Privacy Policy according to article 13 of the EU Regulation n. 679/2016

We hereby inform you that the EU Regulation n. 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, also known as the General Data Protection Regulation (hereafter “GDPR” or “Regulation”), safeguards the processing of the personal data of natural persons. Pursuant to the aforementioned regulation, your personal data will be processed in accordance with the principles of fairness, lawfulness and transparency and with respect for your privacy and your rights. This document meets the disclosure requirements set forth in article 13 of GDPR.

Data Controller

With reference to the processing connected to the organization, management, and promotion of the Cosmoprof Worldwide Bologna’s event (hereafter “CPBO” or “the Event”) which jointly determine the purposes and methods used for processing – described in the following paragraphs of this privacy policy –,

ü ITA Agency – the Italian Trade Agency for promotion abroad and for the internationalization of Italian companies, with registered office in Rome, Via Liszt, 21 (hereafter also “ITA”);

ü BolognaFiere Cosmoprof SpA, a company managed and coordinated by its sole shareholder BolognaFiere S.p.A, with registered office in Bologna, via Maserati 16 (hereafter also “Cosmoprof”);

are Joint Controllers of the Data and, pursuant to article 26 GDPR, have signed a joint controllers’ agreement regulating their respective liabilities regarding compliance with the requirements of the Regulation.

Hereafter, in this policy, ITA and Cosmoprof will be referred to jointly as “Joint Controllers”.

Each of the Joint Controllers has nominated a Data Protection Officer (DPO) or a Data Protection contact person, who may be reached at the following addresses:

-          ITA Data Protection Contact Person: mailto:[email protected]

-          Cosmoprof DPO: [email protected]

The essential contents of the aforementioned joint controllers’ agreement are available at the offices of the Joint Controllers and may be obtained via a written request to be sent to the email addresses provided above.

Types of data processed

Processed data includes identifying data, contact information and work position information that you provide by completing the paper or digital form, in order to participate in the Event as a buyer and benefit from the promotional activities that ITA carries out in relation to CPBO.

Said processing does not include sensitive data as identified in paragraph 1 of article 9 of the GDPR, nor it does include personal data related to criminal convictions and offences, as indicated in article 10 of the GDPR.

Purposes for the processing, legal basis, and provision of information

The personal data that you provide will be processed for the following purposes:

a)         In order to allow the Joint Controllers to meet their legal and contractual obligations and for the exercise of their rights.

The Joint Controllers will process your data within the limits and for the purpose of carrying out activities that are strictly necessary for permitting you to participate in the Event, for providing you with service information related to CPBO and for evaluating your satisfaction with respect to the Event. The legal basis of the processing is the execution of your request to participate in CPBO and the related management of the Event.

Your data will also be processed in order to meet the legal requirements that result from your participation in the Event and from subscribing to the services offered by ITA in relation to the promotion of CPBO. The legal basis for said processing is compliance with the legal requirements which are on each Joint Controller in relation to the activities carried out to ensure the Event's success.

Providing such data is optional; however, refusing to provide the data makes it impossible to execute your request to participate in the Event and subscribe to the services offered by ITA in relation to the promotion of CPBO.

b)      Purposes related to email marketing to allow the Joint Controllers to offer you similar products and/or services

If, as part of the relationship established with us, you have provided us with your email address, the Joint Controllers may use the said address to send you emails related to the future editions of the Event and/or initiatives similar to the event You subscribed to when you completed the form for the participation in the Event. In any event, you have the right to object to such processing at any time. The legal basis for this processing is article 130, paragraph 4 of Legislative Decree 196/2003, as amended by Legislative Decree 101/2018. You may stop such messages from being sent at any time by clicking on the “unsubscribe” option at the bottom of each email or by contacting us through the channels indicated in the following paragraph (“Your Rights”).

c) Additional direct marketing, customer satisfaction, and business matchmaking purposes pursued by means of emails, operator phone calls, regular mail, and SMS messaging carried out autonomously by each Data Controller.

