PRIVACY

INFORMATION PURSUANT TO REGULATION (EU) 2016/679 (“GDPR”) ARTICLES 13 AND 14 AND NATIONAL ADAPTION LAWS

This document (“Notice”) aims to provide you with information regarding the processing of the information specified below, which will be provided by you or otherwise available to our organization, and which will be processed by us and/or other identified parties for the purposes indicated below. This Notice is issued in accordance with EU Regulation No. 679/2016 (“GDPR”) and subsequent national adaptation laws (collectively referred to as “Applicable Legislation”).

1. Data Controller
   The Data Controller, as defined under Articles 4 and 24 of EU Regulation 2016/679, is Mia Production srls – Corso Vittorio Emanuele II 87 00186 Rome (RM), VAT Number 14401291001, Tel: [insert phone number], Email: info@mia-lejournal.com, represented by the legal representative pro tempore (hereinafter referred to as “Controller”).

2. Contact Details of the Data Protection Officer (DPO)
   The Data Controller does not engage in activities that require the designation of a Data Protection Officer.

3. Purposes and Legal Basis for Processing
   The Personal Data collected will be processed for the following purposes and legal bases:

• Purpose 3, Letter a): To manage your contractual relationship or to execute pre-contractual measures (for example, requests for information or quotes). In this case, you are free to provide your Personal Data, including sensitive data; however, failing to provide them will prevent the establishment of the aforementioned relationship and meet your request.
  Legal basis: Processing is necessary for the performance of a contract to which you are a party.

• Purpose 3, Letter b): With your explicit consent, to send you (i) promotional communications related to the Controller and (ii) communications regarding events organized by the Controller (hereinafter referred to as “Marketing Purposes”).
  Legal basis: Your consent.

4. Categories of Personal Data Processed (pursuant to Article 14)
   In line with the purposes and methods described in this Notice, information that may be considered “Personal Data” will be processed, including your identification details and contact information (e.g., mobile number, email address, etc.).

5. Recipients and Categories of Recipients
   Personal data will not be disseminated or disclosed to unspecified parties. However, they may be communicated to clearly defined parties, fully respecting legal requirements, for purposes strictly related to those previously indicated. Access to your personal data is restricted to individuals authorized by the Controller. Communication to identified recipients, only if relevant and functional, is related to achieving the purposes outlined in point 3. Therefore, the collected and processed personal data may be:

• Used in an anonymized form for statistical purposes;
• Made available to the Controller’s collaborators as Data Processors or authorized personnel;
• Communicated to third parties, physical or legal entities, public administrations, professionals, law enforcement, governmental bodies, regulatory agencies, courts, or other public authorities authorized by law;
• Shared with commercial partners only with the prior and explicit consent of the User;
• If necessary, transferred to another Data Controller in accordance with GDPR, including regarding the right to data portability.

Additionally, information may be provided whenever necessary to comply with requests from the Judicial Authority or Public Security. The collected data will under no circumstances be disseminated. A list of Data Processors is available at the Controller’s office.

6. Data Transfer Abroad
   Data will not be transferred outside the European Union.

7. Data Retention Period (Determination Criteria)
   Below is a table detailing the retention periods (or the criteria for determining) for Personal Data:

   Purpose	Retention Period
   Purpose 3, Letter a): Contract Management	For the duration of the relationship and subsequently for 10 years (standard limitation period).
   Purpose 3, Letter b): Marketing Purposes	2 years from collection, subject to the User’s right to modify and/or revoke their consent at any time (in line with the “accountability” principle of GDPR).

8. Methods of Data Processing
   The processing of Personal Data will occur using manual, IT, or telematic tools, suitable for ensuring security and confidentiality, and will be carried out by personnel duly trained to comply with Applicable Legislation. There is no automated decision-making process. Besides cases necessitating contact regarding the management of your position, should you consent to the processing of your data for the purposes outlined in point 3, Letter b), you may be contacted via email, newsletter, SMS, or through any equivalent electronic means, or by postal mail or telephone to all provided contact details. Should you prefer to be contacted only via one or a few of these methods, you can expressly request this using the form available in the Privacy section of the website www.mia-lejournal.com/Modulo esercizio diritti.pdf.

9. Your Rights
   You are informed that you can exercise the rights granted by Applicable Legislation, including, by way of example:

• The right to access your Personal Data and know their origin, purposes, and aims of processing, the identity of recipients to whom they are disclosed, the data retention period or criteria for determining it (Article 15);
• The right to request rectification (Article 16);
• The right to erasure (“right to be forgotten”), if no longer necessary, incomplete, inaccurate, or collected in violation of the law (Article 17);
• The right to request that processing be limited to certain information concerning you (Article 18);
• The right to receive, in a structured format, or to transmit to you or to third parties designated by you the information concerning you (the so-called “portability”) or that you have voluntarily provided (Article 20);
• The right to object to the processing based on legitimate interest (Article 21);
• As well as the right to withdraw your consent at any time if this constitutes the basis for processing (the withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal).

These rights may be exercised by sending a written request to the Controller [or the DPO] at the contacts provided in points 1 and 2. The Controller will act on this request without delay and, in any case, no later than one month from the receipt of the request. This period may be extended by two months if necessary, considering the complexity and number of requests received by the Controller. In such cases, the Controller will inform you within one month of receiving your request and will communicate the reasons for the extension. Please note that if the response to your requests is not satisfactory, you may contact and lodge a complaint with the Data Protection Authority (http://www.garanteprivacy.it/) as provided by Applicable Legislation.

Revision May 2018