Information for "Visitors" pursuant to Article 13 of EU Regulation 2016/679 ("GDPR") on the Processing of Personal Data - Visitors

Hereinafter, Veronafiere S.p.A. and Commerciale S.r.l. provide the information required by the GDPR regarding the processing of personal data provided for the purpose of participation in the event (hereinafter, the "Event").

1. Data Controllers

The independent data controllers are Veronafiere S.p.A. (hereinafter, "Veronafiere"), VAT No. 00233750231, Viale del Lavoro 8, 37135 Verona, and Commerciale S.r.l. (hereinafter "Commerciale"), VAT No. 03760600274, Via Monte Bianco 31, 30173 Venice. Veronafiere S.p.A. and Commerciale S.r.l. When referred to jointly, they will be referred to as the "Data Controllers."

2. Data Protection Officer (DPO)

Veronafiere has appointed a DPO, who can be contacted at the following email address: [email protected].

3. Purpose of processing, legal bases, and data retention periods

Why are data processed?

1. To allow registration and participation in the Event.
2. To fulfill administrative, accounting, tax, and other legal obligations, in accordance with applicable legislation, in the case of paid services.
3. To create and maintain a reserved area on the Event ticketing portal.
4. To send commercial/advertising communications about subsequent editions of the Event, as well as similar initiatives organized by the Data Controllers, including physical events, pertaining to the Event's sector.
5. To carry out so-called "promotion" initiatives. "Customer satisfaction" measures aimed at obtaining information from customers regarding the quality of the services offered.
6. To carry out general marketing activities: conducting market research and sending communications, information, newsletters, and advertising materials, generally regarding trade fairs organized by the Data Controllers and companies belonging to the same group, or regarding third-party services or products related to or connected to the Event, using both automated (email, apps, messaging, social networks) and traditional (postal mail, operator-assisted calls) contact methods.
7. To communicate your data to third parties operating in the sector covered by the Event for their marketing purposes (commercial/advertising communications will be sent by third parties).

Who is the data controller involved?

Veronafiere and Commerciale (valid for points 1 to 7)

What are the conditions that make the processing lawful?

1. Performance of a contract to which the data subject is a party.
2. Fulfillment of a legal obligation to which the Data Controller is subject
3. The Data Controllers' legitimate interest in offering repeat visitors a more streamlined registration process for the Event.
4. The Data Controllers' legitimate interest and "soft spam" pursuant to Article 130, paragraph 4, of Legislative Decree 196/03, the so-called Privacy Code, given the visitor's interest in being informed about subsequent editions of the Event and related initiatives.
5. The Data Controllers' legitimate interest in improving their services by tailoring them based on customer feedback.
6. The Data Subject's Consent

How long do we retain personal data?

1. For the duration of the contractual relationship and, after its termination, for 10 years.
2. Until the data subject objects (including through specific functions in the reserved area).
3. Until the data subject objects.
4. Until the (anonymized) results of the survey are processed.
5. Until consent is withdrawn.
6. Until the data is disclosed to third parties, without prejudice to the right of objection that can be exercised against third parties.

4. Data Provision

Provision of the data marked with an asterisk in the registration form is required to register for the Event; failure to provide it will therefore prevent participation.

5. Categories of Recipients

Visitor data will be communicated, if consent has been given, to third parties operating in the same sector as the Event, who will process it as independent data controllers for marketing purposes. The data may be communicated to other entities operating as independent data controllers (for example, public authorities, supervisory and control bodies, professional firms). The data may also be processed, on behalf of the Data Controllers, by third parties responsibly designated pursuant to Art. 28 of the GDPR, such as natural and/or legal persons (such as IT service providers, ticketing, marketing, and communications companies).

6. Transfer of personal data to countries outside the European Union

Data may be transferred to countries outside the EU or the European Economic Area (EEA), for example, as part of collaboration with technological partners. When the transfer occurs to countries not deemed adequate by the European Commission and is not necessary for the performance of the contract, the transfer tools provided for by Art. 46 of the GDPR are adopted, considering the adoption of additional measures to ensure a level of protection equivalent to that required by EU law.

7. Rights of the data subject

The data subject, i.e. the individual to whom the personal data refers, may obtain from Veronafiere and Commerciale confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the data, the rectification of inaccurate data, the integration of incomplete data, and the erasure of data in the cases provided for by Art. 17 GDPR, the right to restrict processing in the cases provided for in Article 18 GDPR, and the right to object, for reasons relating to their particular situation, to processing carried out in the legitimate interests of the data controllers.

The data subject may also exercise the right to withdraw consent, object to data processing for marketing purposes, and lodge a complaint with the competent supervisory authority in the Member State of residence, work, or where the alleged infringement occurred.

8. Duration of storage and deletion

Until the end of the applicable retention periods (for example, up to 10 years after the termination of the relationship, or until the data subject objects). After this period, the data will be deleted, destroyed, or anonymized, consistent with technical deletion and backup procedures.