Privacy Policy

PRIVACY NOTICE PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679

Umbriafiere SpA, with registered office in Piazza Moncada, 06083 - Bastia Umbra (PG), VAT No. 02270300540, in the person of its legal representative pro tempore, informs users of the website that the personal data provided through the website, including those entered in the section dedicated to the newsletter and in the form for the organisation of events, will be processed in compliance with Regulation (EU) 2016/679 ("GDPR") and with the applicable legislation on the protection of personal data.

Processing will be carried out in accordance with the principles of lawfulness, fairness and transparency, purpose and storage limitation, data minimisation, accuracy, integrity, confidentiality and accountability.

For the processing of data collected by means of cookies and other tracking tools, reference is made to the separate Cookie Policy, available at the following link: Cookie Policy.

A) DATA CONTROLLER

The Data Controller is Umbriafiere SpA, with registered office in Piazza Moncada, 06083 - Bastia Umbra (PG), VAT No. 02270300540 (hereinafter, the "Data Controller").

For information relating to the processing of personal data or to exercise the rights provided for by the GDPR, you may contact the Data Controller at the following contact details:
e-mail: privacy@umbriafiere.it;
telephone: +39 075 800 4005.

B) DATA SUBJECT TO PROCESSING

Within the context of the website, the Data Controller may process the following categories of personal data:

  • identification data, such as first name and surname;
  • contact details, such as e-mail address and telephone number;
  • data relating to the company or entity to which the user belongs, where provided;
  • data relating to the city and province, where provided;
  • data and information contained in the message spontaneously sent by the user through the "Organise your event" form available on the web page;
  • data relating to the preferences expressed by the user with regard to communications and content of interest;
  • any other personal data that the user voluntarily decides to enter in the forms available on the website.

Users are invited not to enter in free text fields personal data that are not relevant to the request submitted and, in particular, special categories of personal data within the meaning of Article 9 GDPR.

C) PURPOSES AND LEGAL BASIS OF PROCESSING

Personal data are processed for the purposes indicated below.

1. Management and operation of the website

Data may be processed in order to allow browsing and use of the functions of the website, as well as to ensure the security, maintenance and proper management of the digital services made available.

Legal basis: legitimate interest of the Data Controller in the management, security and functionality of the website, pursuant to Article 6(1)(f) GDPR.

2. Management of requests relating to the organisation of events

The data provided voluntarily through the "Organise your event" form will be processed in order to receive, examine and respond to requests for information, contact, inspections, proposals or cooperation relating to the organisation of exhibitions, trade shows, congresses and other initiatives at the exhibition centre of the Data Controller.

Legal basis: performance of pre-contractual measures adopted at the request of the data subject, pursuant to Article 6(1)(b) GDPR.

Providing the data marked as mandatory is necessary to allow the Data Controller to handle and respond to the request. Failure to provide such data may result in the impossibility to follow up on the contact.

Any consent to the sending of newsletters and commercial communications is optional, separate and does not in any way affect the handling of the request for the organisation of the event.

3. Subscription to the newsletter and sending of commercial communications

Subject to the collection of specific consent, the user's personal data will be processed for the purpose of sending, by e-mail, newsletters and commercial communications relating to Umbriafiere SpA, its activities, services, initiatives, trade shows, events and press releases.

Legal basis: consent of the data subject, pursuant to Article 6(1)(a) GDPR.

Consent to marketing is optional. Failure to provide consent does not affect browsing of the website or the possibility to submit requests through the "Organise your event" form.

The user may withdraw consent at any time, by using the unsubscribe link included in the communications received or by contacting the Data Controller at the contact details indicated in this privacy notice.

4. Profiling of communication preferences

Subject to the collection of specific consent, separate and distinct from that given for the sending of the newsletter, personal data may be processed in order to analyse and use the communication preferences expressed by the user, so as to personalise the content of the communications sent.

Profiling will be carried out exclusively on the basis of the categories of interest selected by the user in the subscription form, such as:

  • all Umbria Fiere initiatives;
  • trade shows;
  • press releases;
  • events.

Legal basis: consent of the data subject, pursuant to Article 6(1)(a) GDPR.

Consent to profiling is optional, separate and not necessary for subscription to the newsletter. Therefore, the user may receive commercial communications even without consenting to their personalisation.

The user may at any time change his/her preferences or withdraw consent to profiling, without necessarily withdrawing consent to receive the newsletter.

5. Compliance with legal obligations and protection of rights

Personal data may be processed in order to comply with obligations laid down by laws, regulations, measures of competent authorities or to establish, exercise or defend a right of the Data Controller in out-of-court or judicial proceedings.

Legal basis: compliance with a legal obligation to which the Data Controller is subject, pursuant to Article 6(1)(c) GDPR, as well as the legitimate interest of the Data Controller in the protection of its rights, pursuant to Article 6(1)(f) GDPR.

