DATA PROTECTION NOTICE ON THE USE OF IMAGES

Processing of photographic and audiovisual images – Event
Updated version pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018

1. Data Controller
Pursuant to Regulation (EU) 2016/679 (“GDPR”), the Data Controller is:
Chaberton Italia S.r.l., with registered office at Via San Paolo 1, 20121 Milan (MI), Italy, VAT No. 11573330963, registered with the Milan Companies Register under No. 11573330963 (hereinafter, the “Data Controller”).
Contact: privacy@chabertonpartners.com 

2. How this notice is provided
This notice is made available through a QR code displayed at the event venue. Physical signage provides a brief summary including the identity of the Data Controller, the purpose of the processing, and the legal basis for such processing. This document constitutes the full privacy notice pursuant to Article 13 GDPR.

3. Categories of Personal Data Processed
During the event, photographs and audiovisual recordings may be taken. The personal data processed may include photographic images, video recordings and, where applicable, audio recordings of event participants.

4. Purpose and Legal Basis of Processing
Personal data are processed for the following purpose:

  • Documentation of corporate activities and institutional communication directed towards professional stakeholders, including publication on the company's website, official social media channels (e.g. LinkedIn), and informational materials. The legal basis for processing is the Data Controller’s legitimate interest pursuant to Article 6(1)(f) GDPR, consisting of its interest in documenting and promoting its professional activities in a manner consistent with participants' reasonable expectations.

5. Image Processing Activities
Images may be subject to technical processing operations such as selection, editing, resizing, enhancement, or graphic adaptation, always in compliance with the purposes outlined above and with due regard for the dignity and rights of the individuals concerned. Recordings are carried out in public and professional settings.

6. Recipients and Disclosure of Personal Data
Personal data may be processed by:

  • duly authorised personnel of the Data Controller;
  • third parties supporting the Data Controller in organising the event and carrying out communication activities (e.g. professional photographers, communication agencies, IT service providers), appointed as Data Processors pursuant to Article 28 GDPR under specific contractual arrangements.

Images may be published through: corporate website, official social media channels (e.g. LinkedIn), the Data Controller's informational and promotional materials.

7. Transfers of Personal Data to Third Countries
Personal data are primarily processed within the European Union. Should operational requirements related to service providers entail transfers to third countries, such transfers will take place exclusively in accordance with the safeguards set out in Articles 44 et seq. GDPR, including, where applicable, Standard Contractual Clauses adopted under European Commission Implementing Decision 2021/914/EU or transfers to countries covered by an adequacy decision.
Further information may be requested from the Data Controller.

8. Retention Period
Images will be retained for no longer than 24 months from the date of the event, unless specific historical documentation needs justify a longer retention period. In such cases, the Data Controller shall ensure the implementation of appropriate security measures.
Upon expiry of the retention period, images will be securely deleted or permanently anonymised.

9. Data Subjects Rights
Pursuant to Articles 15 to 22 GDPR, data subjects may exercise the following rights at any time:

  • right of access to personal data (Art. 15);
  • right to rectification of inaccurate data (Art. 16);
  • right to erasure ("right to be forgotten") (Art. 17);
  • right to restriction of processing (Art. 18);
  • right to object to processing (Art. 21);
  • right to data portability, where applicable (Art. 20).

The Data Controller will respond to requests within one month of receipt. This period may be extended by a further two months in particularly complex cases, as provided by Article 12(3) GDPR.

10. Right to Object to Recording
Data subjects have the right to object at any time to the processing of their images on grounds relating to their particular situation, pursuant to Article 21 GDPR.
Participation in the event is not conditional upon consent to be photographed or recorded.
Individuals who do not wish to appear in photographs or recordings are invited to notify the event staff before or during the event. Organising personnel, who will be easily identifiable, will record and manage such requests appropriately.
Where technically feasible, any images already captured will be deleted upon request.

11. Right to Lodge a Complaint with the Supervisory Authority
Data subjects have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali - www.garanteprivacy.it – Piazza Venezia n. 11, 00187 Roma) pursuant to Article 77 GDPR.

12. Contact Details for Exercising Rights
For the exercise of the rights described above, or for any request concerning the processing of personal data, please contact: privacy@chabertonpartners.com