Information pursuant to Legislative Decree 196/2003 and Articles 13-14 of the GDPR 2016/679
(General Data Protection Regulation)
Dear Sir or Madam,
pursuant to Legislative Decree 196/2003 and Articles 13-14 of EU Regulation 2016/679 (General Data Protection Regulation), and in relation to the information that will come into our possession, for the purposes of protecting people and other subjects regarding the processing of personal data, we inform you of the following:
- Purpose of Processing
Registration via the relevant accreditation application form for the Historic Carnival Event of Ivrea requires the entry of personal data (Art. 4 letter a Regulation 2016/679) like personal details, email address or telephone number.
The personal data collected will be used for purposes related to your roles as Journalists, PR, Bloggers, Photographers and Guests, as well as to any other Subject operating in the radio/television communication sector, so as to inform you about our events and for our initiatives in general, and to issue access documents for the Historic Carnival event of Ivrea.
Processing your data is necessary to pursue the legitimate interests of the Historical Carnival of Ivrea Foundation in informing you about our initiatives.
The personal data processed does not, therefore, require your consent.
At any time you will still be free to request removal from our mailing list, by writing to [email protected]
- Processing Methods
The data processing is performed with computer tools and/or on paper, by individuals committed to confidentiality, with logic related to the purposes and in any case to ensure the security and confidentiality of data.
The data collected will not be disclosed or disseminated to third parties, in accordance with the law.
- Data provision
The provision of data for the aforementioned purpose is mandatory, and the legal basis consists in satisfying a request formulated by you and fulfilling legal obligations. Any refusal to provide the Data will make it impossible for the Historic Carnival of Ivrea Foundation to satisfy your requests.
The Data collected by the Data Controller for this purpose may be kept for the limitation period provided for by the applicable legal, and fiscal, provisions.
- Communication and dissemination of data
Your personal data may be disclosed to third parties known to us exclusively for the aforementioned purposes, and in particular to the following categories of subjects:
– External companies and Professionals who perform services on our behalf (as duly appointed external managers);
– Entities and Public Administrations for any legal obligations;
- Data Controller
The Data Controller is the Historical Carnival of Ivrea Foundation, Antico Palazzo della Credenza, 10015 Ivrea (TO)
Tax Code 93037710014 | VAT No. 10210500012 | Economic and Administrative Index (REA) TO-1115870
For any communication pursuant to the abovementioned articles of EU Regulation 2016/679, the Data Controller provides the address: [email protected]
- Data subject rights
Pursuant to Articles 15 to 22 of EU Regulation No. 2016/679, you may, at any time, exercise the following rights:
– Right to access (Art. 15);
– Right to rectification (Art. 16);
– Right to erasure (Art. 17);
– Right to restrict processing (Art. 18);
– Right to data portability (Art. 20);
– Right to object to processing (Art. 21);
– Right to withdraw consent;
– Right to lodge a complaint with the Supervisory Authority.
Below, in detail, are the individual rights granted to the Data Subject:
RIGHT TO ACCESS – Art. 15
The Data Subject has the right to obtain, from the data controller, confirmation whether or not personal data processing concerning them is in progress, and if so, to obtain access to said personal data, as well as the following information:
a) the purposes of the processing;
b) the categories of personal data concerned;c) rec
ipients or categories of recipients to whom the personal data has been or will be disclosed, particularly if the recipients are in third countries or international organisations;
d) when possible, the retention period for the personal data provided or, if that is not possible, the criteria used to determine said period;
e) the existence of the data subject’s right to request, from the data controller, rectification or erasure of personal data, or restrictions on processing personal data concerning the data subject, or to object to its processing;
f) the right to lodge a complaint with a supervisory authority;
g) when the personal data is not collected from the data subject, any available information regarding its source;
h) the existence of automated decision-making, including profiling, referred to in Article 22, paragraphs 1 and 4, and, at least in those cases, meaningful information about the logic involved, as well as the significance and expected consequences of such processing for the data subject.
1. Where personal data is transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards, pursuant to Article 46, relating to the transfer.
2.The data controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
The right to obtain a copy must not adversely affect the rights and freedoms of others.
RIGHT TO RECTIFICATION – Art. 16
The data subject shall have the right to obtain, from the data controller, the rectification of inaccurate personal data concerning them, without undue delay. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by providing a supplementary statement.
