PRIVACY POLICY - WEBINAR

Pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)

1. DATA CONTROLLER

The Data Controller of personal data is:

EXOR INTERNATIONAL S.P.A.
VAT No. 01990710236
Registered office: Via Monte Fiorino no. 13, San Giovanni Lupatoto (VR), Italy
E-mail: privacy.it@exorint.com
Certified e-mail (PEC): exorint@pec.exorint.com

To exercise the rights referred to in this notice or for any request concerning the processing of personal data, the data subject may contact the Data Controller using the contact details indicated above.

2. PURPOSES AND LEGAL BASES OF THE PROCESSING

The personal data collected through the webinar registration form will be processed for the following purposes, each based on a specific legal basis pursuant to Article 6 of the Regulation.

2.1 Webinar registration management and related activities

Purpose: Registration of the data subject for the webinar, sending access credentials, sending organizational and technical communications relating to the event (e.g. registration confirmation, access link, any changes or cancellations), as well as handling any support requests.
Legal basis: Performance of a contract or implementation of pre-contractual measures taken at the request of the data subject (Article 6(1)(b) GDPR).

2.2 Compliance with legal obligations

Purpose: Compliance with obligations laid down by applicable law (tax, accounting, administrative), where applicable.
Legal basis: Compliance with a legal obligation (Article 6(1)(c) GDPR).

2.3 Sending promotional and marketing communications (subject to prior consent)

Purpose: Sending commercial, informational and promotional communications relating to events, webinars, products and services offered by EXOR INTERNATIONAL S.P.A. or by companies belonging to the same corporate group, by e-mail and other distance communication channels.
Legal basis: The data subject’s express and specific consent (Article 6(1)(a) GDPR). Consent is freely given, specific, informed, and may be withdrawn at any time without affecting the lawfulness of processing carried out before the withdrawal.

Please note that consent to processing for marketing purposes is optional and does not in any way affect the possibility of using the webinar registration service.

2.4 Newsletter subscription (subject to prior consent)

Purpose: Sending periodic commercial, informational and promotional communications relating to events, webinars, products and services offered by EXOR INTERNATIONAL S.P.A. or by companies belonging to the same corporate group, by e-mail.
Legal basis: The data subject’s express and specific consent (Article 6(1)(a) GDPR). Consent is freely given, specific, informed, and may be withdrawn at any time without affecting the lawfulness of processing carried out before the withdrawal.

Please note that consent to processing for newsletter subscription purposes is optional and does not in any way affect the possibility of using the webinar registration service.

3. CATEGORIES OF PERSONAL DATA PROCESSED

For the purposes described above, the following personal data will be processed:

• Identification and contact data: first name*, last name*, e-mail address*, telephone number (where provided);
• Professional data: company and country of the registrant*, professional role/job title*;
• Browsing data: technical data connected with access to and participation in the webinar (e.g. IP address, connection logs).
• Tracking Pixels: tracking pixels are tiny graphic images, invisible to the user, embedded in web pages or within our newsletters. The Data Controller may activate tracking pixels to verify, for example, whether the data subject has opened emails. We use these tools to collect aggregated and anonymous (or pseudonymized) statistical data, such as the number of visits to a page, browsing behavior, the type of browser used, and whether a sent e-mail has been opened or internal links have been clicked. The data subject may easily object to such processing according to the methods indicated by the Data Controller, depending on the case.

4. DISCLOSURE OF DATA TO THIRD PARTIES AND RECIPIENTS

The data subject’s personal data may be disclosed or made accessible to the following categories of recipients:

• Group companies: subject to the expression of an additional specific consent, the data may be disclosed to companies belonging to the same corporate group as EXOR INTERNATIONAL S.P.A., exclusively for the purposes referred to in sections 2.1, 2.3 and 2.4, within the limits and under the conditions described in this notice;
• Technology service providers: third parties providing platforms for webinar management and delivery (e.g. video conferencing platform providers), appointed as external Data Processors pursuant to Article 28 GDPR;
• E-mail delivery service providers and CRM providers: entities managing electronic communications on behalf of the Data Controller, likewise appointed as Data Processors;
• Public authorities and supervisory bodies: in the cases provided for by law or upon request by the competent authorities.

Personal data will not be disseminated to third parties. The updated list of appointed Data Processors is available upon request addressed to the Data Controller.

5. TRANSFER OF DATA TO THIRD COUNTRIES

Where webinar platform providers or other Data Processors are based in, or transfer data to, countries outside the EU/EEA, such transfer shall take place in compliance with the safeguards provided for by the GDPR, such as an adequacy decision of the European Commission or Standard Contractual Clauses pursuant to Article 46 GDPR.

6. DATA RETENTION PERIOD

Personal data will be retained for the time strictly necessary to achieve the purposes for which they were collected, and in particular:

• Webinar registration management
  For the duration of the event and, thereafter, for the time necessary to handle any post-event requests; in any case, no longer than 12 months from the date of the webinar, unless otherwise required for documented reasons.
• Compliance with legal obligations, where applicable
  For the periods provided for by applicable law (e.g. 10 years for tax and accounting documents).
  
• Marketing and promotional communications (contact us)
  Until consent is withdrawn and, in any case, no longer than 24 months from the collection of consent or from the data subject’s last interaction.
  
• Newsletter subscription
  Until consent is withdrawn.
  Upon expiry of the above retention periods, the data will be deleted or irreversibly anonymized.
  

7. RIGHTS OF THE DATA SUBJECT

The data subject has the right to exercise, at any time and free of charge, the following rights vis-à-vis the Data Controller, pursuant to Articles 15–22 GDPR:

• Right of access (Article 15 GDPR): to obtain confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to such data and the information relating to the processing;
• Right to rectification (Article 16 GDPR): to obtain the rectification of inaccurate or incomplete personal data;
• Right to erasure (Article 17 GDPR): to obtain the erasure of personal data in the cases provided for by law;
• Right to restriction of processing (Article 18 GDPR): to obtain restriction of processing in the cases provided for by law;
• Right to data portability (Article 20 GDPR): to receive the personal data provided to the Data Controller in a structured, commonly used and machine-readable format, in the cases provided for by law;
• Right to object (Article 21 GDPR): to object at any time to the processing of personal data, in particular where the processing is carried out for direct marketing purposes;
• Right to withdraw consent (Article 7(3) GDPR): to withdraw at any time the consent given for marketing, without affecting the lawfulness of processing carried out before such withdrawal.

To exercise these rights, the data subject may send a request to the Data Controller using the contact details indicated in section 1. The Data Controller undertakes to respond without undue delay and, in any event, within 30 days of receipt of the request, extendable by a further 60 days in cases of particular complexity.

8. RIGHT TO LODGE A COMPLAINT

The data subject has the right to lodge a complaint with the competent supervisory authority, which in Italy is the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), with registered office at Piazza Venezia no. 11, 00187 Rome (www.garanteprivacy.it), if he or she believes that the processing of personal data has been carried out in breach of the GDPR.

9. NATURE OF THE PROVISION OF DATA AND CONSEQUENCES OF FAILURE TO PROVIDE DATA

The provision of the personal data marked with an asterisk (*), which are necessary for managing registration for the webinar, is mandatory: failure to provide such data will make it impossible to complete the registration or participate in the event.

The provision of data for marketing purposes is, instead, optional: refusal to give the relevant consent will have no consequence on the possibility of registering for and participating in the webinar.

10. AUTOMATED DECISION-MAKING

The Data Controller does not carry out decisions based solely on automated processing which produce legal effects concerning the data subject or similarly significantly affect him or her, pursuant to Article 22 GDPR.