Participant Privacy Policy

Participant Privacy Policy

Why this Policy?

The following information is intended to provide a clear and transparent overview of which personal data are processed in connection with the organisation of the “Venice Sustainable Fashion Forum” (hereinafter, the “Event”), in compliance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (hereinafter, the “GDPR” or “Regulation”). The Data Subjects concerned by the processing activities are the ones who request to participate in the Event by completing the online registration form and those who subsequently attend the Event.

1. Joint Data Controllers

CONFINDUSTRIA MODA, FEDERAZIONE TESSILE E MODA, with registered office at Via Alberto Riva Villasanta no. 3, Milan, Tax Code 97414740155, represented by its pro tempore legal representative (hereinafter, “Confindustria Moda”);

Confindustria Veneto Est, with registered office at Via Edoardo Plinio Masini no. 2, Padova, Tax Code 92293280282, represented by its pro tempore legal representative (hereinafter, “CF VE-EST”)

are Joint Data Controllers of the personal data collected in connection with the Event (hereinafter, the “Joint Controllers”), taking into account the jointly agreed decisions concerning the methods, purposes and security measures of such processing. The essential contents of the joint controllership arrangement entered into pursuant to Article 26 of the GDPR are available by contacting the Joint Controllers at the contact details indicated below.

Confindustria Moda

By e-mail: privacy@confindustriamoda.it
By post: Via Alberto Riva Villasanta no. 3, Milan (MI – 20145)

CF VE-EST

By e-mail: dpo@confindustriavenest.it
By post: Piazza delle Istituzioni, 12 – 31100 Treviso

2. Types of data and purposes of processing

The data you provide at the time of registration by completing the digital form are: identification data (first name, surname); contact data (e-mail address; telephone number); data relating to your company and corporate role as well as sector, IP address and data relating to logical access to IT platforms. In addition, during the Event, the Joint Controllers may collect further personal data relating to you, such as: images and/or audio-video recordings, as well as audio recordings or recordings of another nature. In any event, the data collected will be processed lawfully by the Joint Controllers, each within the scope of its respective responsibilities, pursuant to Article 6 of the Regulation for the following processing purposes:

a) Registration management and consequent participation in the Event

Your personal data are processed in order to carry out activities that are instrumental and functional to your participation in the Event, including in relation to the subject matter and the specific manner in which the Event is held.

b) Dissemination of Event content

The processing of images and/or audio/video recordings, created and/or disseminated through audio-visual media, documents, websites and social networks; print and online magazines; platforms dedicated to web-streaming the Event; radio, television and/or mass-media channels; and any other instrument and/or medium intended for data dissemination, is carried out for the purpose of promoting and publicising the Event and its subsequent editions, directly by the Joint Controllers or through authorised third parties, such as, by way of example, companies and/or professionals in the photography and/or video sector who will be authorised as external data processors, or through third parties that will process the data as independent Data Controllers.

c) Invitations to subsequent editions of the same Event

Your contact data may be further processed in order to invite you to subsequent editions of the Event and future developments thereof.

d) Direct marketing by the Event Partners

Your identification and contact data may also be disclosed to the Event Partners for the purpose of promoting their activities through direct marketing tools.

3. Legal bases for processing

Pursuant to Article 6 of Regulation (EU) 2016/679, the conditions for the lawfulness of the processing of your personal data in relation to the specific purposes described in this Policy are as follows:

• Management of the Data Subject’s request to participate in the Event and subsequent management thereof (purpose a)): the legal basis for this processing is performance of a contract pursuant to Article 6(1)(b) of the GDPR. The data whose processing does not require your express consent are limited and include personal details, company names and sector, e-mail addresses or telephone contact details, and the source of the reserved invitation; in essence, these are the data necessary for the performance of contractual obligations and related legal obligations incumbent on the Joint Controllers, as organisers of the Event;
• Dissemination of Event content (purpose b)), the legal basis for such processing is:
  1. the legitimate interest of the Joint Controllers pursuant to Article 6(1)(f) of the GDPR with regard to panoramic images and videos of the Event in which participants appear as part of the background and not as the central subject of the photograph/recording;
  2. the freely given and explicit consent provided pursuant to Article 6(1)(a) of the GDPR with regard to images and videos depicting an individual participant as the specific, principal and recognisable subject of the photograph/recording.
• Sending invitations to participate in the next edition of the Event (purpose c)), the legal basis for such processing is the freely given and explicit consent provided pursuant to Article 6(1)(a) of the GDPR.
• Direct marketing by the Event Partners (purpose d)), the legal basis for such processing is the freely given and explicit consent provided pursuant to Article 6(1)(a) of the GDPR.

What happens if you do not provide your data?

Failure to provide your personal data for the organisational management purposes of the Event referred to under point a) will make it impossible for the Joint Controllers to process your request to participate in the Event.

