Privacy Policy

Data Controller

The Data Controller is Federlegno Arredo Eventi S.p.A., with registered office in Milan, Foro Buonaparte no. 65, tax code and registration number in the Milan Business Register: 06987590152, e-mail  privacy@federlegnoarredo.it (hereinafter “Data Controller” or “FLA Eventi”).

Data Protection Officer (hereinafter referred to as “DPO”)

The Data Protection Officer is TZ&A Studio Associato (hereinafter also referred to as the “DPO”).
To exercise your rights and for any communication, problem and/or request for clarification regarding the protection of your personal data, feel free to contact the DPO at the address dpoflaeventi@studiotza.it

Purpose

Legal basis for the processing

Management of the data provided for the purpose of registering for the Event and purchasing the ticket, and compliance with the related legal and tax obligations

(Art. 6(1)(b) GDPR)
Fulfilment of a contract 
(Art. 6(1)(c) GDPR)
Processing necessary to comply with a legal obligation to which the Data Controller is subject

Management of the data provided for the purpose of registering on the Site and digital events and the use of related services, including publishing

(Art. 6(1)(b) GDPR)
Fulfilment of a contract

Archiving and storing of data, sending of information and communications, including electronic communications, requested by you through the Site, sending of information and documents relating to the relationship with FLA Eventi

(Art. 6(1)(b) GDPR)
Fulfilment of a contract 
(Art. 6(1)(c) GDPR) 
Processing necessary to comply with a legal obligation to which the Data Controller is subject
(Art. 6(1)(f) GDPR)
Processing necessary for the pursuit of the lawful interest of the Data Controller related to the organizational and administrative management of its organization

Purpose

Legal basis for the processing

Commercial and direct marketing activities through the transmission to the contacts provided by you of communications relating to services similar to those already supplied, provided that you do not refuse such use initially or in response to subsequent communications

(Art. 6(1)(f) GDPR)
Processing necessary for the pursuit of the lawful interest of the Data Controller related to its organizational and commercial management

Anonymous surveys to measure the level of satisfaction with the digital experience on the Salone del Mobile.Milano website/app

(Art. 6(1)(f) GDPR)
Processing necessary for the pursuit of the lawful interest of the Data Controller to verify and improve the quality of its services

Anonymous surveys aimed at measuring the level of satisfaction with visitors’ trade fair experience

(Art. 6(1)(f) GDPR)
Processing necessary for the pursuit of the lawful interest of the Data Controller to verify and improve the quality of its services

Purpose

Legal basis for the processing

Transfer of your data to the subjects participating in the Event as exhibitors (hereinafter, “Exhibitors”) for their autonomous processing for promotional purposes and marketing activities, with the provision of material and news regarding the Exhibitors and their activities, services, products, promotions, initiatives, facilitations and other information, also through the sending of specific material in paper and/or electronic form (including by means of newsletters) and/or telephone.

(Art. 6(1)(a) GDPR) 
Consent of the data subject 
The interested party expresses consent when he/she presents and permits the Exhibitor to scan the QR code affixed to the entrance ticket to the Event.
Following the scanning of the QR code, the personal data will be transferred to the Exhibitor, who will process it as an independent data controller for promotional and marketing purposes.

Promotional and marketing – with the provision of materials and editorial content concerning the Exhibitors and the commercial partners of the Event (such as institutional partners, official partners, media partners and official time keepers), their services, products, activities and initiatives, as well as promotional materials and content of FLA Eventi (including new services, products, promotions, trade fairs, initiatives organized and/or sponsored by FLA Eventi, concessions and other information), by telephone and/or by sending specific material in paper and/or electronic form, including by means of newsletters.

(Art. 6(1)(a) GDPR) 
Consent of the data subject

Profiling and processing of your personal data, preferences, habits and interests (such as, for example, purchase data, including ticket data, visits and activities performed during the Event, monitoring of the newsletter, browsing data) with automated methods in order to identify and offer the most appropriate services, products and benefits that meet your needs, including by sending personalized communications, market research and/or surveys.

