) acting on behalf of the Controller as data processors pursuant to Article 28 GDPR.
- Disclosure of Personal Data
Pursuant to Articles 6(1)(b) and 6(1)(c) GDPR, and therefore without requiring explicit consent, the Controller may disclose your data or the data of your representatives – strictly within the limits necessary for the purposes set out in Article 2 – to judicial authorities or other entities to whom disclosure is mandated by law, including:
- public bodies and institutions with which the Association maintains institutional relations (e.g. Regione Lombardia, Finlombarda);
- organisations to which the Association belongs (e.g. CFI – Cluster Fabbrica Intelligente);
- Members of the Association, where necessary for institutional or statutory purposes or participation in working groups and associative initiatives;
- statutory auditors and parties responsible for administrative/accounting reviews;
- social network providers;
- property owners or managers of the premises where the Controller’s offices are located, solely for access management purposes.
These recipients will act as independent controllers.
Personal data will not be disseminated unless required by law, based on the Controller’s legitimate interests, or with the explicit consent of the data subject.
- Data Transfers
Personal data may be transferred, for the purposes described in this notice and for storage or archiving needs, within the European Union or to third countries.
In all cases, the Controller ensures that any transfer outside the EU will be carried out in accordance with applicable legal requirements.
- Nature of Data Provision and Consequences of Refusal
The provision of the personal data necessary for the purposes indicated in Articles 2.1 to 2.3 and 2.5 is to be considered mandatory, as such data are strictly required for the establishment, management and proper performance of the membership relationship, for compliance with the Association’s statutory and legal obligations, and for enabling access to the Controller’s premises.
Any refusal to provide such data, in whole or in part, may make it impossible for the Association to perform the membership relationship, to fulfil the institutional and statutory obligations related to the roles held, or to allow access to the Controller’s premises.
The possibility to unsubscribe from institutional newsletters remains unaffected and may be exercised at any time through the opt‑out/unsubscribe function available in the newsletters.
The provision of personal data processed for the purposes set out in Article 2.4 (collection and dissemination of photographs/video) is optional when processing is based on consent. In cases where the dissemination of images is carried out on the basis of the Controller’s legitimate interest (e.g., institutional documentation and communication relating to events or associative activities), the data subject may nevertheless exercise their right to object at any time.
Failure to provide such data or the withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal, but it prevents the Controller from using or publishing the data subject’s images for the purposes described.
- Data Subject Rights
As data subjects, you may exercise at any time the rights provided for in Articles 15–22 GDPR. These include: obtaining confirmation as to whether personal data concerning you are being processed; accessing the data; receiving information on the purposes, categories of data processed, recipients or categories of recipients (including non‑EU recipients), retention periods or criteria for determining them; the source of the data; and the existence of automated decision‑making, including profiling.
Where applicable, you may exercise the rights to rectification, erasure, restriction of processing, portability, objection, and the right not to be subject to decisions based solely on automated processing. You may also lodge a complaint with the competent Supervisory Authority and, in the event of damage arising from a GDPR violation, seek compensation pursuant to Article 82 GDPR.
- How to Exercise Your Rights
Data subjects may exercise their rights at any time by sending a registered letter with return receipt to:
AFIL – Associazione Fabbrica Intelligente Lombardia, c/o Innovhub, Via G. Colombo 83, 20133 Milan (MI) or an email to: direzione@afil.it .
- Controller and Processors
The data controller is ASSOCIAZIONE FABBRICA INTELLIGENTE LOMBARDIA, Via Oldofredi Ercole 23, 20124 Milan, Tax Code and VAT No. 08192390964. The updated list of data processors is available at the Controller’s registered office.
Milano ASSOCIAZIONE FABBRICA INTELLIGENTE LOMBARDIA