Privacy Policy

EMI – Meetings & Incentives S.r.l. – Privacy Policy

 

1)         Introductions

EMI – Meetings & Incentives S.r.l. is committed to protecting your privacy.

This statement is made in the light of the requirements of the General Data Protection Regulation (GDPR) to alert users to EMI – Meetings & Incentives S.r.l. data processing practices which will govern the processing of your personal data.

GDPR not only applies to organizations located within the EU but also to organizations located outside of the EU if they offer goods or services to, or monitor the behavior of, EU data subjects. It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location. Whilst we understand this means it does not include non-EU citizens, we believe at EMI – Meetings & Incentives S.r.l., it is important to protect individual’s personal data regardless of their nationality and therefore we look to apply the same standards across all individual’s personal data regardless of their nationality.

As the controller, EMI – Meetings & Incentives S.r.l., adheres to numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. However, Internet-based data transmissions may in principle have security gaps, so absolute protection may not be guaranteed. For this reason, every data subject is free to transfer personal data to us via alternative means, e.g., by telephone.

 

2)         Definitions

The data protection declaration of EMI – Meetings & Incentives S.r.l., is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). Our data protection declaration should be legible and understandable for the general public, as well as our clients and business partners. To ensure this, we would like to first explain the terminology used.

In this data protection declaration, we use, among others, the following terms:

a) Personal data

Personal data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b) Data subject

Data subject is any identified or identifiable natural person, whose personal data is processed by the controller responsible for the processing.

c) Processing

Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of processing

Restriction of processing is the marking of stored personal data with the aim of limiting their processing in the future.

e) Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

f) Controller or controller responsible for the processing

Controller or controller responsible for the processing is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

g) Processor

Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

h) Recipient

Recipient is a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

i) Third party

Third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

j) Legitimate Interest

Legitimate Interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party or party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

 

3)         Data controller

EMI – Meetings & Incentives S.r.l., acts as a data controller (Art. 24) for (i) the personal data relating directly to its clients and (ii) for its own employee management purposes.

 

4)         Data processor

EMI – Meetings & Incentives S.r.l., will from time to time act as a data processor (Art. 28) and may supply personal data to third party service providers, contractors and agents that provide services to us, to support the completion of projects and events (in which case our client is the controller).

Where we share personal data with sub-processors, we will use all reasonable means to ensure that they only process this information in accordance with this Privacy Policy.

 

5)         Legal basis for processing personal data

(Art. 6.1) lit. a GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, when processing operations are necessary for the supply of goods or to provide any other service, the processing is based on (Art 6.1) lit. b GDPR. The same applies to such processing operations which are necessary for carrying out pre-contractual measures, for example in the case of inquiries concerning our products or services. If EMI – Meetings & Incentives S.r.l., is subject to a legal obligation by which processing of personal data is required, such as for the fulfilment of tax obligations, the processing is based on (Art. 6.1) lit. c GDPR. In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if a data subject were injured and his name, age, health insurance data or other vital information would have to be passed on to a doctor, hospital or other third party. Then the processing would be based on (Art. 6.1) lit. d GDPR. Finally, processing operations could be based on (Art 6.1) lit. f GDPR. This legal basis is used for processing operations which are not covered by any of the above-mentioned legal grounds, if processing is necessary for the purposes of the legitimate interests pursued by EMI – Meetings & Incentives S.r.l., or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Such processing operations are particularly permissible because they have been specifically mentioned by the European legislator. He considered that a legitimate interest could be assumed if the data subject is a client of the controller (Recital 47 Sentence 2 the GDPR).

 

6)         Legal basis for processing personal data – Legitimate Interest

We have decided that the legal basis for our processing of your personal data is ‘Legitimate Interest’ to carry out our business, including to grow and improve our services and support our clients, provided those interests are not outweighed by your rights and interests. We have conducted a Legitimate Interest Assessment (LIA) to arrive at this decision, if you wish to receive a copy of this LIA, please contact to Privacy@emi-dmcitaly.com to request a PDF of the LIA.

 

7)         Data Processing of Special Category data

We may be required to process special category data which includes such items as medical history, passport information etc. (Art. 9) to facilitate the successful completion of projects, in this case we will only undertake this processing following explicit consent being obtained by the individual data subjects either by ourselves directly, or via our clients who have commissioned us to undertake the specific project. (Art. 9.2a)

 

8)         What information do we collect and why?

We will obtain personal information from you when you enquire about our activities, register with us, attend one of our events or otherwise provide us with personal information.

The types of information collected might include names, e-mail address, postal address, telephone number, mobile phone number, credit/debit card details and dietary or access requirements.

