Privacy Policy
Information in accordance with Article 13 of the EU Regulation 2016/679 for the personal data protection (GDPR)
PARTICIPANTS
In accordance with Article 13 of the EU Regulation 2016/679 (hereinafter "GDPR"), Stairway to Event sas di Ivana Cerato (hereinafter referred to as "Stairway" or the "Data Controller") - with registered office in Via Bargagna 60, Pisa, Italy - in the capacity of Data Controller, in the person of its legal representative, informs you that your personal data will be processed by Stairway itself by means of manual, electronic or automated processing, computer or telematic tools, with logics strictly related to the purposes listed below and, in any case, in such a way as to ensure data security and confidentiality.
Identity and contact details of the Data Controller and Data Protection Officer
The Data Controller is Stairway, in the person of its legal representative pro tempore, with registered office in Via Bargagna 60, Pisa.
You may contact Data Controller in order to exercise your rights or to obtain information on the same and/or on this Privacy Policy, by writing to Stairway, Via Bargagna 60 Pisa or by sending an e-mail to info@stairwaytoevent.com.
Purpose and lawfulness of processing
Your personal data are processed by the Controller in accordance with Article 6 of the GDPR. The specific purposes of processing and their legal bases are set out below:
| Finalità di trattamento Base giuridica del trattamento | Base giuridica del trattamento |
|---|---|
| Management of invitations for event organisation and video photo shoots as part of the same events. | Pursuit of the legitimate interest of the data controller or third parties |
| Management of corporate events with regard to the processing of special data | Express consent to the processing of personal data |
| Transfer to third parties (i.e. business partners, sponsors, companies present at the organised event) of your identification and contact data for marketing purposes | Express consent to the processing of personal data |
Nature of conferment and consequences of refusal
The provision of data, the lawfulness of which is based on the legitimate interest of the responsible for the processing, is necessary for participation in the event, so any refusal will result in the objective impossibility of pursuing the relevant processing purpose (paragraph "Purpose, legal basis and lawfulness of processing"). In fact, occasionally your personal data such as photos and images may be acquired (e.g. for events such as company conventions and promotional videos): such data may be used for internal or external purposes, including for purposes related to the promotion of the Company's image and its initiatives towards customers and dealers.
The provision of data whose lawfulness is based on consent is instead optional and presupposes your consent, which can always be revoked in the manner described below. In fact, such data may be acquired in order to propose personalised menus in the event of food intolerances or allergies or to facilitate participation in events in the case of differently abled persons. In the event that these data are not provided, the processing would still be carried out, but it would not be possible to take advantage of these services.
For such activities Stairway may make use of external companies, to which it transmits your personal data, including any images or videos, in full compliance with the legal provisions.
Categories of data recipients
1 Promotional activities and in-depth technical information on products mainly addressed to partners and customers.
The personal data provided may be disclosed to third parties, such as event organisation companies, photographers and videomakers and hotel and/or catering establishments, industry partners, as well as partners and sponsors attending events.
All subjects belonging to the categories to which the data may be communicated will use them as "Data Processors" specifically appointed by Stairway, pursuant to art. 28 of the GDPR or as autonomous "Data Controllers".
The data will also be processed by persons specifically authorised to process them by the Data Controller, in accordance with the GDPR. Images and recordings of the event may be subject to dissemination by Stairway through publication on the company website and social networks.
Transfers outside the EU
For the pursuit of the processing purposes described above, your personal data may be transferred to the above-mentioned recipients in Italy and abroad.
Under no circumstances will your personal data be transferred outside the EU.
Personal data retention period
The personal data processed by the Data Controller will be stored at the registered office of Stairway for the time necessary to perform the service. Thereafter, the data will be stored until the statute of limitations provided for by law with reference to the individual rights that can be enforced. After such term, your data will be anonymised or cancelled, unless their storage is necessary for other and different purposes provided for by express provision of law.
