1. Data controller.

The data controller, i.e., the person who makes the decisions on the purposes and methods of data processing, is IMA S.p.A. (hereinafter also referred to as the “Company”), and can be contacted by registered mail to be sent to the registered office of the Company, Via Emilia, 428-442 Ozzano dell’Emilia (BO), or by e-mail to the e-mail address: privacy@ima.it

The Company has appointed a Data Protection Officer (‘DPO’), who can be contacted for clarification on the processing of personal data at the following address: DATAPROTECTIONIT@ima.it

2. Data processed.

The data to be processed are those you provide when participating in events organised by the company, and in particular:

• your image portrayed in photographs and/or videos taken by the Company during the event (“Images“);
• any special data pursuant to Article 9 GDPR and in particular data relating to health, such as, for example, allergies and food intolerances when necessary for the purposes of organising the event (‘Special Data‘).

hereinafter referred to collectively as ‘Personal Data‘.

3. Purpose of processing and legal basis.

Your Personal Data is collected and processed to enable you to participate in the event organised by the company.

The processing of Images, including possible publication on advertising material and/or on the Company’s website and/or on the Company’s social channels, is carried out for advertising and marketing purposes only.

The processing of Particular Data is carried out in order to provide for possible customised menus in case of food intolerances/allergies/preferences.

The legal basis for the processing of your Personal Data for the above-mentioned purposes is Article 6(1)(a) GDPR (consent of the data subject).

4. Nature of data provision and consequences of refusal to provide data.

Participation in events organised by the Company is absolutely free and optional, however, if you wish to participate, you must provide your consent to the processing of your Personal Data and Images.

5. Method of treatment.

Personal Data will be processed in accordance with the principles of fairness, lawfulness, transparency and protection of confidentiality and rights, in compliance with the principles expressed by the GDPR.

The processing of your Personal Data may be carried out by means of paper and/or electronic means and shall include – in compliance with the limits and conditions laid down by the legislation in force – all the operations or set of operations necessary for the processing in question, including communication to the entities referred to in paragraph 6 below. The processing of Personal Data shall be carried out in compliance with the rules of confidentiality (except for your express consent to publication, limited to Images) and security provided for by European legislation, the law, the ensuing regulations and internal provisions.

The Company guarantees the logical and physical security of the data and, in general, the confidentiality of all personal data processed (except for its express consent to publication, limited to Images), putting in place all necessary technical and organisational measures adequate to prevent the loss of data, unlawful or otherwise incorrect use thereof, as well as unauthorised access by third parties.

6. Communication of data.

IMA may, for the purposes set out in paragraph 3 above, disclose your Personal Data and Images:

• to its employees and collaborators, who will act in their capacity as authorised data processors (or so-called “processors”), as well as to other companies of the IMA Group and/or consultants engaged by the Controller who need to process personal data in order to perform their duties;
• to business partners as part of co-marketing initiatives;
• to third parties who perform outsourcing activities on behalf of the Company by providing specific services in their capacity as Data Processors pursuant to art. 28 GDPR (“Processors“). For information on the names and references of the Processors, you may contact IMA at privacy@ima.it or by registered mail at the address of the Company’s registered office;
• to judicial or supervisory authorities, administrations, public bodies and organisations (domestic and foreign), in accordance with the provisions of the law and following a formal, legitimate request by such parties.

7. Data retention.

Personal Data will be kept for the time strictly necessary to achieve the purposes described above, i.e. until your consent is revoked or you request deletion.

8. Transfer of personal data to third countries or international organisations.

The complex business structure of the IMA Group necessarily implies a circulation of personal data outside the territory of the European Union and the European Economic Area (“EEA”) which qualifies under Article 44 of the GDPR as a transfer of personal data to third countries.

Your personal data may therefore be transferred to third countries and, when this occurs, will always be processed in accordance with the provisions of Articles 45 et seq. of the GDPR.

For more information on the transfer of your personal data, please contact the company at: privacy@ima.it

9. Rights of the data subject.

With regard to your Personal Data, you may at any time exercise the rights recognised by the GDPR, set out below:

• access to personal data pursuant to Art. 15: obtain confirmation as to whether or not personal data concerning you are being processed and, if so, access to the following information: the purposes, the categories of data, the recipients, the retention period, the right to lodge a complaint with the Supervisory Authority, the right to request rectification or erasure or restriction of processing or to object to processing, and the existence of an automated decision-making process;
• Request for rectification of personal data pursuant to Article 16: obtain, without undue delay, the rectification of inaccurate Personal Data concerning you and the possible integration of the same if incomplete;
• deletion of personal data pursuant to Art. 17: obtain, without undue delay, the deletion of Personal Data concerning you;
• limitation of processing pursuant to Article 18: ‘limitation’ means the marking of stored data with the aim of limiting their processing in the future;
• data portability pursuant to Art. 20: in the case of automated processing carried out on the basis of consent or in performance of a contract, to receive Personal Data in a structured, commonly used and machine-readable format;
• Withdrawal of consent: with reference to the processing of special data pursuant to Article 9 GDPR provided in accordance with the provisions of paragraph 2 of the Information Notice and solely for the purposes set out above. Your consent may be revoked at any time, without affecting the lawfulness of the processing based on the consent you gave before revocation.

The Company also informs you that you can lodge a complaint pursuant to Article 77 with the competent Supervisory Authority (e.g. that of the State where you have your habitual residence, that of your place of work or that of the place where your rights are violated). For Italy, the competent authority is the Garante per la protezione dei dati personali, which can be contacted via the contact details given on the website https://www.garanteprivacy.it/.

The aforementioned rights may be exercised by sending a request by e-mail to privacy@ima.it or by registered mail to the head office of IMA.

Requests relating to the exercise of rights will be processed without undue delay and, in any event, within 30 days of receipt of the application.

Finally, it should be noted that IMA may amend or update this notice, also in order to comply with new obligations imposed by applicable law or for technical necessity.