INFORMATION ON THE PROCESSING OF PERSONAL DATA pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council dated 27 April 2016 (GDPR)
Summary
Art. 1. Identity of the Ente Fiera di Alba as personal data controller.
Art. 2. Data processing for the purpose of purchasing tickets to attend the International Alba White Truffle Fair
Art. 3. Data processing for soft spamming purposes
Art. 4. Data processing for generic marketing purposes
Art. 5. Data processing for customer care and assistance purposes
Art. 6. Data processing for administrative-accounting and tax purposes
Art. 7. Data processing for the establishment, exercise or defence of a right
Art. 8. Processing methods and personal data protection
Art. 9. Categories of recipient to whom the Ente Fiera discloses your personal data
Art. 10. Ente Fiera contact details
Art. 11. Storage of personal data
Art. 12. Transfer to third countries
Art. 13. Right of objection
Art. 14. Right of access
Art. 15. Right of rectification
Art. 16. Right of cancellation
Art. 17. Right to restrict processing
Art. 18. Right to data portability
Art. 19. Time and modalities of response in case of exercise of the data subject’s rights
Art. 20. Right to file a complaint with a supervisory authority
Art. 21. Amendments
***
Ente Fiera di Alba, with head office in Alba (CN), Piazza Medford no. 3 (12051) registered in the Registro Imprese di Cuneo, with VAT no. 02945590046 (Ente Fiera) is the data controller of the personal data of users described in this information notice and having as its object the data collected on the website www.fieradeltartufo.org (Website) and on other sites where Ente Fiera acts as data controller pursuant to the GDPR for the purposes indicated therein.
The Ente Fiera will process the user’s personal data in order to:
- enable the user to purchase tickets for the International Alba White Truffle Fair (Event) and to allow the participant to take part in the activities organised as part of the Event;
- allow the Ente Fiera to correctly execute the obligations arising from the purchase of tickets and the correct execution of operations related thereto and to fulfil tax obligations;
- execute pre-contractual requests sent by the user. The legal basis is the need for the Ente Fiera to execute contractual measures (Art. 6, para. I, letter b) of the GDPR) adopted at the request of the data subject or to fulfil a legal obligation (Art. 6, para. I, letter c) of the GDPR).
The user wishing to purchase tickets to attend the Event must click on the “Buy Tickets” button on the Website. The user will be directed to the website https://ticket.fieradeltartufo.org/webshop and, by following the purchase procedure, they will be able to purchase tickets (Sites where tickets can be bought). These websites are the property of TicketOne S.p.A., with registered office in Milan (MI), Via Vittor Pisani n. 19 (20124), registered in the Registro delle Imprese di Milano, with VAT no. 12471480157). The personal data provided by users through this website will be processed by the Ente Fiera in its capacity as data controller. TicketOne S.p.A., on the other hand, will act as data processor appointed by the Ente Fiera.
The provision of data for the purpose in question is optional, i.e. there is no legal or contractual obligation to provide such data; however – since their processing is necessary to allow the execution of the contract for the purchase of tickets for the Event or to respond to pre-contractual requests made by the user – failure to provide such data will make it impossible for the user to purchase tickets for the Event or to receive a response to their pre-contractual requests.
Limited to the e-mail addresses to be provided by the user in the context of a purchase via the Websites on which tickets can be bought, in order to allow the direct offer of similar services by the Ente Fiera (so-called soft spamming), provided that the user does not object to such processing in the manner set out in this policy.
The legal basis for the processing is the legitimate interest of the Ente Fiera in sending this type of communication. This legitimate interest can be considered equivalent to the data subject’s interest in receiving “soft-spam” communications (Art. 6(I)(f) GDPR).
Subject to the express consent of the user, for sending newsletters and carrying out market surveys, also aimed at assessing the degree of user satisfaction, and sending advertising material relating to the Event and concerning the activities and services offered by Ente Fiera, by means of systems such as email (marketing purposes).
The legal basis for this processing is the express consent of the user (Art. 6(I)(a) GDPR).
Users may object to the processing of their personal data by contacting Ente Fiera at the contact details shown in Article 10 and via the link at the bottom of any promotional email sent by Ente Fiera.
The provision of data for generic marketing purposes is optional: there is no legal or contractual obligation on the user to provide such data for this purpose and/or to consent to the processing of his personal data for this purpose. Failure to consent to the processing of data for marketing purposes will result in the impossibility for users to receive advertising material relating to the Event and to the activities and services offered by Ente Fiera as well as the impossibility for Ente Fiera to carry out market surveys, including those aimed at assessing the degree of user satisfaction, and to send them newsletters.
Ente Fiera will process users’ data for general assistance and customer care activities and therefore to respond to users’ requests for information by email or telephone as well as to respond to complaints, reports, disputes.
The legal basis for this processing is the execution of pre-contractual measures taken at the request of the data subject (Art. 6(I)(b) of the GDPR) or, as the case may be, the legitimate interest of Ente Fiera in responding to your requests (Art. 6(I)(f) of the GDPR).
