Privacy Notice – Personal Data Processing
Pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)
If you are considering purchasing a product or booking an activity related to:
- Cioccolatò – 2026 Edition
- NITTO ATP Finals
- Welcome Tour – Your First Time in Torino
we hereby inform you, in accordance with the applicable legislation on the protection of personal data, that your data will be processed as described below.
The personal data provided will be processed by the Torino Chamber of Commerce, headquartered at Via Carlo Alberto 16, Torino, tel. +39 011 57161, email: [email protected] (this address can also receive ordinary emails), and by Turismo Torino e Provincia s.c.r.l., headquartered at Via Maria Vittoria 19, Torino (TO), email: [email protected].
The two entities may operate jointly as Joint Controllers or independently as Separate Controllers, depending on the specific purposes of the processing. Both have appointed a Data Protection Officer (DPO) pursuant to Article 37 of Regulation (EU) 2016/679 (GDPR):
- The DPO of the Torino Chamber of Commerce can be contacted at [email protected] (this address can also receive PEC emails).
- The DPO of Turismo Torino can be contacted at [email protected].
1. Purposes and Legal Bases of Processing as Joint Controllers
The personal data provided will be processed by the Joint Controllers for the following purposes:
a) Managing the purchase or booking request for the product, service, or activity, including the possible issuance of a card or pass for access, as well as assistance and post-purchase communications with the user;
b) Organising and managing participation in the purchased activities or services, including ancillary activities necessary for setting up the initiative. This includes, for example, managing bookings, providing assistance during the experience, and sending organisational or product/service-related communications;
c) Sending informational and promotional communications regarding the event in the reference year and any subsequent edition, including communication activities as agreed by the Joint Controllers;
d) Conducting satisfaction surveys, customer feedback, and follow-ups relating to the event, aimed at improving the participant’s experience, event quality, and planning for possible future editions.
The legal basis for purposes a) and b) is the performance of a contract to which the data subject is party and/or the performance of a task carried out in the public interest or in the exercise of official authority. The legal basis for purpose c) is the data subject’s consent; for purpose d) it is the Joint Controllers’ legitimate interest (Article 6(1)(f) GDPR).
Please note that, during the event, additional personal data may be collected, such as testimonials, images, and photo/video recordings, which may be used for promotional purposes through publication on institutional social media channels, newsletters, and other communication tools. Such processing will be based on consent, which will be requested during participation in the event. A specific privacy notice will be provided in this regard, using the most appropriate methods.
2. Purposes and Legal Bases of Processing as Separate Controllers
Torino Chamber of Commerce – also through management and analytics software – may process personal data for:
- Sending information and periodic updates regarding the Chamber’s activities to promote awareness and facilitate access to its services;
- Sending targeted communications, including newsletters or dedicated mailing lists, regarding opportunities, financial benefits, events, and services on topics of interest selected by the data subject;
- Sending communications on opportunities, events, and services related to the data subject’s specific sector of activity;
- Sending anonymous surveys aimed at conducting statistical research and proposing new services.
The legal basis for these purposes is the data subject’s consent.
Turismo Torino may process personal data for:
- Managing payments, invoicing, and reporting activities related to the sale of the purchased product, and any related payment management communications;
- Sending informational, institutional, and promotional communications, including newsletters, regarding initiatives, events, activities, and services promoted or independently organised by Turismo Torino;
- Conducting research and statistical analyses – including through surveys – to assess the impact of initiatives and/or to define strategies for the development and improvement of the local tourism offer.
The legal basis for purpose 1 is compliance with a legal obligation and/or the performance of a contract; for purpose 2 it is the data subject’s consent. For purpose 3, the legal basis is the performance of a task carried out in the public interest, pursuant to Article 6(1)(e) GDPR. In any case, the data subject has the right to object at any time to processing for this purpose, as provided by Article 21 GDPR.
3. Authorised Personnel and Data Processors
Personal data will be processed by personnel of the Torino Chamber of Commerce and Turismo Torino who are duly authorised and specifically trained.
Data may also be processed by external parties formally appointed by the Torino Chamber of Commerce and/or Turismo Torino as Data Processors pursuant to Article 28 GDPR, including:
- Companies providing IT system management and maintenance services, in particular document archiving services;
- Companies providing telecommunication services, in particular email services;
- Other companies specialised in digital services, possibly engaged for website management, implementation of information or promotional campaigns, or online survey administration;
- Companies in charge of organising the event/initiative.
4. Data Retention Period
Personal data will be processed for the entire duration of the initiative and for the time necessary to fulfil administrative, reporting, or legal obligations, and in any case no longer than five years after the conclusion of the event, unless different terms are imposed by applicable law.
For the sending of informational and promotional communications, including newsletters, data will be processed until consent is withdrawn or the right to object is exercised by the data subject.
5. Nature of Data Provision and Consequences of Failure to Provide Data
Providing personal data is mandatory for managing the product, service, or activity with regard to the purposes listed under points a) and b) above, as well as for fulfilling related legal obligations. For all other purposes, providing data is optional.
6. Data Transfers to Non-EU Countries
As mentioned above, the Torino Chamber of Commerce and Turismo Torino, including through their Data Processors, may use IT and electronic communication service providers which, in the course of their assigned activities, could transfer or route personal data to countries outside the European Economic Area (EEA).
These providers are selected according to strict criteria, including certifications, compliance statements, and guarantees regarding security, reliability, and compliance with EU and national data protection regulations.
In any case, the transfer of personal data outside the EEA will only take place to countries for which the European Commission has issued an adequacy decision, or will be governed by the European Commission’s Standard Contractual Clauses, in compliance with Article 46 GDPR, in order to ensure an adequate level of protection for personal data.
7. Your Rights
Regulation (EU) 2016/679 grants various rights that the data subject may exercise by contacting the Controller or the DPO at the addresses indicated in this notice.
Provided the conditions set forth by the legislation are met (in particular, Articles 15 et seq. of the Regulation), these rights include:
- The right to know whether personal data concerning them are being processed, and, if so, to access such data and all related information;
- The right to rectification of inaccurate personal data and/or to have incomplete data completed;
- The right to erasure of personal data;
- The right to restriction of processing;
- The right to object to processing;
- The right to data portability;
- The right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
For more information on your rights or to submit a request to exercise them, you may contact one of the Joint Controllers or their respective DPOs using the contact details provided above. In any case, you also have the right to lodge a complaint with the Italian Data Protection Authority (“Garante per la protezione dei dati personali”), according to the procedures available on its website: www.garanteprivacy.it/.