RIGHT TO ERASURE – Art. 17
- The data subject shall have the right to obtain, from the data controller, the erasure of personal data concerning them without undue delay, and the data controller must delete such personal data without undue delay where any of the following grounds apply:
a) the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
b) The data subject withdraws the consent on which the processing is based in accordance with Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), and where there is no other legal basis for the processing;
c) The data subject objects to the processing pursuant to Article 21, paragraph 1, and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21, paragraph 2;d) the pe
rsonal data has been unlawfully processed;
e) the personal data must be deleted to fulfil a legal obligation required by Union or Member State law to which the data controller is subject;
f) the personal data has been collected in relation to the offer of services from an information company referred to in Article 8, paragraph
2. Where the data controller has made the personal data public and is obliged, pursuant to paragraph 1, to delete the personal data, said controller, taking into account the available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform the data controllers processing the personal data of the data subject’s request for erasure of any links, copies, or reproductions of their personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that the processing is necessary:
a) to exercise the right of freedom of expression and information;
b) to fulfil a legal obligation involving processing required by Union or Member State law to which the data controller is subject, or to perform a task carried out in the public interest, or to exercise the official authority vested in the data controller;
c) for reasons of public interest in the area of public health, in accordance with Article 9, paragraph 2, letters (h) and (i), and Article 9, paragraph 3;
d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89, paragraph 1, in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair achievement of the objectives of such processing; or
e) for the establishment, exercise, or defence of a right in court.
RIGHT TO RESTRICT PROCESSING – Art. 18
- The data subject shall have the right to obtain, from the data controller, restriction of processing where one of the following applies:
a) the accuracy of the personal data is contested by the data subject, for the period necessary for the data controller to verify the accuracy of that personal data;
b) the processing is unlawful and the data subject objects to erasure of the personal data, requesting instead restriction of its use;
c) although the data controller no longer needs the personal data for processing purposes, the personal data is required by the data subject to ascertain, exercise or defend a right in court;
d) the data subject objects to the processing pursuant to Article 21, paragraph 1, pending verification of the possible prevalence of the data controller’s legitimate reasons over those of the data subject.
- Where the processing has been restricted pursuant to paragraph 1, such personal data shall, with the exception of preservation, only be processed with the data subject’s consent or for the establishment, exercise or defence of a right in court, or protection of the rights of another natural or legal person, or for reasons of significant public interest for the Union or a Member State.
- The data subject who has obtained a processing restriction, pursuant to paragraph 1, shall be informed by the data controller before the processing restriction is lifted.
RIGHT TO DATA PORTABILITY – Art. 20
- The data subject shall have the right to receive the personal data concerning them, which they have provided to a data controller, in a structured, commonly used and machine-readable format, and have the right to transmit such data to another data controller without hindrance from the data controller to which the personal data was provided, where:
a) the processing is based on consent pursuant to Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), or on a contract pursuant to Article 6, paragraph 1, letter b); and
b) the processing is carried out by automated means.
2. In exercising their right to data portability in accordance with paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one data controller to another, where technically feasible.
3. The exercise of the right referred to in paragraph 1 of this article shall not affect the provisions of Article 17. Such a right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.
4.The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.
RIGHT TO OBJECT TO PROCESSING – Art. 21
- At any time, the data subject shall have the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them pursuant to Article 6, paragraph 1, letters e) or f), including profiling based on those provisions. The data controller will refrain from further processing of the personal data except where it is possible to demonstrate the existence of binding legitimate reasons to proceed with the processing, that prevail over the data subject’s interests, rights and liberties, or for the establishment, exercise or defence of a right in court.
- Where personal data is processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning them for such purposes, which include profiling to the extent that it is related to such direct marketing.
- Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
- The right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information, no later than the time of the first communication with the data subject.
- Within the context of the use of services of an information company, and notwithstanding Directive 2002/58/EC, the data subject may exercise their right to object by automated means using technical specifications.
- Where personal data is processed for scientific or historical research purposes or statistical purposes pursuant to Article 89, paragraph 1, the data subject, based on their particular situation, shall have the right to object to processing of personal data concerning them, unless the processing is necessary to perform a task carried out for reasons in the public interest.
In addition to the aforementioned rights, the data subject has the right to lodge a complaint with the Supervisory Authority in the cases provided for by law.