Blastness S.p.A., with registered office in Piazza Castello, 26 – 20121 Milano, Fiscal Code and VAT number no. 01195440118, as Data Controller (hereinafter, “Data Controller”), hereby provides you, pursuant to and for the purposes of EU Regulation No. 2016/679 (hereinafter, “GDPR”), with information regarding the processing of personal data collected while browsing the website https://www.blastness.com/it/privacy, as well as any requests for information or participation in events and webinars.
1. Personal data and source of the data
The Data Controller processes the following personal data
• identification data and contact details (e.g., name, surname, e-mail address, mobile phone number, etc.) and any other information provided when requesting information, registering for webinars and/or events. In addition, your image may also be collected during events and/or webinars;
• navigation data such as the IP addresses or domain names of the devices used and connected to, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and IT environment.
2. Purpose, legal basis of the processing and nature of the provision of data
Your data will be processed for the following purposes:
a) Allowing you to browse the website, such as managing any request for information and the registration and participation in events and/or webinars.
The legal basis of the processing is the performance of contractual obligations pursuant to Article 6(1)(b) of the GDPR. The provision of personal data is necessary; therefore, the omission of the personal data requested makes it impossible to manage any request.
b) Take photographs and/or videos during the event and publish them to promote the activities of the Data Controller.
In the case of events that, due to their organisation, do not allow for the collection of specific authorisations and consents, the legal basis for processing is the pursuit of a legitimate interest of the Data Controller pursuant to Article 6, paragraph 1, letter f) of the GDPR. Only in this case is the provision of personal data necessary for participation in the event; in all other cases, it will be purely optional and subject to the collection of specific authorisations and consents.
c) Fulfilment of regulatory obligations to which the Data Controller is subject.
The legal basis of the processing is the fulfilment of regulatory obligations pursuant to Article 6(1)(c) of the GDPR. The provision of personal data is necessary; therefore, the omission of the personal data requested makes it impossible to manage any request.
d) Defence of the Data Controller's rights in judicial and extrajudicial proceedings.
The legal basis for the processing of the data is the pursuit of the legitimate interest consisting in the protection of the interests and rights of the Data Controller pursuant to Article 6(1)(f) GDPR. The provision of personal data is necessary; therefore, the omission of the personal data requested makes it impossible to manage any request. However, you may request to object at any time, by sending a motivated request to the Data Controller, to the processing of personal data carried out on the basis of legitimate interest, pursuant to and for the purposes of Article 21 GDPR; your request, in this sense, will be subject to evaluation and response by the Data Controller.
e) Data Controller’s direct marketing purposes, consisting, for example, in sending via e-mail commercial communications relating to products, services, initiatives and projects of the Data Controller or other companies in the Blastness group, as well as surveys and/or questionnaires aimed at assessing your level of satisfaction with the services you receive.
The legal basis for the processing of the data is the consent pursuant to Article 6(1)(a) GDPR and Article 130 of Legislative Decree no. 196/2003. The provision of personal data for this purpose is optional; therefore, failure to provide the requested personal data does not make it impossible to manage any request, and your right to withdraw your consent or object to such processing at any time, easily and free of charge, in the ways indicated in the “Data subject’s rights” section of this information notice and/or with those indicated in the promotional communications that will be sent to you from time to time, remains unaffected.
3. Recipients of the data
The data may be communicated for the pursuit of the aforementioned purposes to other entities such as, for example, public authorities and law enforcement agencies, law firms, accountants, etc., who will process the data as independent data controllers for their own purposes. The following subjects may also have access to the data:
• the staff of the Data Controller, who are expressly authorised to process them, in accordance with the instructions given, pursuant to Articles 29 and 32(4) of the GDPR and 2-quaterdecies of Legislative Decree no. 196/2003;
• service providers working on behalf of the Data Controller, appointed as Data Processors, including, but not limited to, IT suppliers, etc. The updated list of Data Processors is available from the Data Controller.
Personal data, except for your image, will not be disclosed. With particular reference to images collected during photo and/or video shoots carried out during events, and without prejudice to the provisions expressly set out in any authorization forms that may have been collected, the Data Controller shall have the right to use and adapt such images in order to create and publish content on its websites, social networks, catalogues, magazines, press releases and/or any other present or future dissemination channels, for the purpose of promoting its brand and activities, without in any way compromising the dignity of the persons depicted.
4. Data retention periods
Without prejudice to the prescription periods provided for by law, personal data processed for the purposes indicated in letters (a), (c) and (d) of point 2 above shall be stored for no longer than 12 months from the date of the event and/or webinar or from the date of the request for information, while images processed for the purposes indicated in letter (b) of point 2 above may be subject to longer storage periods if they are published.
The personal data processed for the purpose of direct marketing indicated in point (e) of section 2 above are kept until the revocation of consent or opposition to the processing or for 24 months from the moment of the last renewal of consent and of the will not to oppose the processing. This is without prejudice to the data subject's right to revoke consent or object to the processing at any time, by contacting the Data Controller, with consequent cancellation of the personal data processed for marketing purposes.
5. Extra-EEA Data transfer
The Data Controller may transfer your personal data to the United Kingdom and/or the United States of America on the basis of the relevant Adequacy Decisions adopted by the European Commission and, in the case of the United States of America, of the recipients’ adherence to the EU-US Data Privacy Framework programme.
6. Data subject’s rights
Data subjects may assert their rights and/or request information on the processing of their data by contacting the Data Controller. The GDPR grants the right to:
a) withdraw the consent given, with the understanding that withdrawal of consent shall not affect the lawfulness of the processing based on the consent prior to the withdrawal;
b) access or obtain a copy of the personal data as well as to know the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients in third countries or international organisations; where possible, the period for which the personal data are to be stored or, if this is not possible, the criteria used to determine that period; the existence of the data subject’s right to request from the data controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning him or her or to object to their processing; the right to lodge a complaint with a supervisory authority; where the data are not collected from the data subject, all available information on their source; the existence of an exclusively automated decision-making process, including profiling, and, at least in such cases, meaningful information on the logic used, as well as the importance and the envisaged consequences of such processing for the data subject;
c) rectification and integration of inaccurate or outdated data;
d) erasure, whenever the data are no longer necessary in relation to the purposes pursued, or if the data subject decides to withdraw consent or objects to the processing and there are no other legal grounds for keeping the data, or if the data are processed unlawfully, or have to be erased because of a legal obligation;
e) restriction of processing if the data subject contests the accuracy of the personal data, for the period necessary for the controller to verify the accuracy of the personal data; if the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead that their use be restricted; even though the controller no longer needs them for the purposes of the processing, if the personal data are necessary for the establishment, exercise or defence of legal claims; if the data subject has objected to the processing, pending verification as to whether or not the legitimate reasons of the controller prevail over those of the data subject.
In cases of exercise of the rights referred to in points c), d), and e), the data subject has the right to know the recipients to whom the personal data have been transmitted and the right that the Controller communicates to them the rectification, erasure or restriction of the processing, unless this proves impossible or involves a disproportionate effort.
f) data portability, i.e. to receive in a structured, commonly used and machine-readable format the personal data concerning him/her, including the direct transfer of the same by the Controller to other Controllers, where the processing is carried out by automated means and is based on consent or contract;
g) object to the processing where the processing is based on the legitimate interest of the Controller, as already specified in point 2 above;
h) lodge a complaint to the competent Supervisory Authority (for Italy, the Garante per la protezione dei dati personali, https://www.garanteprivacy.it).
7. Contact details
You may contact the Data Controller by sending an email to privacy@blastness.com.