D) NATURE OF THE PROVISION OF DATA

The provision of the data requested for the management of requests for the organisation of events is necessary in order to allow the Data Controller to provide a response to the user.

The provision of data for subscription to the newsletter, for the sending of commercial communications and for the profiling of communication preferences is optional.

The user may therefore:

  • read the privacy notice;
  • subscribe to the newsletter and receive commercial communications;
  • give, separately, consent to the profiling of preferences;
  • select one or more categories of interest.

The check-boxes relating to marketing consent, consent to profiling and communication preferences must be optional and not pre-selected.

E) METHODS OF PROCESSING

The processing of personal data is carried out using IT, telematic and, where necessary, paper-based tools, with the adoption of appropriate technical and organisational measures to ensure the security, confidentiality and integrity of the data. The data are processed by personnel of the Data Controller who are expressly authorised and instructed by the latter, within the limits of their respective duties and responsibilities.

F) DATA RECIPIENTS

Personal data may be disclosed, to the extent strictly necessary for the purposes indicated above, to the following categories of persons:

  • authorised personnel of Umbriafiere SpA;
  • providers of IT, hosting, maintenance and website management services;
  • consultants and professionals entrusted with administrative, accounting, tax, legal or organisational activities;
  • public authorities, judicial authorities, law enforcement agencies and other parties entitled to request the data by virtue of the law;
  • entities appointed as data processors pursuant to Article 28 GDPR.

For the technical management of the newsletter, of the sending of communications and of subscribers' preferences, Umbriafiere SpA uses Sendinblue, registered with the Paris Trade and Companies Register under number 498 019 298, with registered office in Rue Salneuve 9-17, 75017 Paris, appointed as external data processor pursuant to Article 28 GDPR.

Personal data will not be disclosed to the public.

G) TRANSFER OF PERSONAL DATA

As a rule, personal data are processed within the European Union.

Should it become necessary, for technical or organisational reasons, to transfer personal data outside the European Economic Area, such transfer will be carried out in compliance with the safeguards laid down by the GDPR, including, where applicable, the adequacy decisions of the European Commission or the safeguards referred to in Article 46 GDPR.

H) DATA RETENTION

Personal data will be retained for no longer than is necessary to achieve the purposes for which they are collected and processed.

In particular:

  • the data collected through the "Organise your event" form will be retained for the time necessary to handle the request and the related pre-contractual contacts; should the request lead to the establishment of a contractual relationship, the data will be retained for the duration of the relationship and for the subsequent period required by legal obligations or necessary for the protection of the rights of the Data Controller;
  • the data processed for the sending of the newsletter and commercial communications will be retained until the withdrawal of consent or the user's unsubscribe;
  • the data and preferences processed for profiling purposes will be retained until the withdrawal of the relevant consent or the change of the user's preferences;
  • the data processed for legal obligations, tax, administrative, accounting purposes or for the protection of the rights of the Data Controller will be retained for the period laid down by the applicable legislation or necessary for the management of any disputes.

I) RIGHTS OF THE DATA SUBJECT

The data subject may exercise, in relation to the Data Controller, the rights provided for in Articles 15 et seq. of the GDPR and, in particular, has the right to:

  • obtain confirmation as to whether or not personal data concerning him or her are being processed and access such data;
  • request the rectification of inaccurate data or the completion of incomplete data;
  • request the erasure of personal data, in the cases provided for in Article 17 GDPR;
  • obtain restriction of processing, in the cases provided for in Article 18 GDPR;
  • receive the personal data in a structured, commonly used and machine-readable format and, where technically feasible, have them transmitted to another controller;
  • object to processing carried out on the basis of the legitimate interest of the Data Controller;
  • object at any time to the processing of personal data for direct marketing purposes;
  • withdraw at any time the consent given for the sending of the newsletter, commercial communications and/or for profiling, without affecting the lawfulness of processing based on consent before its withdrawal;
  • lodge a complaint with the Italian Data Protection Authority pursuant to Article 77 GDPR.

To exercise his/her rights, the data subject may send a request to the following e-mail address: privacy@umbriafiere.it.

L) MINORS

Personal data of individuals under 16 years of age must not be provided through the website without the authorisation of the person exercising parental responsibility, where required by the applicable legislation.

M) UPDATES TO THIS PRIVACY NOTICE

This privacy notice may be updated or amended in the event of changes in the methods of processing personal data, in the services offered through the website or in the applicable legislation. The updated version will be published on the website of Umbriafiere SpA with an indication of the relevant date of update.

Umbriafiere SpA

Regione Umbria Provincia di Perugia Comune di Bastia Umbra Camera di Commercio dell'Umbria Sviluppumbria Umbria - Cuore Verde d'Italia FederUnacoma Associazione Esposizioni e Fiere Italiane Monte dei Paschi di Siena Printreleaf