Processing and packaging between digitalization and sustainability

Privacy policy on the processing of personal data in accordance with the terms of Article 13 of Regulation EU 679/2016

1.INTRODUCTION 
Pursuant to Art. 13 of the GDPR, concerning the protection of individuals in regards to the processing of personal data, we are providing the information requested on the processing of personal data concerning you ("Data") by Koeln Parma Exhibitions S.r.l. (hereinafter also referred to as "Data Controller” and/or “Controller” and/or “KPE”).  
 
2.DATA CONTROLLER  
Koeln Parma Exhibitions S.r.l., with registered office in Parma (Italy), Viale delle Esposizioni 393/a, VAT no and Tax ID no. 02787300348 – email: info@cibustec.com 
 
3.PERSONAL DATA PROCESSED 
The Data processed by the Data Controller are: name, surname, email address, telephone no., company, country of the “Data subject”.  
If the Data collected by the Controller do not entitle you to an admission ticket, they will be deleted.  Data may be stored for marketing purposes only if consent is given by the data subject. 
 
4.PURPOSE OF PROCESSING AND LEGAL BASIS  
The Data supplied by the Data subjects, including data entered in forms, are used for the following purposes: 

 
5.PROCESSING PROCEDURES 
Data processing is based on principles of correctness, lawfulness, transparency and data minimization (privacy by design); it may be carried out either manually or through automated procedures designed to store, process and transmit them and will take place through appropriate technical and organizational measures, taking into account the current technological level and implementation costs, in order to guarantee, among other things, the security, confidentiality, integrity, availability and resilience of systems and services, avoiding the risk of loss, destruction, unauthorized access or disclosure or, in any case, illicit use, as well as through reasonable steps for ensuring that inaccurate data is erased or rectified in accordance with the purpose for which they are processed. 
 
6.RIGHTS OF THE DATA SUBJECT (ART. 15-22 of the GDPR) 
Data subjects have the rights established by articles 15 to 22 of the GDPR, where applicable. Data subjects have the right to request from the Data Controllers access to data, rectification or erasure of such data as well as restriction of or objection to processing. Data subjects are entitled to revoke consent at any time regarding the purposes of point 6 and 7 of chapter “4. PURPOSE OF PROCESSING AND LEGAL BASIS”. For more information on your specific rights as a Data Subject, and on how to exercise them, please send an email or write to the Data Controller's address, given in art. 2, specifying your request and indicating the address where you would like to receive the reply. 
Data subjects are entitled to lodge a complaint with the Data Protection Authority through the contact details available on the website  https://www.garanteprivacy.it/ 
 
7.CATEGORIES OF DATA RECIPIENTS TO WHOM THE DATA MAY BE PROVIDED AS DATA CONTROLLERS OR WHO MAY HANDLE IT AS DATA PROCESSORS 
Your Data may be processed by third parties operating as Data Controllers such as, for example, authorities and supervisory and control bodies and in general public or private subjects entitled to request the Data.  
Your Data may be processed by third parties designated as data processors who perform specific activities on behalf of the Data Controller, such as accounting, tax and insurance-related requirements, management of admission tickets and other procedures required for the provision of services. 
Your data will be processed by authorized, trained persons and will not be disclosed and disseminated.  
If you apply for participation in the Business Agenda platform, some of your data will be viewed by the exhibitors for the purpose of business matching. 
 
8.Data transfer outside the EU 
Structured transfers of Personal Data of the Data subjects to non-European countries are not planned. For organizational reasons, it is possible that cloud services are activated outside the EU; in these cases, the Data Controller will comply with the provisions contained in Chapter V of Regulation EU 2016/679 to ensure an adequate level of protection. When possible, priority will be given to countries that have been declared adequate by the European Commission.