Policy on the processing and protection of personal data (policy for events)
Policy on the processing and protection of personal data
Art. 1. Data Controller: the person or the company deciding how and why to process data
Art Cosmetics S.r.l. Single-member private limited liability company, subject to the direction and coordination of AC HOLDING S.r.l.
Phone: +39 0363 547001
E-mail address: privacy@artcosmetics.it
CEM address privacy@pec.artcosmetics.it
Art. 2. DPO Contact information
Art Cosmetics S.r.l. single-member private limited liability company has designated a DPO (Data Protection Officer). DPO contact information:
Phone: +39 0363 547001
E-mail address: privacy@artcosmetics.it
Art. 3. Purposes and legal basis for the processing: Why data are being processed and its justification
Purpose a)
Contact the company that provided us with the data during the fair to make an appointment, present our products, carry out other pre-contractual activities.
Legal basis: execution of the contract (consent to data processing is not required).
Refusal to provide the requested data will impede the proper execution of the contract.
Purpose b)
Filming (photographs and videos) during the event to be published on the corporate digital channels (Art Cosmetics website and social network)
Legal basis: execution of the contract (consent to data processing is not required).
The areas subject to filming are identified by appropriate signs. If you do not want to be filmed, you have the option of not accessing specific areas or asking the staff not to carry out/cancel the filming.
Furthermore, it is emphasised that:
- No personal information shall be resold to third parties.
- No data shall be used to detect personal preferences/habits through automated tools (profiling).
Art. 4. Processed data and methods of processing
For purpose a), the Data Controller processes common personal data (for example, name, surname, company name, telephone number, e-mail address).
For purpose b) they are not requested by the personnel, except for the images immortalized during filming.
Data processing is carried out with appropriate measures to ensure the security and confidentiality of personal data, in particular in accordance with the principles of lawfulness, necessity and proportionality.
Art. 5. Data preservation
The data are processed and stored at the Data Controller’s head office and on the company tools used (e.g. servers and computers). Some digital files are stored in cloud systems (e.g. e-mail). Suppliers have been selected to ensure data protection and confidentiality.
These devices are physically located within the European Union.
The Data Controller will keep the personal data for the time necessary to fulfil the purpose a) referred to in Article 3 above, in particular for 12 months from the end of the event/exhibition.
Filming made and publications on company channels (purpose b) are not subject to cancellation.
Some data may also be present in backup systems. In such case, it will not be possible to remove it. We guarantee that in the event of a total erasure of the systems, such data will be anonymised/deleted again.
Personal data may be retained for a longer period in the event of any litigation and for as long as the litigation lasts to allow the exercise of the Data Controller’s right of defence.
Summary of retention periods
Purpose a) 12 months from the end of the event/exhibition
Purpose b) Up to the specific request for cancellation/limitation of the use of the footage
Art. 6. Data communication and transmission
The employees and/or collaborators appointed by the Data Controller have access to the data as persons authorised to process them in the performance of their work.
Art. 7. Transfer of data to Third Countries
The data are not subject to communication and dissemination in countries outside the European Union.
Art. 8. Rights of the Data Subjects
Art. 7 no. 3 The Data Subject has the right to withdraw their consent at any time; Art. 15 Right of access, including the right to obtain an indication of the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period. Right to obtain indication of the origin of the data collected, as well as the purposes and methods of processing. Right to make any claim to the Control Authority at any time (Data Protection Authority); Art. 16 The Data Subject’s right to have personal data updated, rectified or supplemented; Art. 17 Right to erasure (‘right to be forgotten’); Art. 18 Right to restriction of processing, where applicable; Art. 20 Right to data portability if permitted by existing technology; Art. 21 Right to object at any time for any reason on grounds relating to their particular situation if the processing is carried out in the exercise of official authority or in the performance of a task carried out in the public interest or if it is carried out on the basis of the legitimate interest of the Controller; Art. 22 Right to obtain information regarding automated individual decision-making, including profiling.
Art.19 also requires the Data Controller to communicate the rectification or erasure of personal data or restriction of processing requested by the Data Subject.
Art. 9. Requests of the Data Subjects: how rights can be exercised
The requests referred to in Art. 8 above may be submitted by the Data Subjects to the Data Controller using the specific ‘Exercise of personal data protection rights’ form available on the Data Controller’s website at the following address:
https://www.artcosmetics.it/esercizio-di-diritti-in-materia-di-protezione-dei-dati-personali/
The Data Controller and the DPO may also be contacted at the addresses specified in Art. 1 and Art. 2 above.
Art. 10. Updates to this information
This information may be subject to changes and additions, as well as a consequence of possible regulatory changes and/or additions.
Any changes will be communicated to the Data Subjects.
The Data Subject can request a copy of this information at any time by sending a request to: privacy@artcosmetics.it
Last update: 27/02/2023