If you do not wish to consent to the processing of your image for the purposes referred to under point b2), the Joint Controllers will adopt appropriate measures to allow you to participate in the Event in any case. If, on the other hand, you have given authorisation and subsequently revoke it or object to the dissemination of your image, the effects of the withdrawal will apply from the date on which your request is received and the Joint Controllers will be required to confirm the removal of the data contained in the photographs and/or audio-video recordings subject to withdrawal, except where deletion or removal of such data from websites is impossible or particularly complex and burdensome (for example: the data have been saved by third parties on their own devices or other media, or used for publication on social media through reports, or have already been printed in distributed company brochures or leaflets). In such circumstances, the Joint Controllers cannot be held liable. It is understood that withdrawal will not affect processing already carried out.

The provision of data referred to under point b) is voluntary and the Data Subject may object to the legitimate interest of the Joint Controllers as further specified in paragraph 6.

The provision of data for purposes c) and d) is voluntary and the Data Subject may freely choose whether or not to give consent.

4. Processing methods and data retention periods

In processing your personal data, the Joint Controllers undertake to ensure that the information and data collected and used are adequate, relevant and limited to what is necessary in relation to the processing purposes described above, and that they are processed in a manner that ensures their security, including through adequate and effective technical and organisational measures implemented by the Joint Controllers, in compliance with the principle of Accountability imposed by the GDPR, so as to avoid the risk of loss, unauthorised access, unlawful use and dissemination. For these purposes, the Joint Controllers have procedures in place to manage personal data breaches (data breaches) in compliance with the applicable legal obligations.

Your data are collected through IT procedures (online registration form).

The Event website is developed and managed by “GDS Communication s.r.l.”, appointed as Data Processor pursuant to Article 28 of the GDPR.

In any event, the personal data collected and relating to you may be processed by third parties, as Data Processors or independent Data Controllers, depending on the individual cases and specific purposes, and by persons within the organisations of the Joint Controllers. The data are stored and processed through paper and electronic archives and tools, and appropriate security measures are ensured.

The data collected may be transferred to third countries and/or international organisations outside the European Union. In such cases, the transfer will be carried out in compliance with the applicable legislation (Articles 44 et seq. GDPR) and, therefore, either on the basis of an adequacy decision by the European Commission or, failing that, using the transfer mechanisms referred to in Article 46 of the GDPR (such as, for example, standard contractual clauses), assessing the possible adoption of “supplementary measures” capable of ensuring a level of protection essentially equivalent to that required under European Union law.

The subjects referred to above, in addition to the Joint Controllers, are permitted access to your personal data to the extent and within the limits necessary for carrying out the processing activities concerning you.

The data you provide for the purposes referred to under points a), b), c) and d) will be retained for 5 years from the date of collection.

5. Scope of data disclosure and dissemination

Employees of the Joint Controllers who are responsible for managing the Event and all related activities may become aware of your personal data. Such persons, who are instructed by the Joint Controllers pursuant to Article 29 of the Regulation, will process your personal data exclusively for the purposes indicated in this Privacy Policy and in compliance with the provisions of the applicable legislation.

Third parties may also become aware of your personal data and may process personal data on behalf of the Joint Controllers as “External Data Processors”, pursuant to Article 28 of the Regulation, such as, by way of example, companies and/or professionals in the advertising sector, photographers, professional video editors, graphic design and/or printing service companies, multimedia publishing companies, data processing and IT service companies (e.g. web hosting, data entry, management and maintenance of IT infrastructures and services, web-streaming services, etc.). You have the right to obtain from the Joint Controllers a list of any Data Processors appointed by them, by making a request using the contact details indicated in paragraph 1.

The data may also be shared, subject to your express consent, with Event Partners for the purposes referred to under point e) of the preceding list. You have the right to obtain from the Joint Controllers a list of the data recipients by making a request using the contact details indicated in paragraph 1.

6. Your rights

As a “Data Subject”, you have the right, in the cases provided for, to obtain from the Joint Controllers: access to the data collected, rectification, erasure, restriction of processing, withdrawal of consent and data portability. Data Subjects may object to processing, on grounds relating to their particular situation, where the Joint Controllers rely on legitimate interest (Articles 15 et seq. of Regulation (EU) 2016/679). The relevant request to exercise rights in connection with the processing of personal data may be submitted jointly or separately to the Data Protection Officer of the Joint Controllers at the e-mail addresses indicated below, attaching the relevant request or the completed form available for download from the institutional website of the Italian Data Protection Authority at the following link: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/1089924.

Confindustria Moda

privacy@confindustriamoda.it

Confindustria Veneto Est

dpo@confindustriavenest.it

You may also send the Joint Controllers a registered letter with return receipt to the addresses of their respective registered offices.

The exercise of these rights is free of charge pursuant to Article 12 of the EU Regulation, except in cases of manifestly unfounded or excessive requests, to which paragraph 5 of the same Article applies.

The Joint Controllers will respond to your request without undue delay and, in any event, within one month of receipt. This period may be extended by a further two months where necessary, taking into account the complexity or number of requests; in such a case, you will be promptly informed of the reasons for the extension. You also have the right to lodge a complaint with the Italian Data Protection Authority or bring proceedings before the competent courts if you consider that the processing of your personal data is carried out in breach of the Regulation (Articles 77 and 79 GDPR).