Information pursuant to Art. 13 GDPR – free corporate events

Information pursuant to Art. 13 GDPR 

 

Identity and contact details of the data controller 

Fondazione Azione contro la Fame Italia ETS, with registered office at Via Rubens 3, 20148 Milan (MI), Italy, e-mail  info@azionecontrolafame.it (hereinafter: “Azione Contro la Fame” or “the Controller”). 

Source of data and purposes of processing  

Personal data are collected through the completion of the event registration form and are processed for the following purposes: 

1. managing the event and the related activities and communications
2. using tracking pixels to ensure the correct receipt of e-mails (so-called deliverability), to combat spam, for formatting requirements and statistical purposes, to report phishing activity, and to send service communications 
3. storing personal data in our records and carrying out direct marketing activities through promotional, informational and institutional communications about our projects, outreach and institutional events, fundraising initiatives, awareness-raising campaigns, surveys and research, as well as involvement in other forms of collaboration  
4. producing statistics on registrations. 

Methods of processing 

1. Personal data are processed by the Controller mainly by electronic means and are stored within its management system. Appropriate security measures are in place to prevent the loss or alteration of data – including accidental loss or alteration – unlawful or improper use and unauthorised access. 
2. For the purpose of sending institutional and promotional communications referred to in point 3, “Source of data and purposes of processing”, the e-mail address provided in the registration form will be used. 
3. The purposes referred to in point 4, “Source of data and purposes of processing”, are pursued through electronic processing that separates the information identifying the data subject from the remaining information and results in anonymous reports: it will no longer be possible to link the data back to the person to whom they refer. 
4. Tracking pixels are used in the e-mails sent for purely administrative, statistical and security purposes. Tracking pixels cannot be installed if image downloading is disabled. 

Legal basis for processing 

1. For the purposes referred to in point 1, “Source of data and purposes of processing”, the legal basis is Art. 6(1)(b) GDPR, in order to process the registration request. 
2. For the purposes referred to in point 3, “Source of data and purposes of processing”, the legal basis is the Decision of 17 June 2026 – Guidelines on the use of tracking pixels in e-mail communications, as well as Art. 122(1) of Legislative Decree 196/2003 with regard to the technical storage of, or access to, information already stored, where this is carried out for the sole purpose of transmitting a communication over an electronic communications network, or to the extent strictly necessary for the provider of a service explicitly requested by the user to provide that service. 
3. For the purposes referred to in point 3, “Source of data and purposes of processing”, the legal basis is the legitimate interest (Art. 6(1)(f) GDPR, Recital 47 GDPR and Opinion 6/2014 of 9 April 2014 of the Article 29 Working Party, para. III.3.1) of Azione contro la Fame in having at its disposal contacts who have shown an interest in its institutional activities, balanced against the interest of the person in receiving communications about projects and initiatives which they have shown they appreciate by registering for the event. 
4. For the purposes referred to in point 4, “Source of data and purposes of processing”, the legal basis is the legitimate interest (Art. 6(1)(f) GDPR, Recital 47 GDPR and Opinion 6/2014 of 9 April 2014 of the Article 29 Working Party, para. III.3.1) of Azione contro la Fame in knowing the level of participation in its projects and events and in planning its activities to promote its causes and develop its charitable work. 

Criteria for data collection 

All data marked with an asterisk are mandatory, while the telephone number is optional. If it is not provided, you will still be entitled to take part in the event. Finally, please note that, for the purposes of using tracking pixels, the following are collected: the pixel identifier, the IP address, the user ID, the message ID, the delivery ID in the form of a time stamp relating to the actual sending, and any security tokens protecting the integrity of the message. The need to request the above data as mandatory has been assessed in compliance with the requirements of Art. 25 GDPR (“Data protection by design and by default”), which require the prior assessment of appropriate technical and organisational measures designed to implement data protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of the GDPR and protect the rights of data subjects. In addition, Azione contro la Fame has implemented appropriate technical and organisational measures to ensure that, by default, only the personal data necessary to achieve the intended purposes are processed. 

Data processors, persons authorised to process data, independent controllers 

1. The persons authorised to process the data are responsible for relations with companies and institutional activities, outreach events, information systems and data security. 
2. The data will also be processed by data processors in charge of services connected with the purposes referred to in points 3 and 4, “Source of data and purposes of processing”.  
3. The data may be disclosed to public bodies, the judicial authorities or law enforcement agencies where required by law, regulation or EU legislation; these will act as independent controllers.
4. Scope of communication and dissemination of data 

1. The data are not disclosed to other associations, companies or organisations for their own direct marketing or profiling purposes. 
2. The data may be disclosed to law enforcement agencies, the judicial authorities or supervisory bodies for their institutional activities, at their express request, or in order to establish or defend a legal claim of the Controller or of a third party. 
3. Personal data are not and will not be disseminated. 

Data retention period

For the purposes referred to in point 1, “Source of data and purposes of processing”, personal data are retained for the period necessary to manage the event and the related ancillary and subsequent activities. 

1. For the purposes referred to in point 2, “Source of data and purposes of processing”, personal data will be retained for as long as the data subject is active and receives e-mail communications, unless otherwise ordered by law enforcement agencies or the judicial authorities where breaches are detected. 
2. For the purposes referred to in point 3, “Source of data and purposes of processing”, personal data will be retained for as long as the participant is active and remains interested in the institutional activities of Azione contro la Fame. Retention will cease if the right to object under Art. 21(1)(b) GDPR is exercised.
3. For the purposes referred to in point 4, “Source of data and purposes of processing”, personal data are retained for the period necessary to anonymise them. After that period, the identifying data can no longer be singled out and cannot be traced back to the person, and are therefore no longer subject to the requirements of the GDPR. 

At the end of the retention periods described above, the data will be anonymised for statistical purposes and then destroyed, unless otherwise ordered by supervisory authorities, law enforcement agencies or the judicial authorities. 

Place of processing and transfer of data to non-EU countries 

Personal data are processed on servers owned by the Controller and/or by third-party companies engaged and duly appointed as data processors, located within the European Union. It is nevertheless understood that the Controller, should it become necessary, may transfer the processing to non-EU countries. In such a case, the Controller hereby guarantees that the transfer of data will take place in accordance with the applicable legal provisions (Arts. 45, 46, 47 and 49 GDPR). 

Rights of data subjects under Arts. 15-22 GDPR 

By writing to the Controller at the postal address Via Rubens 3, 20145 Milan (MI), Italy, or by e-mail to privacy@azionecontrolafame.it you may exercise the rights of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing on legitimate grounds or to the sending of marketing communications and institutional information, including with regard to one or more specific means of contact only. You may at any time request the complete and up-to-date list of data processors and of the third parties to whom the data may be disclosed. 

Complaint to the Supervisory Authority 

The data subject has the right to lodge a complaint with the Supervisory Authority, which in Italy is the Garante per la Protezione dei Dati Personali (Italian Data Protection Authority) – Piazza Venezia 11, 00187 Rome (RM) – www.garanteprivacy.it, e-mail: protocollo@pec.gpdp.it, using the form available 

at https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524&zx=e0yn0riezmmw.  

Data Protection Officer 

The Data Protection Officer can be contacted by e-mail at dpoacf@azionecontrolafame.it for information on the processing of data.