 

9)         What do we do with the information?

We will use the information you provide to:

  • fulfill your requests – such as provision of information about our services
  • process sales transactions, or other payments and verify financial transactions
  • handle event/service orders; deliver products and communicate with you about event/service orders
  • provide a personalized service to you when you visit our websites – this could include customizing the content and/or layout of our pages for individual users
  • record any contact we have with you
  • prevent or detect fraud or abuses of our websites and enable third parties to carry out technical, logistical or other functions on our behalf
  • communicate with our supplier partners, supporters and collaborators to fulfill our contractual obligations
  • provide you with information that we think may be of interest to you.

We may use generic photographs taken at our events for promotional purposes. In the event we use identifiable images of individuals, we will have sought and obtained written consent.

 

10)       Sharing your information

We will only share your information if:

  • We are legally required to do so, e.g., by a law enforcement agency legitimately exercising a power, if compelled by an order of the Court.
  • We believe it is necessary to protect or defend our rights, property or the personal safety of our people or visitors to our premises or websites.

We are working with carefully-selected partners that are carrying out work on our behalf. These partners may include, event organizers, supplier partners and venues, marketing agencies, accountants and IT specialists. The kind of work we may ask them to do includes sending emails, event registration and organization, processing card payments, etc. We only choose partners we can trust. Some of our suppliers may process data outside the EU, but we only share data with such recipients where appropriate standards and safeguards are in place. Whenever we share or transfer your personal information, we comply with the standards set by the GDPR and this privacy statement at a minimum.

 

11)       Storing your information

We take appropriate measures to ensure that the information disclosed to us is kept secure, accurate and up to date and kept only for so long as is necessary for the purposes for which it is used. We have security measures in place to attempt to protect against the loss, misuse and alteration of personal data under our control. For example, only authorized personnel can access user information. While we cannot ensure or guarantee that loss, misuse or alteration of data will not occur while it is under our control, we use our best efforts to try to prevent this.

 

12)       Retaining your information – data retention policy

If you have received marketing communications from EMI – Meetings & Incentives S.r.l., under our privacy policy and have not unsubscribed, you will be on our marketing communications mailing list unless you unsubscribe during this time.

Program Data is gathered by EMI – MEETINGS & INCENTIVES S.r.l. via secure, encrypted methods.  It is processed via secure email and stored on secure servers.  Client hard copy file folders for individual jobs/events will be available for a period of 10 years.  At that point, all hard copy documents will be shredded. Email correspondence between the client and EMI – Meetings & Incentives staff will remain available for a period of three (3) years.  At that point, Emails will be archived, and password-protected on a separate hard drive within the company, should information need to be retrieved.   Electronic data over ten (10) years that is archived, will be forensically deleted. EMI will maintain an electronic copy of the pertinent program information indefinitely unless you request removal of this information under your right to erasure, unless we are requires to retain it for legal reasons (Art.17).

 

13)       Children’s Privacy

From time to time we may be required to process children’s personal data (Art. 8), as part of completing an event or project, we understand the sensitively around the processing of children’s data and we take very seriously the responsibility for identifying the risks and consequences of the processing. Persons aged 16 or less are considered children.

We have chosen legitimate interests as the lawful basis for processing children’s data and we balance our own (or a third party’s) legitimate interests in processing the personal data against the interests and fundamental rights and freedoms of the child. We take appropriate measures, where necessary, to safeguard against those risks when processing a child’s personal data.

 

14)       Website cookies policy

We may use cookies to provide accurate monitoring reports to help us understand our users’ interests and preferences, to ensure that our website is as user friendly as possible.

Our website may use Google Analytics, a service provided by Google LLC that uses cookies to help the website analyze how users use this site. The cookies will generate information about your use of the website, and this along with your IP address will be stored on servers in the United States by Google LLC. This information is retained for the purposes of evaluating and compiling reports on website activity and for other services relating to internet usage. This information may be transferred to third parties by Google LLC where required to do so by law, or where such third parties process the information on their behalf. Your IP address will not be associated with any other data held by Google LLC.

If you do not agree to the processing of data about you by Google LLC in the manner and for the purposes set out above, you can select ‘disable cookies’ on your browser.

 

15)       Data protection provisions about the application and use of Google Analytics

On this website, the controller has integrated the component of Google Analytics. Google Analytics is a web analytics service. Web analytics is the collection, gathering, and analysis of data about the behavior of visitors to websites. A web analysis service collects, among others, data about the website from which a person has come (the so-called referrer), which sub-pages were visited, or how often and for what duration a sub-page was viewed. Web analytics are mainly used for the optimization of a website and to carry out a cost-benefit analysis of Internet advertising.