Below are the details of the data retention period for the purposes described above, i.e. the criteria used to determine this period:
| Purpose | Category of personal data | Retention period |
|---|---|---|
| Management of invitations for event organisation and video photography as part of the same events.Management of company events in relation to the processing of special data |
|
For the duration of the event and for a maximum of 12 months thereafter |
| Transfer to third parties (i.e. business partners, sponsors, companies present at the organised event) of your identification and contact data for marketing purposes |
|
12 months after collection |
| Management of invitations for event organisation and video photography at the events themselves | Photographs and video filming | 1 year from the date of the event subject to interest related to the company's history |
Automated decision-making process
For the pursuit of the processing purposes described above, no decision is made solely on the basis of automated processing which produces legal effects concerning you or which affects you in a similarly significant way.
Rights of the data subject
Pursuant to and for the purposes of the GDPR, you are granted the following rights as Data Subject that you may exercise towards Stairway
(a) access to and confirmation as to whether or not personal data concerning you are being processed, also in order to be aware of the processing and to verify the lawfulness as well as the correctness and updating of such data. In this case, you will be able to obtain access to your personal data and to your information, in particular to information relating to the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, the storage period, etc;
b) the rectification, where inaccurate, of personal data concerning you, as well as the integration of the same where they are considered incomplete, always in relation to the purposes of the processing. During this period, the Controller undertakes not to present the data as certain or definitive, especially to third parties;
c) the cancellation of data concerning you, if the data are no longer necessary in relation to the purposes for which they were collected. Please note that deletion is subject to the existence of valid reasons. If the Data Controller has communicated data concerning you to other Data Controllers or Data Processors, it is obliged to delete them, taking reasonable measures, including technical measures, to inform other Data Controllers who are processing the personal data in question to delete any links, copies or reproductions thereof (so-called right 'to be forgotten'). Deletion may not be carried out if the processing is necessary, inter alia, for compliance with a legal obligation or the performance of a task carried out in the public interest and for the establishment, exercise or defence of legal claims;
(d) limitation of processing. Limitation of processing means, among other things, the possibility of transferring the processed data to a system that is no longer accessible, for storage only and unchangeable. This does not mean that the data are deleted, but that the Controller must avoid using them during the period of the relevant blocking. This would be particularly necessary in the event that persistent use of inaccurate and unlawfully stored data could harm you. In such a case, you may object to the deletion of personal data and instead request that their use be restricted. In the case of rectification of data or objection, you may request the restriction of the processing of that data for the period during which the data controller is rectifying the data or evaluating the objection request. A further case is where the personal data are necessary for you to establish, exercise or defend a right in court, but the Controller no longer needs them for processing purposes;
e) the right to object, at any time, on grounds relating to your particular situation, to the processing of personal data concerning you where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller or where the processing is necessary for the purposes of the legitimate interests of the Controller or a third party. Finally, the Data Controller undertakes to refrain from processing your data unless it can demonstrate that there are compelling legitimate grounds for processing or for the establishment, exercise or defence of a legal claim;
f) the right to revoke consent at any time without prejudice to the lawfulness of the processing based on consent given before revocation, only for the purposes whose legal basis is consent. These rights may be exercised by contacting Stairway by means of a request sent by registered letter to the following address: Via Bargagna 60, Pisa, or by sending an e-mail to the e-mail address: stairway@pec.stairwaytoevent.com You may also promptly report to the company, through the above-mentioned contact details, any circumstances or events from which a breach of personal data (i.e. any breach of security capable of leading, accidentally or unlawfully, to the destruction, loss, alteration, unauthorised disclosure of or access to the data) may arise, even if only potentially, in order to allow an immediate assessment and, where necessary, the adoption of actions to counter such an event. Finally, please note that you have the right to lodge a complaint with the Italian Data Protection Authority or other supervisory authority pursuant to Article 13(2)(d) of the GDPR.