PRIVACY STATEMENT PURSUANT TO REGULATION (EU) 2016/679 (“GDPR”)
ISTITUTO ITALIANO DI FOTOGRAFIA S.R.L., through its legal representative and in its capacity as data controller (hereafter “Controller”), hereby informs you that your data will be processed using the following means and for the following purposes.
- Scope of the processing: The Controller will process the following personal data: your name, surname, email address, telephone number and nationality (hereafter “personal data” or “data”). You provided us with the above data when you subscribed to our mailing list and gave us your verbal or written consent to the processing of such data for the purposes described in article 2 of this privacy statement.
- Purposes of the processing: Your data is processed with your express consent (article 7 GDPR), for the following marketing purposes: sending newsletters, commercial communications, advertising information and/or material regarding services and products offered by the Controller.
- Means of the processing: Your data will be processed lawfully, fairly and in a transparent manner that ensures the protection of your confidentiality and your rights.
The processing of your data involves collection, recording, organisation, storage, consultation, elaboration, alteration, selection, retrieval, alignment, use, combination, blocking, disclosure, erasure or destruction of the data (article 4 no. 2) GDPR). Your data is subjected to electronic and/or automated processing.
For the purposes of the processing indicated in article 2 of this privacy statement, your data will be stored until you unsubscribe from our mailing list. You can unsubscribe at any time by clicking on the following link: https://www.istitutoitalianodifotografia.it//index.php?a=remove
- Access to data: Your data may be made accessible for the above purposes to employees and associates of the Controller designated as persons in charge of data processing.
- Disclosure of data: The Controller may disclose your data without your express consent for the purposes indicated in article 2 of this privacy statement to supervisory authorities, judicial authorities and to any other parties to whom it is legally obliged to disclose the data (article 6, letters b) and c) GDPR).
- Transfer of data: Your data will be processed and stored on internal servers owned by the Controller. The Controller shall be entitled, where necessary, to transfer data to servers owned by third parties (who shall be appointed as Processors) located within the European Union and/or in non-EU countries. In such cases, the Controller shall ensure that the transfer of data to non-EU countries is carried out in accordance with all applicable EU laws. Where necessary, agreements designed to ensure an adequate level of protection and/or the European Commission’s standard contractual clauses shall be entered into.
- Providing data and consequences of a refusal to provide data: Providing data for the purposes described in article 2 of this privacy statement is optional. You have the right to withdraw your consent to further processing of your data. If you decide to do so, you will no longer be able to receive newsletters, commercial communications, advertising information and/or advertising material regarding services and products offered by the Controller.
- Rights of the data subject: As the data subject, you have the following rights (article 15 GDPR):
- to obtain confirmation as to whether or not personal data concerning you exists, including data that has not yet been recorded, and the communication of such data in an intelligible form;
- to be informed: i) of the source of the data; ii) of the purposes and means of the processing; iii) of the logic applied to the processing, if the latter is carried out with the help of electronic means; iv) of the details of the controller, processors and any representatives designated pursuant to article 3, paragraph 1, GDPR; v) of the recipients or categories of recipient to whom the personal data may be disclosed, or who may come to acquire knowledge thereof in their capacity as designated representative in the country, or as processors or persons in charge of the processing;
- to obtain: i) the updating, rectification or (where there is an interest) supplementing of the data; ii) the erasure, anonymization or the blocking of data that has been processed unlawfully, including data whose retention is unnecessary for the purposes for which it has been collected or subsequently processed; iii) certification to the effect that a notification has been submitted to the entities to whom or to which the data was communicated or disseminated concerning the operations provided for in points i) and ii) – including in relation to their contents – unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected;
- the right to object, in whole or in part: i) for legitimate reasons, to the processing of personal data concerning you, even if pertinent to the purpose of data collection ii) to the processing of personal data concerning you for the purpose of sending advertising materials or direct marketing, or for carrying out market research or commercial communication, through the use of automated call systems without the intervention of an operator, by email and/or through traditional marketing methods by telephone and/or mail. Please note that the right of opposition of the interested party for the purposes of direct marketing by automated means extends to traditional methods and that the possibility for the interested party to exercise the right to object, even in part, is not affected. Therefore, the interested party can decide to receive only communications through traditional methods or only automated communications or neither type of communication.
Where applicable, you also have the rights set out in articles 16-21 GDPR (right to rectification, right to be forgotten, right to restriction of processing, right to data portability and right to object), as well as the right to complain to the Supervisory Authority.
- Exercise of rights: You are entitled to exercise your rights at any time by sending a registered letter with return receipt to ISTITUTO ITALIANO DI FOTOGRAFIA S.R.L., Via Caviglia, 3, 20139 Milano (MI); or by certified email to firstname.lastname@example.org.
- Controller and persons in charge of processing: The Controller is ISTITUTO ITALIANO DI FOTOGRAFIA S.R.L., registered office at Via Caviglia, 3, 20139 Milan, VAT number 10863240155, certified email email@example.com, tel.+39 02 58107623, email firstname.lastname@example.org. The persons in charge of data processing are the employees and associates of ISTITUTO ITALIANO DI FOTOGRAFIA S.R.L.
- Modifications to this statement: This statement may undergo modifications. Where this is the case, you will be provided with the new version, which must be signed in acknowledgement and acceptance.