INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679 (“GDPR”)

Last update 2026/02/27

The ASSOCIAZIONE FABBRICA INTELLIGENTE LOMBARDIA, with registered office in Via Oldofredi Ercole 23, 20124 Milan, Tax Code and VAT No. 08192390964 (the “Controller”), in its capacity as data controller, hereby informs you, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”), that your personal data – and/or the personal data of your authorised personnel, to whom this notice must be provided – will be processed for the purposes and under the conditions set out below.

  1. Categories of Personal Data and Source of the Data

The Controller processes personal data relating to natural persons, consisting of common identification and professional contact details (name, surname, company name, address, telephone number, email, banking and payment details) provided by you during the negotiation and/or conclusion of contracts as Clients of the Controller’s services or as Suppliers.

The Controller processes personal data relating to you or to your designated representatives, as Clients or Suppliers of the Controller. Such personal data include identification and contact details (e.g., name, surname, job role, professional email address, telephone number, business address), as well as administrative and payment data necessary for managing the relationship (e.g., banking details, invoice references, contractual information).

Data may be provided directly by you as the data subject, or by the Client/Supplier company within the contractual or pre‑contractual relationship established with the Controller.

In some cases, data may also come from third parties such as professionals or commercial intermediaries involved in the relationship, or from information available in public registers or sources relevant to the commercial relationship.

  1. Purposes of the Processing and Legal Bases

Personal data are processed by the Controller for the following purposes:

  1. a) Conclusion, management and execution of the contractual relationship with Clients and Suppliers, including administrative, accounting, fiscal, financial, documentary and organisational activities.

Legal basis: performance of a contract or pre‑contractual measures taken at the request of the data subject (Art. 6(1)(b) GDPR).

  1. b) Compliance with legal obligations in fiscal, accounting, civil, administrative and transparency matters.

Legal basis: compliance with a legal obligation to which the Controller is subject (Art. 6(1)(c) GDPR).

  1. c) Protection of the Controller’s rights in judicial proceedings or in the event of disputes.

Legal basis: legitimate interest of the Controller in establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR).

  1. d) Institutional communication and information activities towards Members and Association contacts, where connected with and relevant to the contractual relationship.

Legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR).

  1. e) Communication of personal data to property owners/managers for access to the premises where the Controller’s offices are located.

Legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR).

  1. f) Associational marketing purposes (e.g., sending newsletters, information on activities, services and initiatives of the Association).

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR) or “soft spam” (Art. 130 Italian Privacy Code).

  1. Methods of Processing and Retention Periods

Data are processed using paper-based and electronic tools, applying appropriate technical and organisational measures pursuant to Articles 32 and 28 GDPR.

The Controller retains:

  • Contractual, administrative and accounting data: for the time strictly necessary to fulfil the contractual purposes described above and, in any case, no longer than 10 years from the termination of the contractual relationship, pursuant to civil and fiscal legislation.
  • Data used for associational marketing: until consent is withdrawn, with immediate deactivation from marketing systems and deletion within 24 months from withdrawal.
  • Data communicated for access to premises: retained for 30–90 days, unless longer retention is necessary for evidentiary purposes.

No automated decision‑making processes, including profiling, pursuant to Article 22(1) and 22(4) of Regulation (EU) 2016/679, are carried out as part of the processing activities described.

  1. Access to Personal Data

In compliance with the principles of necessity and proportionality, your personal data may be processed exclusively by personnel expressly authorised by the Controller or by data processors formally appointed pursuant to Article 28 GDPR.

Authorised personnel include employees, collaborators and other workers specifically instructed by the Controller.

Designated data processors include:

  • providers of administrative, accounting and fiscal services;
  • IT, cloud and email service providers;
  • PEC (certified email) and digital archiving service providers;
  • professionals and companies supporting the Controller in activities related to the contractual relationship.
  1. Disclosure of Personal Data

For the purposes set out in Article 2 and in execution of contractual and legal obligations related to the commercial relationship, your personal data may be disclosed to entities acting as independent controllers, within the limits of their respective competences.

These may include:

  • Public Administrations and competent Authorities, including judicial authorities, the Italian Revenue Agency and other public bodies;
  • Banks and insurance companies;
  • Other entities to whom disclosure is required by law or necessary for the performance of the contract.

Your data will not be disseminated.

  1. Data Transfers

Personal data may be transferred, for the purposes described in this notice and for storage or archiving needs, within the European Union or to third countries.

In all cases, the Controller ensures that any transfer outside the EU complies with applicable legislation.

  1. Nature of Data Provision and Consequences of Refusal

Providing personal data for the contractual purposes referred to in Article 2 (points a–e) is mandatory.
Failure to provide such data will make it impossible to execute the contractual relationship.

Providing data for marketing purposes (Article 2(point f.)) is optional. You may decide not to provide such data or to withdraw consent at any time. In such cases, you will no longer receive commercial or promotional communications relating to the Controller’s activities.

  1. Data Subject Rights

As data subjects, you may exercise the rights provided for in Articles 15–22 GDPR at any time. These include: confirmation of processing; access to your data; information on purposes, categories, recipients (including non‑EU recipients), retention periods and data sources; information on the existence of automated decision-making, including profiling.

Where applicable, you may exercise the rights to rectification, erasure, restriction, portability, objection, and the right not to be subject to automated decision‑making.

You may also lodge a complaint with the Supervisory Authority and seek compensation under Article 82 GDPR if you suffer damage resulting from a breach.

  1. Exercising Your Rights

You may exercise your rights at any time by sending a registered letter with return receipt to:
AFIL – Associazione Fabbrica Intelligente Lombardia, c/o Innovhub, Via G. Colombo 83, 20133 Milan (MI), or an email to: direzione@afil.it .

  1. Controller and Processors

The data controller is ASSOCIAZIONE FABBRICA INTELLIGENTE LOMBARDIA, Via Oldofredi Ercole 23, 20124 Milan, Tax Code and VAT No. 08192390964. The updated list of data processors is available at the Controller’s registered office.