Browser not supported

PRIVACY STATEMENT UNDER ARTICLE 13 OF EU REGULATION 2016/679

Gaya Events & Communication S.r.l., pursuant to Article 4 of the EU Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter: "EU Regulation"), is the Data Controller of personal data and in implementation of Article 13 of the EU Regulation ("Information to be provided when personal data is collected from the data subject") provides the following information.
The same therefore informs you that the personal data acquired, also with reference to existing legal relationships (by way of example only, but certainly not exhaustive: pre-contractual relationships, contractual relationships, orders, purchases), are subject to processing in compliance with the above-mentioned regulations. In relation to the above processing, the Data Controller provides, among other things, the following information.

By "personal data" (as per art. 4 number 1 of EU Regulation 2016/679), any information concerning an identified or identifiable natural person ("data subject"); an identifiable person is considered to be a natural person who can be identified, directly or indirectly, with particular reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more characteristic elements of his or her physical, physiological, genetic, mental, economic, cultural or social identity.

"Processing" (as per art. 4 number 2 of EU Regulation 2016/679), means any operation or set of operations, whether by automated means, applied to personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, comparison or interconnection, restriction, erasure or destruction.
Such processing must be based on the principles of fairness, lawfulness, and transparency, protecting your confidentiality and your rights.

Data of the Data controller 
Gaya Events & Communication S.r.l.
Registered office: Via Paolo da Cannobio, 12, 20122 Milan (MI)
Operational headquarters: Via F. Vismara 6, 23880 Casatenovo (LC)
Tel 02.83595074 
e-mail: giustina@gayaevents.it

Purposes of processing
The purposes of the processing of personal data are as follows:
1.    Fulfilment of obligations under laws, regulations, EU legislation, or provisions issued by authorities in connection with or otherwise related to the existing and/or future legal relationship.
2.    Execution, organizational management of contracts, also with reference to preliminary agreements.
3.    Management of the contractual relationship (execution of operations based on obligations arising from the contract concluded with the interested party).
4.    Possible external professional collaborations for the fulfilment of legal obligations.
5.    Protection of legal relations.

Method of processing
Personal data will be processed in paper, computerized and telematic form and entered into relevant databases (customers, users, etc.. ) which may be accessed, and therefore become aware of, the employees expressly designated by the Owner as Responsible and Authorized for the processing of personal data, which may carry out consultation operations, use, processing, comparison and any other appropriate operation also automated in accordance with the provisions of the law necessary to ensure, among other things, the confidentiality and security of data as well as the accuracy, updating and relevance of the data to the stated purposes.

Categories of recipients
In relation to the stated purposes, the data may be disclosed to the following parties and/or categories of parties indicated below, or it may be disclosed to companies and/or persons, in EU countries, who provide services, including external services, on behalf of the Data Controller. Among these are indicated for the sake of clarity and merely by way of example but not limited to their diverse types:
- Accounting management consultants
- IT service companies.

The list of Data Processors is available from the Data Controller.

Transfer of data to third countries outside the EU
The Data Controller does not transfer personal data to non-EU territory.

Retention period
Pursuant to the provisions of Article 13(2)(a) of the Regulation, below are indications of the data retention period according to the different purposes of the processing: 
- with reference to the purposes under numbers 1 to 5, the data are kept for the period necessary to manage the contract, fulfil legal obligations and to protect legitimate interests.
- with reference to the purposes in number 6, the data will be processed until the data subject's consent is revoked and will be updated every two years.


Rights of the data subject
The data subject, in relation to the personal data covered by this notice, has the right to exercise the rights provided for in Articles 15 to 22 EU Regulation 2016/679 as set out below:
•    data subject's right of access [Art. 15 of the EU Regulation] (the possibility to be informed about the processing performed on one's Personal Data and, if necessary, to receive a copy of it).
•    right to rectification of one's Personal Data [Art. 16 of the EU Regulation] (the data subject has the right to rectification of inaccurate Personal Data concerning him or her).
•    right to erasure of one's own Personal Data without undue delay ("right to be forgotten") [Art. 17 of the EU Regulation] (the data subject has, as well as will have, the right to erasure of his or her own data).
•    right to restriction of processing of one's Personal Data in the cases provided for in Art. 18 of the EU Regulation, including in the case of unlawful processing or contestation of the accuracy of Personal Data by the data subject [Art. 18 of the EU Regulation].
•    right to data portability [Art. 20 of the EU Regulation], the data subject will be able to request his or her Personal Data in a structured format to transmit it to another controller, in the cases provided for in the same article.
•    right to object to the processing of one's Personal Data [Art. 21 of the EU Regulation] (the data subject has, as well as will have, the right to object to the processing of one's Personal Data).
•    right not to be subjected to automated decision-making [Art. 22 of the EU Regulation] (the data subject has, as well as will have, the right not to be subjected to a decision based solely on automated processing).
Pursuant to the same legislation, one has the right to request revocation of the consent provided at any time and to file a formal complaint with the Garante per la protezione dei dati personali - Piazza Venezia, 11, Rome.

All the rights mentioned so far are exercised with a written request addressed to the Data Controller. The request can be sent by any means (registered letter, email) to the addresses of the Controller.
If the purpose of processing pursued by Gaya Events & Communication S.r.l. has consent as a legal basis, the data subject has the right to proceed, at any time, to revocation by sending an email to the above address and the personal data will no longer be processed for such purposes.

Mandatory provision of personal data
Please note that if the processing purposes have a legal or contractual (or even pre-contractual) obligation as a legal basis, the data subject must necessarily provide the requested data. Failure to do so will make it impossible for the Data Controller to proceed with the pursuit of the specific processing purposes.

Automated decision-making process
The Data Controller does not use any automated decision-making process.

Changes and updates
Gaya Events & Communication S.r.l. may also make changes and/or additions to the said policy also as a consequence of possible and subsequent regulatory changes and/or additions.