It is in the legitimate interest of the Ente Fiera to respond to enquiries and/or reports and/or complaints from users of the Website. This legitimate interest of the Ente Fiera also coincides with the legitimate interest of the users of the Website themselves who make the requests and/or reports and/or complaints in question and who, therefore, within the context of their relationship with the Ente Fiera, may reasonably be expected to expect that their personal data will be used by the Ente Fiera in order to provide feedback.
The provision of data for the purpose in question is optional. Failure to provide the data will make it impossible for Ente Fiera to respond to users’ requests for information and/or reports and/or complaints.
The Ente Fiera will process the user’s data for the purpose of fulfilling administrative and/or accounting and/or tax obligations connected with the provision of the services offered on the Website and on the Websites where tickets can be bought and/or the contract for the purchase of tickets related to the Event.
The legal basis for this processing is the fulfilment of legal obligations to which the Ente Fiera is subject (Art. 6(I)(c) GDPR).
The provision of data for this purpose is mandatory, as their processing is necessary to allow the Ente Fiera to fulfil its legal obligations. Any refusal to provide data for this purpose will make it impossible for the user to use the services of the Website and the Websites where tickets can be bought and, in particular, to finalise the purchase of tickets for the Event.
Ente Fiera will process the user’s data for the purpose of establishing, exercising or defending a right in all competent courts.
The legal basis for this processing is legitimate interest (Art. 6(I)(f) GDPR). It is a legitimate interest of Ente Fiera to pursue remedies to ensure compliance with its contractual rights or to prove that it has fulfilled its obligations arising from the contract with the data subject or imposed on Ente Fiera by law.
The processing of the User’s personal data will mainly be carried out with the aid of electronic or otherwise automated means, according to the methods and with the tools suitable to guarantee their security and confidentiality in compliance with the GDPR.
The information acquired and the methods of processing will be relevant and not excessive in relation to the type of services rendered. The data will also be managed and protected in environments whose access is under constant control.
The personal data provided by the user may be disclosed by the Ente Fiera to the categories of recipients listed below:
- companies, consultants or professionals who may be entrusted with the installation, maintenance, updating and, in general, the management of the Website’s hardware and software (including the platform), including cloud computing service providers, and any third parties they use;
- to companies appointed by the Ente Fiera to send commercial communications;
- to all those persons, including public authorities, who have access to the data by virtue of regulatory or administrative measures;
- employees and/or collaborators of the Ente Fiera;
- TicketOne S.p.A.;
- banking institutions and companies operating national or international payment circuits through which online payments are made for Event-related tickets bought through the Websites where tickets can be purchased;
- to all those public and/or private entities, natural and/or legal persons (legal, administrative and tax consultancy firms, Judicial Offices, Chambers of Commerce, Chambers and Labour Offices, etc.), if the communication is necessary or functional for the correct fulfilment of contractual obligations undertaken in relation to the purchase of tickets related to the Event, as well as obligations arising from the law or in the case of ascertainment, exercise or defence of a right.
Data concerning users will not be disseminated, other than in an anonymous and aggregate form, by the Ente Fiera for statistical or research purposes.
The Ente Fiera can be contacted at the following addresses:
- Ente Fiera di Alba, located in Alba, Piazza del Risorgimento 1 (12051)
- e-mail: info@fieradeltartufo.org
- phone nr: +39.0173.361051 (Monday to Friday, from 8:30 a.m. to 12:30 p.m. and from 2:00 p.m. to 6:00 p.m., excluding Saturdays and Sundays and bank holidays in Italy).
Personal data will be stored according to the following criteria:
- for marketing purposes, until your consent is withdrawn. Any personal data that you provide for marketing purposes will be retained for 24 months after it is provided, unless you withdraw your consent beforehand. At the end of the aforementioned retention period, there is the possibility that the Ente Fiera will contact you to ask if you wish to continue to receive marketing communications from the Ente Fiera. In the absence of a positive and explicit response from the user, personal data concerning the user will be deleted or archived in accordance with current legislation;
- for the purpose of executing the sales contract, for 10 years from the date of receipt of the purchase order;
- for purposes of legal defence, until judgment has become final;
- for the purpose of complying with the law, for the time necessary for that purpose;
- for the purpose of performing any service requested through the Site, for the time necessary to execute the request.
The Ente Fiera is based within the European Union. Therefore, the processing of user data is safe in terms of legal regulations as it is governed by the GDPR. If the transfer of your personal data takes place in a country outside the EU and for which the European Commission has issued an adequacy finding, the transfer is in any case considered safe from a regulatory point of view.
The user’s personal data may be transferred to the USA in accordance with the European Commission’s adequacy decision. With this decision, the European Commission has decided that the USA offers data protection comparable to that offered by the European Union.
The user’s personal data may also be transferred to countries outside the EU and for which the European Commission has not issued an adequacy finding. You are therefore invited to regularly review this article to find out to which of these countries your data may be transferred.
