INFORMATION FOR THE PROCESSING OF PERSONAL DATA EX ART 13 OF THE GDPR

In compliance with Article 13 of Regulation (EU) 2016/679 ("GDPR"), IpackIma S.r.l. ("IpackIma") and BolognaFiere S.p.A. ("BolognaFiere") as Joint Controllers (hereinafter, the "Joint Controllers") intend to provide you with some information regarding the processing of personal data relating to you as a participant, in various capacities, at the ehxibition in which you partecipated (the "Exhibition") collected by the Joint Controllers and processed in compliance with applicable legislation, including the GDPR, as well as further applicable provisions on the protection of personal data, in the manner and for the purposes described below in this privacy notice (the "Notice").

For all matters not covered by this Notice, please refer to the information provided by the Joint Controllers to the data subjects (e.g., visitors, exhibitors) as part of the registration for the Exhibition and/or the submission of the application for admission to the Exhibition.

1. Contact details of the Joint Controllers and of BolognaFiere’s DPO

The Joint Controllers of the processing of personal data are IpackIma S.r.l., with registered office in S.S. del Sempione 28, 20017 Rho (Milan), e-mail privacy@ipackima.it, and BolognaFiere S.p.A., with registered office in Viale della Fiera, 20 – 40127 Bologna, e-mail privacy@bolognafiere.it. BolognaFiere has appointed a Data Protection Officer who can be contacted at the e-mail address privacy@bolognafiere.it.

2. Types of personal data

The Joint Controllers process your personal data (in particular, photographic reproductions and video recordings of your image) collected at the booths or as part of the Exhibition.

The processing of personal data related to the image of the data subjects, including their collection and subsequent publication, will be carried out by the Joint Controllers in accordance with the principle of minimization by avoiding as much as possible taking photographs and portraying the subjects in ways that make them identifiable, for example, by preferring photographs and videos of the context of the Exhibition and from a distance.

In any case, the Joint Controllers will employ all reasonable efforts to identify areas subject to photographic shooting and inform the data subjects by posting appropriate signs/information.

3. Purpose and legal basis for processing

The personal data collected by means of cameras, video shooting or audiovisual recording and are processed for dissemination, promotional and commercial purposes of the Exhibition, to document the Exhibition organized by the Joint Controllers as well as to promote the arrangements and methods of organization of the Exhibition. Data processing includes the collection, reproduction, publication and dissemination of photographic reproductions and video recordings of the data subjects’ image.

The Joint Controllers shall process personal data where applicable on the basis of the performance of the contract to which the data subject is a party, e.g. for exhibitors in compliance with the contractual relationship with the same, pursuant to Art. 6(1)(b) of the GDPR as well as, for the pursuit of a legitimate interest of the Joint Controllers, pursuant to Art. 6(1)(f) of the GDPR to document and promote the Exhibition.

4. Method of treatment

The processing of personal data is carried out for the above purpose, in accordance with the provisions of Article 5 of the GDPR, both on paper and computer, as well as by electronic or otherwise automated means.

Processing is carried out directly by the Joint Controllers, their employees and collaborators, who have been authorized to carry out personal data processing operations related to the contractual relationship and have been instructed to do so, as well as by Fiera Milano Group companies and service companies operating as data processors on behalf of the Joint Controllers (for details, see section 7).

5. Nature of data provision and consequences of refusal

Providing personal data is optional, but refusal to do so will result in the impossibility of processing the images and/or video recordings of the data subject for the purposes stated above.

6. Retention period of personal data

The data collected and conferred will be stroed in the databases of the Joint Controllers only for the time strictly necessary to achieve the purposes for which they are processed (e.g. duration of the Exhibition and its promotional activities) or, in any case, until the exercise of the data subject's right to object, without prejudice to the lawfulness of the processing carried out prior to said objection. In the latter case, where possible, the data will be deleted.

7. Recipients of personal data

As part of the purposes set forth in paragraph 3, your personal data may be disclosed to the following categories of recipients. The full list of such recipients or categories of recipients is available at the offices of the Joint Controllers:

- data processors, pursuant to Article 28 of the GDPR, appointed from time to time;

- professionals, partners, advertising agencies,

- technical management companies of computer networks and systems;

- public bodies;

- judges and courts, by reason of any request or as part of a trial;

- public authorities authorized by law, in case of audits, verifications and/or inspections.

8. Data dissemination

Within the limits pertinent to the processing purposes indicated, personal data (images and audiovisual footage) may be subject to communication, publication and/or dissemination in any form on the promotional material of the Joint Controllers, on the website of each Joint Controllers and on the pages of the relevant social channels (i.e. Facebook, Youtube, Instagram, X, LinkedIn and TikTok) of the Joint Controllers, as part of subsequent editions of the Exhibition, in print media and/or any other means of dissemination.

The Joint Controllers will not transfer data outside the European Economic Area (hereinafter "EEA"). However, as anticipated, the Joint Controllers may post data on the following social networks: Facebook, Youtube, Instagram, X, LinkedIn and TikTok. In this case, these social networks may transfer such data to countries located outside the EEA, each as data controller, pursuant to Article 4, no. 7, GDPR.

Therefore, it is suggested that you review the privacy policies of the aforementioned social networks. In particular:

- Facebook: Informativa sulla privacy di Meta - In che modo Meta raccoglie e usa i dati degli utenti | Centro sulla privacy | Gestisci la tua privacy su Facebook, Instagram e Messenger | Privacy di Facebook;

- Youtube: Privacy Policy – Privacy & Terms – Google

- Instagram: Informativa sulla privacy di Meta - In che modo Meta raccoglie e usa i dati degli utenti | Centro sulla privacy | Gestisci la tua privacy su Facebook, Instagram e Messenger | Privacy di Facebook

- X: X Privacy Policy

- LinkedIn: Informativa sulla privacy di LinkedIn

- TikTok: Privacy Policy | TikTok

9. Rights of the data subject

You have the right to exercise at any time the rights recognized by Articles 15-21 GDPR, as briefly summarized below:

- Right of access: you may request information regarding the processing we operate on your data or confirmation that the Controller (or the Joint Controllers) processes your personal data. In this case, you may ask us to provide you with copies of your data and to verify what data we hold about you.

- Right of rectification: you have the right to request us to rectify your personal data if it is incorrect, including the right to request the integration of incomplete personal data.

- Right to erasure: you have the right to request us to erase the data (or any part of it) you have provided to us, including data whose retention is not necessary in relation to the purposes for which the data was collected or otherwise processed.

- Right to restrict processing: you may request us to restrict the processing of your personal data if the legal circumstances apply.

- Right to object: you may object to the processing of your personal data, subject to the existence of an overriding legitimate reason for the continuation of such processing.

- Right to portability: you may obtain from the Controller (or the Joint Controllers), in a structured, commonly used and machine-readable format, the personal data you have communicated to us, for the purpose of transmitting them to another party. This right is applicable in cases where the Controller (or the Joint Controllers), processes such data through automated means, on the basis of consent or for the purpose of providing services.

- Revocation of consent: if the processing is based on consent, you may revoke it at any time, without prejudice, however, to the lawfulness of the processing carried out prior to such revocation.

- Right to lodge a complaint with the Supervisory Authority: without prejudice to any other administrative or jurisdictional recourse, you have the right to lodge a complaint with the competent Supervisory Authority if you believe that the processing operations carried out violate the current legislation on the protection of personal data.

Any requests made, for the exercise of your rights, may be forwarded to the Joint Controllers by writing to the e-mail address indicated in paragraph 1 of this Notice.