The company ESPOSIZIONE INTERNAZIONALE CICLO E MOTOCICLO S.p.A. (hereinafter also referred to as “EICMA. S.p.A.” for brevity) informs you that the personal data collected during registration will be processed in compliance with the legislation on the protection of personal data.

That said, pursuant to Article 13 of European Regulation 2016/679, E.I.C.M.A. S.p.A. provides the following informatiom.

1. CONTACT DETAILS OF THE DATA CONTROLLER

The Data Controller is E.I.C.M.A. S.p.A., with registered office in via Fabio Filzi 25/A 20124, Milan, VAT number 04145450153 – email: [email protected]. The Data Controller has not currently appointed a Data Protection Officer (DPO).

2. PURPOSE AND LEGAL BASIS OF THE PROCESSING

• a) The data provided by the user/visitor, hereinafter also referred to as the “Data Subject” (name, surname, gender, email address, date of birth, telephone number, country of residence, city of residence) are processed to enable the Data Subject to obtain the free ticket granting access to EICMA RIDING FEST and to offer and manage the related requested services (e.g., assistance, authorization for test rides, responses to requests for information, communications in the event of emergency measures, etc.). The legal basis for the processing described above consists in the execution of the relationship to which the data subject is a party and in legal obligations for purposes related to the requested services in connection with obtaining the free ticket (Art. 6 letter (b) and (c) GDPR).

• b) The aforementioned data indicated in point a) in the event of purchase by the Data Subject of services/products (e.g., track experiences) are processed to allow the Data Subject to purchase the products/services and to offer and manage the related services requested in connection with such purchase (e.g., assistance, responses to requests for information, administrative and accounting activities, customer service, product evaluation, credit recovery, communications in the event of emergency measures, etc.). The legal basis for the processing described above consists in the execution of the relationship to which the data subject is a party and in legal obligations for purposes related to the products/services purchased (Art. 6, letters b) and c) of the GDPR).

• c) If the user/visitor requests to remain in contact with the Data Controller to receive information about promotional initiatives (promotions, discounts, competitions, surveys, and other marketing activities), including those related to EICMA RIDING FEST and EICMA, they must provide their email address and any additional data requested, which will then be used for this purpose, without prejudice to the user/visitor's right to communicate at any time that they no longer wish to receive such communications. The legal basis for the processing described above consists of the expression of consent by the user/visitor.

• d) The data provided by the user/visitor to the Data Controller, collected in consideration of their interests and purchasing preferences, will be processed for purposes related to marketing and personalized commercial and promotional communications to enhance the experience offered by EICMA RIDING FEST and EICMA. The legal basis for the processing described above consists of the express consent given by users/visitors.

Please note that data legitimately collected in accordance with the law may also be used for anonymous statistical extrapolations.

3. RECIPIENTS OR CATEGORIES OF RECIPIENTS TO WHOM PERSONAL DATA MAY BE DISCLOSED

The data may be disclosed to third parties operating in support of and on behalf of the Data Controller only for the purposes listed above for contractual and legal obligations. The data may be disclosed to administrative staff and those responsible for the management and maintenance of processing systems. Disclosure to the above-mentioned parties will in any case be carried out with the guarantee of protection of the rights of the data subject as provided for in the GDPR. The list of any data processors is available from the Data Controller.

However, it should be noted that for the issuance of tickets through this sales channel, Platinium Group S.A.M., registered in Monaco under number 06S04539, Address: 2 Rue du Gabian, 98000 Monaco, is the external party responsible for the processing of personal data, also responsible for managing the technological infrastructure that allows the free ticket and products/services to be obtained and for processing the data collected through these technological tools.

The data provided for marketing purposes may also be communicated or transferred to third-party partners (for example, but not limited to, the main partners highlighted on the E.I.C.M.A. S.p.A. website: https://www.eicma.it/) in order to allow them to use it directly for sending their commercial communications, only with prior specific consent.

4. POSSIBLE TRANSFER OF PERSONAL DATA TO A THIRD COUNTRY

Any transfer of data outside the EU will be carried out in full compliance with the levels of protection and safeguards provided for in the GDPR.

5. PERIOD OF RETENTION OF PERSONAL DATA OR CRITERIA USED TO DETERMINE THAT PERIOD

The data will be stored in a form that allows the identification of the data subjects for a period of time not exceeding the achievement of the purposes of the processing, compatibly with other legal obligations, and in accordance with the data storage procedure adopted by the Data Controller. The data subject may request the retention periods of their personal data at any time by writing to the following address: [email protected].

6. RIGHTS OF THE DATA SUBJECT

As provided for in Article 13 of the GDPR, the Data Subject may exercise the following rights at any time:

• a) right of access, rectification, erasure, restriction, objection: the data subject may access their data at any time, request its rectification if it is incorrect, request the erasure of redundant data but not that required by law from the data controller, and may restrict access to the data to certain persons;

• b) right to data portability: the Data Subject has the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning him or her provided to a data controller and has the right to transmit those data to another data controller without hindrance from the data controller to which the personal data have been provided, only in the cases provided for in Article 20 of the GDPR;

• c) right to withdraw consent at any time: the Data Subject may withdraw consent at any time, assuming the consequences thereof, without prejudice to the Data Controller's obligation to continue to hold the personal data subject to this processing when this is necessary to fulfill a legal obligation of the Data Controller or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller.

• d) the right to lodge a complaint with a privacy supervisory authority.

• e) with regard to the marketing purposes referred to in paragraphs 2 c) and 2 d), the data subject who has given their consent retains the right:

  • i. to request, at any time and free of charge, that the Data Controller send communications exclusively through traditional means of contact, such as paper mail or operator calls;

  • ii. to object, at any time and free of charge, to the processing of their personal data for the aforementioned purposes. In this case, the data subject's right to object to the processing of their personal data through automated means of contact (e.g., email, MMS or SMS messages, social networks, etc.) extends to traditional means of contact;

  • iii. to object, at any time and free of charge, to the processing of their personal data for the aforementioned purposes only in part, i.e. by expressing a choice regarding the means of contact.

• f) with regard to the marketing purposes referred to in paragraphs 2 c) and 2 d), the data subject retains the right to object, at any time and free of charge, to the processing of their personal data for the aforementioned purposes.

To exercise your rights, write to [email protected].

7. MANDATORY OR OPTIONAL NATURE OF DATA PROVISION

The provision of data marked with an asterisk is mandatory given the nature of the contractual relationship established between the user/visitor and the Data Controller in relation to the services requested, including those connected with obtaining a free ticket. The provision of data for marketing purposes, either our own or those of third parties, and for the analysis of purchasing preferences (personalized marketing) is optional.

8. CONSEQUENCES OF REFUSAL TO RESPOND

If the user/visitor refuses to provide the mandatory data requested in relation to the services requested, including those connected with obtaining the admission ticket, the Data Controller will not be able to provide its service. However, there are no consequences for failure to provide optional data, except for the impossibility of receiving personalized and/or generic promotional communications.

9. EXISTENCE OF PROFILING ACTIVITIES OR AUTOMATED DECISION-MAKING PROCESSES, LOGICS USED, AND CONSEQUENCES FOR THE DATA SUBJECT

Within the limits indicated in this policy, the Data Controller carries out profiling activities on the Data Subject related to marketing activities: these will be carried out in accordance with the GDPR and the Data Subject may object at any time by writing to [email protected].

EICMA S.p.A.