The operator of the Google Analytics component is Google LLC, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, United States.

The purpose of the Google Analytics component is to analyze the traffic on our website. Google uses the collected data and information, among others, to evaluate the use of our website and to provide online reports, which show the activities on our websites, and to provide other services concerning the use of our Internet site for us.

Google Analytics places a cookie on the information technology system of the data subject. The definition of cookies is explained above. With the setting of the cookie, Google is enabled to analyze the use of our website. With each call-up to one of the individual pages of this Internet site, which is operated by the controller and into which a Google Analytics component was integrated, the Internet browser on the information technology system of the data subject will automatically submit data through the Google Analytics component for online advertising and the settlement of commissions to Google. During this technical procedure, the enterprise Google gains knowledge of personal information, such as the IP address of the data subject, which serves Google, among others, to understand the origin of visitors and clicks, and subsequently create commission settlements.

The cookie is used to store personal information, such as the access time, the location from which the access was made, and the frequency of visits of our website by the data subject. With each visit to our Internet site, such personal data, including the IP address of the Internet access used by the data subject, will be transmitted to Google in the United States of America. These personal data are stored by Google in the United States of America. Google may pass these personal data collected through the technical procedure to third parties.

The data subject may, as stated above, prevent the setting of cookies through our website at any time by means of a corresponding adjustment of the web browser used and thus permanently deny the setting of cookies. Such an adjustment to the Internet browser used would also prevent Google Analytics from setting a cookie on the information technology system of the data subject. In addition, cookies already in use by Google Analytics may be deleted at any time via a web browser or other software programs.

In addition, the data subject has the possibility of objecting to a collection of data that are generated by Google Analytics, which is related to the use of this website, as well as the processing of this data by Google and the chance to preclude any such. For this purpose, the data subject must download a browser add-on under the link https://tools.google.com/dlpage/gaoptout and install it. This browser add-on tells Google Analytics through a JavaScript, that any data and information about the visits of Internet pages may not be transmitted to Google Analytics. The installation of the browser add-ons is considered an objection by Google. If the information technology system of the data subject is later deleted, formatted, or newly installed, then the data subject must reinstall the browser add-ons to disable Google Analytics. If the browser add-on was uninstalled by the data subject or any other person who is attributable to their sphere of competence, or is disabled, it is possible to execute the reinstallation or reactivation of the browser add-ons.

Further information and the applicable data protection provisions of Google may be retrieved under https://www.google.com/intl/en/policies/privacy/ and http://www.google.com/analytics/terms/us.html. Google Analytics is further explained under the following Link https://www.google.com/analytics/.

 

16)       Mailing lists

If you subscribe to our mailing list, you will be automatically subscribed to receive email updates.

We use MailChimp to manage our email marketing. MailChimp stores their data in the US, they comply with the EU-U.S. Privacy Shield Framework and the Swiss – U.S. Privacy Shield Framework. They do share data with third parties but never sell data.

You can change your email marketing preferences at any time, by clicking ‘unsubscribe’ on any of our emails or by contacting: Privacy@emi-dmcitaly.com

 

17)       Your rights

By providing us with your personal data, you consent to the collection and use of any information you provide in accordance with the above purposes and this privacy statement. You have the right to ask for a copy of the information we hold about you and to have any inaccuracies in your information corrected.

If you want to exercise these rights or update your personal details, please contact Privacy@emi-dmcitaly.com

 

18)       Data subject rights

As an individual whose personal data is processed by EMI – Meetings & Incentives S.r.l., Inc you have the following rights, where applicable:

To exercise any of these rights, please email Privacy@emi-dmcitaly.com to get in touch.

We reserve the right to amend this privacy statement. If we do so, we will post notice of the change on our website and you will be deemed to have accepted such changes.

 

19)       Employees and job applicants

If you apply to work at EMI – Meetings & Incentives S.r.l., we will only use the information you give us to process your application and to monitor recruitment statistics. If we want to disclose information to someone outside EMI – Meetings & Incentives S.r.l.,- for example, if we need a reference, or need to get a ‘disclosure’ from the Criminal Records Bureau – we will make sure we tell you beforehand, unless we are required to disclose this information by law.

If you are unsuccessful in your job application, we will hold your personal information for 12 months after we finish recruiting the post you applied for. After this date we will destroy or delete your information.

If you begin employment with us, we create a file about your employment. We keep the information in this file secure and will only use it for matters that apply directly to your employment.

Once you stop working for us, we will keep this file according to our record retention guidelines. You can contact us, Privacy@emi-dmcitaly.com to find out more about this.