In accordance with Regulation (EU) 2016/679 and current Italian legislation on the processing of personal data (Version updated on 29/11/2022)

Agenzia italiana per l'Internazionalizzazione - Promos Italia S.c.r.l., with registered office in via Meravigli No. 9/b, 20123 Milan, Tax Code and VAT No. 10322390963, in its quality as Data Controller (hereinafter, "Data Controller"), informs You pursuant to Regulation (EU) 2016/679 ("GDPR") and current national legislation on the protection of personal data that Your data will be processed in the following ways and for the following purposes:

1. Object of the Data Processing

The Controller processes personal data (hereinafter referred to as "Personal Data" or "Data"), provided directly by the data subject. In particular:

• with reference to the "Operating Headquarters" section: VAT number, company name, website, reference telephone number, email address, address, country, city, zip code;
• with reference to the "Registered Office" section: address, country, city, zip code, reference product category;
• with reference to the "Contact person details" section: name, surname, email address, telephone number, mobile phone number, job title, indication of origin of the invitation to participate.

2. Purpose and Legal Bases of the Processing

Your Personal Data are processed, without Your prior consent, for the following purposes and legal bases:

1. the execution of the contract and/or the fulfilment of pre-contractual commitments, in particular:
   •  for the registration and participation in the InBuyer initiative;
   •  to send service communications;
   •  for the execution of any support and assistance activities in the context of this initiative, including assistance in using the platform by accessing the user's profile;
2. for the fulfillment by the Data Controller of legal obligations, such as:
   •  compliance with the obligations established by laws, regulations or by national and community legislation or imposed by the competent Authorities.
3. the pursuit of a legitimate interest of the Data Controller, in particular the prevention and repression of unlawful acts, the verification of solvency, anti-fraud and anti-mafia activities as well as the protection of the rights and legitimate interests of the Data Controller and/or third parties, including in court: the interest of the Data Controller corresponds to the right of action constitutionally guaranteed (art. 24 of the Italian Constitution) and, as such, it is socially recognised as prevailing over the interests of the individual concerned;

B.    with Your consent:

•  to send You informative, promotional communications and newsletters, by e-mail;
•  to communicate personal data to the chambers of commerce, unions of chambers of commerce, special companies of the chambers of commerce, which will process them for their own marketing purposes (also connected to the simple follow-up following participation in the initiative InBuyer), with direct contacts by telephone and e-mail.

3. Method of Treatment

The processing of Your Personal Data is carried out, by electronic and paper means, through the operations of collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of data.

Your Personal Data is processed electronically and, if necessary, automatically. Your Personal Data is protected in such a way as to minimise the risk of destruction, loss (including accidental loss), unauthorised access/use or use incompatible with the original purpose of collection. This is achieved by the technical and organisational security measures implemented by the Data Controller.

4. Data Retention

The Data Controller shall process Personal Data for the time necessary to fulfil the above purposes and in any case no longer than 10 year from the termination of the contractual relationship. Personal Data will be processed for sending information and promotional communications and newsletters until consent is revoked.

5. Provision of Data

The provision of the Data is necessary to establish and continue the pre-contractual and contractual relationship with the Owner. If the Data are not provided, the contractual relationship with the Owner cannot be established or continued.

The provision of the Data for marketing purpose in not mandatory.

6. Access to Data

Your Data may be made accessible for the above purposes to:

- employees and/or collaborators of the Data Controller, in their capacity as Data Processors and/or internal data controllers and/or System Administrators;

- other third parties (e.g. suppliers, etc.) who carry out activities in outsourcing on behalf of the Data Controller, in their capacity as external data controllers.

7. Communication of Data

Your Data may be communicated, even without your consent, to partners of Promos Italia and companies interested in meeting the buyer for commercial reasons.

Your Data may be communicated to control bodies, law enforcement agencies or the judiciary, at their express request, who will process it as autonomous data controllers for institutional purposes and/or in accordance with the law during investigations and controls.

8. Transfer of Data

Your Data will not be disseminated but may be transferred to countries outside the European Union. For this purpose, in accordance with privacy legislation, the Data Controller assesses the impact of data transfers and adopts, if applicable, the most appropriate safeguards (e.g. adequacy decisions or standard contractual clauses).

9. Rights of the interested party

The Data Controller informs You that, as a data subject, if the limitations provided for by law do not apply, you have the right to:

• obtain confirmation of the existence or otherwise of Your Personal Data, even if not yet recorded, and that such Data be made available to you in an intelligible form;
• obtain an indication and, where appropriate, a copy of: a) the origin and category of Your Personal Data; b) the logic applied in the event of processing carried out with the aid of electronic instruments; c) the purposes and methods of processing; d) the identity of the data controller and data processors; e) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of it, in particular if it is received from third countries or international organisations; f) whenever possible, the period of storage of the Data or the criterion used to determine this period;
• obtain, without undue delay, the updating and rectification of inaccurate data or, where interested therein, the integration of incomplete Data;
• revoke at any time the consents given, easily, without hindrance, using, if possible, the same channels used to provide them
• obtain the cancellation, transformation into anonymous form or blocking of data: a) processed unlawfully; b) no longer necessary in relation to the purposes for which they were collected or subsequently processed; c) in the event of withdrawal of the consent on which the processing is based and if there is no other legal basis, d) if you have opposed the processing and there is no overriding legitimate reason to continue processing; e) in the event of compliance with a legal obligation; f) in the case of data relating to minors. The Data Controller may refuse erasure only in the case of: a) exercise of the right to freedom of expression and information; b) performance of a legal obligation, performance of a task carried out in the public interest or exercise of public authority; c) reasons of public health interest; d) archiving in the public interest, scientific or historical research or for statistical purposes; e) exercise of a right in a court of law;
• obtain the restriction of processing in the event of: a) contestation of the accuracy of personal data; b) unlawful processing by the Data Controller to prevent their deletion; c) exercise of a right of yours in a court of law; d) verification of whether the legitimate reasons of the Data Controller prevail over those of the data subject;
• receive, if the processing is carried out by automatic means, without hindrance and in a structured, commonly used and readable format the personal data concerning you in order to transmit them to another data controller or - if technically feasible - to obtain direct transmission by the Data Controller to another data controller;
• oppose, in whole or in part, for legitimate reasons, the processing of your personal data, even if pertinent to the purpose of collection;
• lodge a complaint with the Guarantor Authority for the Protection of Personal Data.

In the above cases, where necessary, the Data Controller shall inform the third parties to whom Your Personal Data are communicated of the possible exercise of your rights, except in specific cases (e.g. when this proves impossible or involves the use of means that are manifestly disproportionate to the protected right).

10. Ways to exercise Your rights

You may exercise these rights at any time:

• by sending a registered letter to the Data Controller's address;
• by sending an e-mail or PEC to promositaliascrl@legalmail.it.

11. Data Controller, Data Protection Officer and Data Processor

The Data Controller is Agenzia italiana per l'internazionalizzazione - Promos Italia S.c.r.l., with headquarters in Via Meravigli 9/b, 20123 Milan, Italy, Tax Code and VAT number 10322390963.

The Data Controller has also appointed a Personal Data Protection Officer who can be contacted by sending an email to dpo@promositalia.camcom.it.

The updated list of data processors, persons in charge of processing and system administrators is kept at the Data Controller's headquarters.