PRIVACY NOTICE

EU Regulation No. 679/2016 (General Data Protection Regulation – GDPR)

The personal data indicated above and provided by you, together with any photographic material and video recordings for which a specific authorisation for processing will be requested—also pursuant to Articles 10 and 320 of the Italian Civil Code and Articles 96 and 97 of Law No. 633 of 22 April 1941 (Copyright Law), as well as Law No. 101 of 19 September 2018—will be collected by Graf Srl (hereinafter “Graf”), which will process such data as Data Controller.

Data will be processed using manual, IT, and telematic tools, in a manner that ensures their security and confidentiality, including when distance communication techniques are used, and in accordance with logic strictly related to the purposes outlined below:

1. Event participation

Participation in the event organised by Graf Srl.
The provision of data for this purpose is a necessary requirement for participation in the event, and processing does not require your consent.

2. Direct marketing activities

Promotion of Graf’s products and services, as well as those of other companies within the Group, including market research activities (so-called direct marketing), carried out via letters, landline and/or mobile phone calls, advertising material, automated communication systems, email, MMS (Multimedia Messaging Service), and SMS (Short Message Service), pursuant to Article 130, paragraph 3-bis of the Italian Privacy Code, without prejudice to Article 1, paragraph 14 of Law No. 5 of 11 January 2018.

3. Profiling and territorial marketing

Promotion of Graf, the Group, or third-party partner companies involved in the event or in territorial communication and marketing initiatives, through the processing and analysis of information relating to preferences, habits, and consumption choices.
This processing is aimed at grouping individuals into “profiles” or homogeneous categories based on specific behaviours or characteristics (customer profiling).
Such processing may also be carried out by combining data with additional information obtained from third parties (data enrichment).

4. Communication of contact details to partners

Communication of your contact details to partner companies for the purpose of receiving commercial communications via postal mail, email, and SMS.

The provision of data for the promotional purposes described in points 2–4 and their related processing requires your explicit consent. In the absence of such consent, it will not be possible to use the data for these purposes.

Your data will be processed for the entire duration of the contractual relationship and, subsequently, for purposes related to contractual obligations, legal and tax compliance, and for the effective management of financial and commercial relationships, as provided for by Article 4 of the Italian Privacy Code and Article 4(2) of the GDPR.
The Data Controller will retain personal data for the time necessary to fulfil the above purposes and, in any case, no longer than 5 years after termination of the relationship for service-related purposes.

Rights of the Data Subject

As a data subject, you may exercise the rights set out in Article 7 of the Italian Privacy Code and Articles 15 to 22 and Article 34 of the GDPR, including the right to:

I. obtain confirmation as to whether or not personal data concerning you exist, even if not yet recorded, and to receive such data in an intelligible form;

II. obtain information regarding:
a) the origin of the personal data;
b) the purposes and methods of processing;
c) the logic applied in the case of processing carried out with electronic tools;
d) the identification details of the Data Controller, Data Processors, and the designated representative pursuant to applicable law.

You may also exercise the rights provided for by Articles 16–21 of the GDPR, including the right to obtain access, rectification, erasure, restriction of processing, and to object, in whole or in part, pursuant to Law No. 5 of 11 January 2018:

a) on legitimate grounds, to the processing of personal data concerning you, even if relevant to the purpose of collection;
b) to the processing of personal data concerning you for the purpose of sending advertising material, direct sales, market research, or commercial communication, carried out through automated calling systems without human intervention, email, and/or traditional marketing methods such as telephone calls and postal mail.

Data Controller and Data Protection Contact

Data Controller:
Graf Srl
Via Isonzo 19 – 03100 Frosinone, Italy
VAT No. 06537370154

The Data Processor / Privacy Contact, whom you may contact to exercise your rights or request clarification regarding personal data protection, can be reached at:
privacy.gdpr@graf.it

or at:
Graf Srl
Via Isonzo 19 – 03100 Frosinone, Italy
VAT No. 03288430600