This privacy notice is provided to data subjects who, in the context of events, exhibitions, and initiatives, interact with stands, information desks, or exhibition areas by completing questionnaires, data collection forms, or participating in promotional or engagement activities, including those related to the distribution of gadgets or participation in interactive initiatives.
The data provided will be processed by the Torino Chamber of Commerce, with registered office in Torino, Via Carlo Alberto no. 16, tel. +39 011 57161, contactable at the following email address: protocollo.generale@to.legalmail.camcom.it (also enabled to receive ordinary emails), and by Turismo Torino e Provincia s.c.r.l., with registered office in Via Maria Vittoria no. 19, Torino (TO), contactable at the following email address: privacy@turismotorino.org.
The two entities may act jointly as Joint Controllers of the processing, or independently as separate Data Controllers, depending on the specific purposes of the processing.
Both entities have appointed a Data Protection Officer (DPO), pursuant to Article 37 of Regulation (EU) 2016/679 (GDPR).
- The DPO of the Torino Chamber of Commerce can be contacted at: rpd1@pie.camcom.it (also enabled to receive certified email/PEC).
- The DPO of Turismo Torino can be contacted at: dpo@turismotorino.org.
Purposes and Legal Bases of Processing Carried Out as Joint Controllers
- Management of participation/registration for activities (promotional activities, games, or initiatives)
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) - Conducting statistical surveys and administering satisfaction questionnaires aimed at improving services and promoted initiatives
Legal basis: legitimate interest of the Joint Controllers (Art. 6(1)(f) GDPR) - The contact details provided may be used to send purely informational, organizational, and service-related communications, strictly connected to participation in the activity or event.
Legal basis: legitimate interest of the Joint Controllers (Art. 6(1)(f) GDPR)
Purposes and Legal Bases of Processing Carried Out as Independent Controllers
- The contact details provided may be used to send informational and promotional communications, including newsletters, relating to activities and initiatives independently promoted by the Torino Chamber of Commerce and Turismo Torino e Provincia.
Legal basis: specific consent (Art. 6(1)(a) GDPR)
Authorized Persons and Data Processors
Personal data will be processed by personnel of the Torino Chamber of Commerce and Turismo Torino who have been previously authorized to process the data and appropriately instructed and trained.
The data may also be processed by external parties formally appointed by the Torino Chamber of Commerce and/or Turismo Torino as Data Processors pursuant to Article 28 GDPR, in particular entities belonging to the following categories:
- companies providing management and maintenance services for IT systems, particularly document storage services;
- other companies specialized in digital services, the creation of informational or promotional campaigns, and the administration of online questionnaires;
- companies entrusted with organizing the activities within which the processing operations are carried out.
Data Retention Period
Personal data will be processed for the entire duration of the activity, taking into account the nature of the activity itself.
With reference to the purpose indicated in point 3, contact details will be processed for a period of 12 months. The data subject retains the right to object to the processing at any time.
As regards the sending of informational and promotional communications, including newsletters, the data will be processed until consent is withdrawn or until the right to object is exercised by the data subject.
Nature of Data Provision and Consequences of Failure to Provide Data
Providing personal data is necessary to allow registration and participation in the engagement activities offered at the stands (e.g. participation in initiatives, games, distribution of gadgets, completion of questionnaires). Failure to provide the data required for these purposes will make it impossible to participate in such activities.
Providing data for the purpose of sending informational and promotional communications (newsletters) is optional and subject to the granting of specific consent.
Such communications are sent independently by each entity, acting as Data Controller, with reference to their respective activities.
Failure to provide consent for marketing purposes does not in any way affect participation in engagement activities.
Transfer of Data to Non-EU Countries
The Joint Controllers do not directly transfer personal data to third countries or international organizations. However, they reserve the right to use cloud-based services. In such cases, data transfers will take place exclusively to providers operating in countries deemed adequate pursuant to Article 45 GDPR, that have adhered to the EU-US Privacy Framework, or that provide the safeguards set out in Article 46 GDPR.
Further information regarding data transfers and/or a copy of the safeguards adopted may be obtained by contacting the Data Controller.
Your RIGHTS
Regulation (EU) 2016/679 grants several rights that the data subject may exercise by contacting the Data Controller or the DPO using the contact details provided in this notice.
The rights that may be exercised, where the legal requirements are met from time to time (in particular pursuant to Articles 15 et seq. of the Regulation), include:
- the right to know whether personal data concerning you is being processed and, if so, to obtain access to the data and all related information;
- the right to rectification of inaccurate personal data concerning you and/or completion of incomplete data;
- the right to erasure of personal data concerning you;
- the right to restriction of processing;
- the right to object to processing;
- the right to data portability concerning you;
- the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
For further information on your rights, or to submit a request to exercise such rights, you may contact either of the Joint Controllers or their respective DPOs using the contact details provided above. In any case, the data subject also has the right to lodge a formal complaint with the Italian Data Protection Authority, according to the procedures available on the website:
Italian Data Protection Authority