The data subject shall have the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them carried out for purposes having as their legal basis the legitimate interest of the data controller.
Where data are processed for direct marketing purposes, the data subject also has the right to object at any time to the processing of personal data related to them for such purposes.
In the event that the right to object is exercised, the Ente Fiera shall refrain from further processing of personal data, unless it can prove the existence of compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
If the data subject objects to processing for direct marketing purposes, the personal data are no longer processed for that purpose.
The data subject has the right to obtain confirmation from the Ente Fiera as to whether or not personal data related to them are being processed and, if so, to obtain access to the personal data and information listed below.
If the user exercises the right of access, they may obtain access to their personal data and to the following information:
- the processing purposes;
- the categories of personal data concerned;
- the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients in third countries or international organizations;
- where possible, the period for which the personal data will be retained or, if this is not possible, the criteria used to determine that period;
- the existence of the data subject’s right to request from the controller the rectification or erasure of personal data or the restriction of the processing of personal data related to them or to object to their processing;
- the right to file a complaint with a supervisory authority;
- where the data are not collected from the data subject, all available information on their origin;
- the existence of an automated decision-making process, including profiling, which produces legal effects concerning the data subject or significantly affects them in a similar way, and at least in such cases, meaningful information on the logic used, as well as the importance and expected consequences of such processing for the data subject.
The Ente Fiera will provide a copy of the personal data being processed. If further copies are requested by the data subject, the trade fair organisation may charge a reasonable fee based on administrative costs. If the data subject makes the request by electronic means, and unless otherwise specified by the data subject, the information is provided in a commonly used electronic format.
The data subject has the right to obtain rectification of personal data related to them without undue delay. In view of the purpose of the processing, the data subject has the right to obtain the integration of incomplete personal data, including by providing a supplementary declaration.
The data subject has the right to obtain from the Ente Fiera the cancellation of personal data related to them without undue delay and the Ente Fiera is obliged to delete personal data without undue delay, if one of the following reasons exists:
- personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- the data subject withdraws the consent on which the processing is based, if there is no other legal basis for the processing;
- the data subject objects to processing based on the legitimate interest of the controller on grounds relating to their particular situation and no overriding legitimate ground exists, or objects to the processing of their personal data for direct marketing purposes;
- personal data are unlawfully processed;
- the personal data must be deleted in order to comply with a legal obligation under Union or Member State law to which the data controller is subject.
The data subject has the right to obtain the restriction of processing from the Ente Fiera when one of the following cases occurs:
- the data subject objects to the processing of personal data for the period of time necessary for the Ente Fiera to verify the accuracy of such data;
- the processing is unlawful and the data subject objects to the deletion of the personal data and asks instead for their use to be restrictedand limited;
- although the Ente Fiera no longer needs it for processing purposes, the personal data is necessary for the data subject for the establishment, exercise or defence of a legal claim;
- the data subject has objected to the processing in cases where the processing is based on the legitimate interest of the data controller, on grounds relating to his particular situation, pending verification as to whether the legitimate interests of the Ente Fiera prevail over those of the data subject.
If the processing is restricted, the personal data subject to the restriction shall be processed, except for storage, only with the consent of the data subject or for the establishment, exercise or defence of a legal claim or to protect the rights of another natural or legal person or for reasons of substantial public interest of the Union or a Member State.
The data subject who has obtained the restriction of processing shall be informed by the controller before that restriction is lifted.
Data subjects have the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning them that were given to Ente Fiera and they have the right to transmit this data to another data controller without hindrance from the data controller to whom they have provided it, if:
- the processing is based on the consent of the data subject or on a contract;
- processing is carried out by automated means.
Data subjects, when exercising their right to data portability, have the right to obtain the direct transmission of personal data from one controller to another, if technically feasible.
The exercise of the right to portability is without prejudice to the right to cancellation.
The right to portability must not infringe the rights and freedoms of others.
Ente Fiera shall provide data subjects with information about the actions taken in relation to a request to exercise the rights recognised by Articles 15 to 22 of the GDPR (i.e. right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object) and by this Privacy Policy, without undue delay and, in any case, within one month of receipt of the request. This deadline may be extended by two months if necessary, taking into account the complexity and number of requests. The Ente Fiera will inform the person concerned about the extension, and the reasons for the delay, within one month of receipt of the request. If the interested party submits the request by electronic means, the information shall be provided, where possible, by electronic means, unless otherwise specified by the interested party.
Without prejudice to any other administrative or judicial remedy, any data subject who considers that the processing relating to them is in breach of the GDPR shall have the right to lodge a complaint with a supervisory authority, namely in the Member State where they normally reside, work or where the alleged breach has occurred. The supervisory authority to which the complaint has been lodged shall inform the data subject of the status or outcome of the complaint, including the possibility of a judicial remedy.
Ente Fiera reserves the right to make changes to this policy at any time, giving appropriate publicity to users of the Website and ensuring in all cases adequate and similar protection of personal data. In order to view any changes, the user is invited to regularly check this information notice.