INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679 (“GDPR”) AND RELEASE FOR THE USE OF PHOTOGRAPHS AND VIDEO RECORDINGS

The ASSOCIAZIONE FABBRICA INTELLIGENTE LOMBARDIA, with registered office in Via Oldofredi Ercole 23, 20124 Milan, Tax Code and VAT No. 08192390964 (the “Controller”), in its capacity as data controller, hereby informs you, pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”), that your personal data will be processed for the purposes and under the conditions set out below.

  1. Categories of Personal Data and Source of the Data

The Controller processes common personal data (identification and contact details such as name, surname, organisation/company, professional role, email address) collected:

  • directly from you through online event registration forms;
  • through registration communicated by your organisation in the case of institutional or project‑related participation;
  • during interactions with the Controller or event organisers.

The Controller may also process common personal data relating to photographic images or video recordings depicting you during the event. Such images may be collected directly from you or captured by the Controller’s authorised staff or by appointed photographers/video‑makers.

  1. Purposes of Processing

2.1 Purposes related to the management of event registration and participation

Legal bases: performance of pre‑contractual or contractual measures (Art. 6(1)(b) GDPR); compliance with legal obligations (Art. 6(1)(c) GDPR); the Controller’s legitimate interests (Art. 6(1)(f) GDPR), including the communication of data to event organisers or venue owners/managers.

2.2 Subscription to and sending of newsletters issued by the Controller or Project

The Controller may send informational communications or newsletters concerning the Association’s or the Project’s activities, initiatives and events.
Legal basis: consent of the data subject (Art. 6(1)(a) GDPR).

2.3 Event documentation purposes

Acquisition and use of common personal data and/or contextual, non‑individualising photographic or video images strictly for documentation and institutional communication purposes on the Controller’s websites and social channels, or in informational and dissemination materials relating to the Controller or the projects in which the Controller participates.

Legal bases:

  • legitimate interest of the Controller (Art. 6(1)(f) GDPR) for contextual and non‑individualising images and any common identification/professional data (e.g., name, surname, role of speakers);
  • consent of the data subject (Art. 6(1)(a) GDPR; Art. 10 Italian Civil Code; Arts. 96–97 Italian Copyright Law 633/1941) for individualising images, video recordings or personal interviews.

You may at any time express your wish not to be recorded or request the removal of content concerning you, compatibly with the publication media used.

2.4 Communication of personal data to project partners

In the case of events forming part of collaborative or funded projects, personal data may be disclosed to project partners for statistical or reporting purposes.
Legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR).

 

 

 

  1. Methods of Processing and Retention Periods

Data are processed in compliance with the principles of lawfulness, fairness, transparency and minimisation, using electronic, digital and—where necessary—paper‑based tools, and applying appropriate technical and organisational measures.

Retention periods:

  • Registration and event management data: for the duration of the event and subsequently up to 10 years for administrative purposes, project reporting and protection of the Controller’s rights.
  • Contextual and non‑individualising images: up to 10 years, unless you object.
  • Individualising images/video (based on consent): until consent is withdrawn and, in any case, no longer than 10 years.
  • Newsletter data (based on consent): until unsubscribe/withdrawal of consent, with deletion within 24 months.
  • Data communicated for venue access: retained for 30–90 days, unless longer retention is necessary for evidentiary purposes.

No automated decision‑making processes, including profiling, pursuant to Article 22(1) and 22(4) of Regulation (EU) 2016/679, are carried out as part of the processing activities described.

  1. Access to Personal Data

Your data may be accessed, strictly within the limits of necessity and proportionality, by:

  • employees and collaborators of the Controller, in their capacity as authorised personnel or data processors;
  • third‑party companies or professionals (e.g., professional firms, IT consultants, event organisers, photographers and video‑makers) acting on behalf of the Controller as data processors.
  1. Disclosure of Personal Data

Pursuant to Articles 6(1)(b) and 6(1)(c) GDPR, and therefore without the need for explicit consent, the Controller may disclose your data for the purposes indicated in Article 2 to judicial authorities and to any entities to whom disclosure is required by law, including (where applicable) event venue owners/managers. Furthermore, where the event forms part of funded or collaborative projects, your data may be disclosed to project partners. These recipients will act as independent controllers.

Your data and images may be subject to dissemination within the limits of the purposes indicated in Article 2.

  1. Data Transfers

Personal data may be transferred, for the purposes described in this notice and for storage and archiving requirements, within the European Union or to third countries. In all cases, the Controller ensures that any transfer outside the EU will comply with applicable legal requirements.

  1. Nature of Data Provision and Consequences of Refusal

Providing personal data necessary for the purposes under Article 2 that are not based on consent is mandatory. Failure to provide such data will make it impossible for the Controller to manage your registration and participation in the event.

Providing personal data for consent‑based purposes is always optional. You may refuse to provide such data or withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. However, this may prevent the Controller from sending newsletters or from capturing individualising images or interviews.

  1. Data Subject Rights

As a data subject, you may exercise at any time the rights set out in Articles 15–22 GDPR. In particular, you may obtain confirmation as to whether personal data concerning you are being processed; access your data; receive information on processing purposes, categories of data, recipients, retention periods or criteria used; the source of the data where not collected from you; and the existence of automated decision‑making, including profiling.

Where applicable, you may also exercise the rights to rectification, erasure, restriction, portability, objection, and the right not to be subject to automated decision‑making. You also have the right to lodge a complaint with the Supervisory Authority and to seek compensation under Article 82 GDPR should you suffer damage resulting from a breach.

  1. Exercising Your Rights

You may exercise your rights at any time by sending a registered letter with return receipt to:
AFIL – Associazione Fabbrica Intelligente Lombardia, c/o Innovhub, Via Giuseppe Colombo 83, 20133 Milan (MI), or an email to: direzione@afil.it .

  1. Controller and Processors

The data controller is ASSOCIAZIONE FABBRICA INTELLIGENTE LOMBARDIA, Via Oldofredi Ercole 23, 20124 Milan, Tax Code and VAT No. 08192390964.
The updated list of data processors is available at the Controller’s registered office.