By freely granting explicit consent, which is optional and can always be revoked, you authorize ITA and Cosmoprof to use your contact information as autonomous and separate Data Controllers for their own direct marketing purposes, i.e. to send informational and/or promotional material related to their own products and/or services and/or events, for direct sales and for their own market research purposes. Said activities may include customer satisfaction surveys and business matchmaking and will be conducted by means of emails, operator phone calls, SMS messaging, and regular mail.

The legal basis for said processing is your consent, which is completely free and may be revoked at any time. You are, in fact, free to revoke your consent to the processing of your data for the purposes mentioned in letter c) with reference to all or only some of the communication channels indicated above and to both or only one of the Data Controllers. You may exercise these rights by contacting the Data Controller(s) using the methods and channels indicated in the following paragraph (“Your Rights”).

Your consent to the direct marketing purposes indicated in letter c) is optional and the refusal of the consent will not affect your participation in the Event in any way.

Means of processing

Your personal information will be processed with and without the use of electronic tools, based on rationales and procedures that are consistent with the aforementioned purposes and in compliance with the GDPR, including aspects related to confidentiality and safety.

Sharing of your personal information with third parties

Personal data can be accessed by our staff persons, who have been duly authorized and trained on the basis of the need-to-know criteria, and is sent to third parties when communication is required by applicable laws and regulations concerning legitimate third-party recipients, such as authorities and public bodies for the relevant institutional purposes, including police forces.

Your personal data is also shared with our service suppliers, such as, for example, self-employed collaborators, who may act as part of an association, and companies that specialize in processing data, advertising, providing technical, computer, and organizational services that are functional for the aforementioned purposes, etc. We only provide such subjects with the data needed for the agreed upon activities and services and they act as our Data Processors based on adequately formalized instructions.

Transfer of data outside the European Union

Your data will not be transferred outside the European Union.

Storing of personal information

Your data concerning participation in the Event are stored by the Joint Controllers in order to meet contractual and legal obligations and for the exercise of their rights for the period of time established by the regulation concerning the storage of legal documents.

For marketing purposes, the data are stored by the Joint Controllers for 10 years.

Exceptions are made in cases where the Joint Controllers and/or autonomous Controllers are authorized to store the data for a different period of time in order to meet a legal requirement or in order to exercise or defend their own rights in legal proceedings.

Your rights

You have the right to ask each of the Data Controllers for access to, correction of, changes to, or deletion of your data and limitations on processing – even in the case of the processing carried out under Joint Controllership indicated in sections a) and b) above – at any time. In addition, you have the right to oppose the processing of your data at any time as well as the right to the portability of the data themselves. To exercise these rights, as well as the additional rights set forth in articles 15 et seq. of the GDPR, Cosmoprof acts as the point of contact for the concerned data subjects, in order to manage the requests received from them. To this purpose, the concerned data subjects may refer to Cosmoprof, at the following addresses:

-          BolognaFiere Cosmoprof spa: by sending an e-mail to: [email protected] or sending a letter to: BolognaFiere Cosmoprof SpA, Via Cappuccini 2, 20122 Milan, Italy.

In any event, pursuant to article 26, paragraph 3 of the GDPR the concerned data subjects may exercise their rights toward each of the Joint Controllers. To this purpose, to exercise the aforementioned rights, the concerned data subjects may also refer to the following addresses:

-          ITA Agency via e-mail [email protected]

***

Concerning the processing for marketing purposes indicated in letter c) above, conducted under autonomous controllership, you may exercise the rights set forth in articles 15 et seq. of the GDPR, in addition to revoking your consent, by contacting the interested Data Controller by using the following methods and channels:

-          ITA Agency: via the e-mail address mailto:[email protected];

-          BolognaFiere Cosmoprof spa: via the e-mail address [email protected] or by writing to: BolognaFiere Cosmoprof SpA, via Cappuccini 2, 20122 Milan, Italy.

Should you deem that a violation of your rights has occurred, you may refer to the competent Supervisory Authority, besides always being able to directly refer to the Judicial Authority.