1. Data Controller and Data Protection Officer’s contact (DPO)

The data controller are Veronafiere S.p.A. Viale del Lavoro, 8, 37135 Verona VR, tel. 045 8298111 – Fax 045 82 98 288, e-mail: info@veronafiere.it (hereinafter, also the “Companies” or the “Data Controller”).

The DPO is available at the following email address: dpo@veronafiere.eu.

Purpose of the processing, legal bases and retention periods

Your data will be processed by the Companies for the purposes related to the purchasing of the ticket, the formation and execution of the contract between You and the Companies.

The legal basis for the processing is the execution of the contract.

Your data will be further processed to fulfill administration/accounting requirements, such as accounts and treasury management, invoicing (e.g. logging and checking invoices) in accordance with what applicable legislation requires, or for the fulfilment of legal, regulatory or EU imposed obligations.

In such case, the legal basis for the processing by the Companies is the necessity to comply with a legal obligation to which the Companies itself is subject.

Your data may be further processed to exercise and/or protect Companies’ rights in a judicial proceeding. In this case the legal basis for the processing is the legitimate interest of the Companies. In case of litigation, data will be retained for the entire duration of the litigation and in addition, until the limitation period foreseen for an appeal has expired.

Your data will be retained for the entire duration of the contract and, upon termination or expiration, for 10 years.

Your data, including your image, will be processed by Verona Fiere Spa through a CCTV system: for visitors’ safety and security reasons during the exhibitions, for Veronafiere real estate protection reasons in particular considering the great soil extension of the fair pavilions which remain partially unattended at night hours between the period from one exhibition to another; for exhibitors’ assets protection reasons at night hours during the exhibitions periods; for safety reasons during assembly and disassembly of the stands and of the equipment in general during the periods before and after the exhibitions; for unauthorised accesses prevention reasons in the perimeter of the entire fair and in the exhibitions areas. The processing of the images collected through the CCTV system will be performed pursuant to Art. 3.1 of the CCTV Decision produced by the Italian Data Protection Authority (hereinafter “CCTV Decision”) until such Decision will be modified, repealed or updated by the Authority, Data subjects are duly informed about the processing through specific signs in the areas subject to video surveillance.

In such case, the legal basis for the processing by the Companies is the legitimate interest.

The detected images are recorded and retained for a period not longer than one week with the exception of special needs of further retention applicable in case of festivities or during office closed hours, as well as in the case where a specific investigative request by the Judicial Authority or by the police, in accordance with what foreseen by the CCTV Decision.

Once the above data retention terms have expired, data will be destroyed or anonymized, compatibly with the technical procedures of cancellation and backup.

Based on Your consent, Your data will be further processed for the following reasons:

• To send communications, information, newsletters, research, and advertising materials, even customized, regarding the exhibitions organized by the Companies, and to perform market surveys using automated contact means (email, fax) as well as traditional (paper mail, operator-assisted phone calls);
• To send communications, information, newsletters, research, and advertising materials, even customized, regarding specific products and services of others using automated contact means (e-mail, fax) as well as traditional contact means (paper mail, operator-assisted phone calls).

Data will be retained until You revoke Your consent.

Once the above data retention terms have expired, data will be destroyed or anonymized, compatibly with the technical procedures of cancellation and backup.

Personal data provision

The provision of personal data marked with an asterisk in the filling form is compulsory. In case of failure to provide these data, the Companies will not be able to execute the related ticket purchase contract or to validate the related card. The provision of personal data non market with an asterisk in the filling form is completely optional.

Categories of subjects to whom the data may be communicated

Your personal data will be processed by the employees and/or collaborators of the Data Controller which have received appropriate operative instructions and which have been expressly authorized for the processing.

Your personal data may be communicated to companies, autonomous controller such as regulatory and supervisory authority, subjects, public or private, legitimized to request data, persons, companies, partnership or professional firms (attorneys, accountants, auditors).

Data may be disclosed to companies which, on behalf of the Data Controller and appointed as external data processors, perform facilities maintenance and companies providing concierge services.

Data may be disclosed to companies which, on behalf of the Data Controller and appointed as external data processors, carry out data processing for administrative and organizational purposes, market surveys, sending of advertising material appointed.

Data may be further disclosed to the ticketing companies, as external data controllers, with the purpose of allowing You to purchase the ticket for the chosen exhibition or to activate the electronic invitation sent to Your e-mail address.

The complete list of data recipients is constantly updated and it is easily and freely obtainable by sending a written communication to the data controller at the address reported hereabove or via email at the following email address: privacy@veronafiere.it.

Data subjects rights

You may request the Controller to access the data concerning You, the erasure of data, the correction of inaccurate data, the integration of incomplete data, the limitation of processing in the cases provided for by Article 18 GDPR, as well as to object, on grounds relating to Your particular situation, to the processing carried out in the legitimate interest of the controller.

In the event that the processing is based on consent or contract and is carried out by automated means, You have the right to receive Your data in a structured format, in common use and readable by an automatic device, as well as, if technically feasible, to transmit them to another data controller without hindrance.

At any time, You may revoke Your consent, as well as to object to the processing for marketing reasons, including the profiling connected to the direct marketing.

To exercise Your rights, You may contact the Data Controller by sending a written communication to the address reported hereabove or via email at privacy@veronafiere.it

Lastly, You may lodge a complaint with the competent supervisory authority as well as to use other protection mechanism as foreseen by applicable law.