(Art. 6(1)(a) GDPR) 
Consent of the data subject

Third parties or categories

Purpose

Notes

IT companies

Management, maintenance, updating of the systems and software used by the Data Controller

Providers of networks, electronic communications services and IT and telematics services for the computer storage, storage and processing of data

Hosting, housing, Cloud, SaaS and other remote IT services essential for the provision of the Data Controller’s activities; archiving and preservation services in accordance with the law for electronic documents

Cloud services may involve data processing in non-EU countries; in this case we guarantee that the data will be suitably protected.

Subjects that FLA Eventi uses in various capacities for the organization of the Event and the services offered through the Site

Organizational, administrative, financial and accounting management

Subjects used by FLA Eventi for managing surveys and market reserach

Survey management and market research

Consultants, professionals, law firms, arbitrators.

Judicial, extrajudicial and insurance activities in case of claims
Organizational, administrative, financial and accounting management

Supervisory and control authorities and bodies and, in general, public or private entities with public functions

To comply with the relevant laws and legal processes and respond to requests from the competent authorities

Personal data and documents

Retention period or criteria for determining it

Personal data and documents relating to the relationship with the Data Controller.

For the duration necessary for the pursuit of the purposes of the processing and also subsequently, within the limits allowed by law, for administrative and accounting purposes, as well as to assert or protect the rights of the Data Controller, where necessary

Data collected and processed as part of satisfaction surveys

For the duration necessary to pursue the purposes of the processing.

Contact details for promotional and marketing purposes, newsletters, invitations to events detailed more fully above

For the duration necessary to pursue the purposes of the processing and, in any case, for a period not exceeding five years from your last interaction with the Data Controller. Events that identify this “interaction” may include, but are not limited to, accessing your personal area of the Site, purchasing a ticket to the Event, or participating in a survey.

Profiling

For the duration necessary to pursue the purposes of the processing and, in any case, for a period not exceeding 18 months.

Right

Description

Right to withdraw consent 
(art. 13, paragraph 2, letter c)

You have the right to withdraw consent for processing for which it is requested, without affecting the lawfulness of processing based on consent before its withdrawal

Right of access to data (art. 15)

You may request: a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; (d) where possible, the period envisioned for which the personal data will be retained or, if this is not possible, the criteria used to determine that period; e) the existence of the right of the data subject to request from the controller the rectification or deletion of personal data or the restriction of the processing of personal data concerning him or her, or to object to its processing; f) the right to lodge a complaint with a supervisory authority; g) if the data is not collected from the data subject, all available information on its source; (h) the existence of automated decision-making, including profiling as referred to in Article 22(1) and (4), and, at least in such cases, meaningful information about the logic used, as well as the significance and expected consequences of such processing for the data subject. 
You have the right to request a copy of the personal data being processed.

Right to rectification (Art. 16)

You have the right to request the rectification of inaccurate personal data concerning you and to obtain the completion of incomplete personal data

Right to be forgotten (Art. 17)

You have the right to obtain from the Data Controller the deletion of personal data concerning you if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed

Right to restriction of processing (Art. 18)

You have the right to obtain from the Data Controller the restriction of processing when you have contested the accuracy of the personal data (for the period necessary for the Data Controller to verify the accuracy of such personal data), or if the processing is unlawful, but you oppose the deletion of the personal data and instead request that its use be restricted or if it is necessary for the establishment, the exercise or the defense of a right in court, while the Data Controller no longer requires it.

Right to portability (art. 20)

You have the right to receive the personal data that supplied to us concerning you in a structured, commonly used and machine-readable format and you have the right to transmit it to another controller if the processing: (i) was based on consent, (ii) on a contract, and (iii) if the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of an official authority, and such disclosure does not adversely affect the rights of a third party.

Right to object (Art. 21)

You have the right at any time to object, in whole or in part, to the processing of your personal data if the processing is carried out in the pursuit of a lawful interest of the Data Controller or if the processing is carried out for direct marketing purposes.