CCTV SURVEILLANCE

At the headquarters of Fiere Internazionali di Bologna – BolognaFiere S.p.A. (hereinafter also referred to as “BolognaFiere” or the “Data Controller“) in Viale della Fiera, 20 – 40127 Bologna/Italy, there is a video surveillance system in operation, through which images relating to you can also be recorded.

The images constitute personal data and as such are subject to the rules on the protection of personal data set out in Legislative Decree no. 196/2003 as amended by Legislative Decree no. 101/2018 (the “Amended Privacy Code“), Regulation (EU) no. 2016/679 (hereinafter the “GDPR“), to the Measure on video surveillance – 8 April 2010, issued by the Guarantor Authority for the protection of personal data (“Measure of the Guarantor“) and art. 4 of Law no. 300/1970 (hereinafter, the “Workers’ Statute“).

Pursuant to art. 13 of the GDPR, BolognaFiere, in its capacity as Data Controller and Employer, informs you that the personal data concerning you, collected from you through the video surveillance system referred to above, will be processed in compliance with the above and in accordance with the information below.

BolognaFiere also informs you that, pursuant to the provisions of art. 4 of the Workers’ Statute, the video surveillance system in question was the subject of the trade union agreement signed on 20^th February 2019 with the R.S.A. and subsequent integrations.

Data Controller, Data Processors and Data Protection Officer.

The Data Controller is Fiere Internazionali di Bologna – BolognaFiere S.p.A., with registered office in Bologna/Italy, Viale della Fiera n. 20. The complete list of persons appointed as Data Processor pursuant to art. 28 of the GDPR is available at the Data Controller’s offices and can be requested by sending a communication to the email address privacy@bolognafiere.it .

The Data Protection Officer, designated by the Data Controller, may be contacted at the following e-mail address: dpo@bolognafiere.it .

Purpose and legal basis of the processing. Legitimate interests pursued.

Your personal data will be processed, without your consent being required, in accordance with art. 6, c. 1, letter f) of the GDPR for the pursuit of the legitimate interest that the Data Controller, on the basis of the balancing of interests carried out by the Guarantor for the Protection of Personal Data in the aforementioned Measure, has identified in the protection of corporate assets, occupational safety and organizational and production needs.

Methods of processing.

Your personal data will be processed by electronic means and in such a way as to ensure the security and confidentiality of data, in accordance with the provisions of the GDPR and the Provision of the Guarantor.

Recipients or categories of recipients.

The images will be processed, where present, by the Data Processor, specifically appointed by the Data Controller, and/or by the persons in charge of surveillance and security, who have received specific instructions in this regard, as well as by the persons in charge of processing within the scope of the tasks assigned to them. In relation to the occurrence of any offences, investigations or reasoned requests, they may be communicated to the judicial or police authorities.

Retention period.

Your personal data will be kept for a period of time not exceeding 7 (seven) days after they were collected, after which they will be deleted by overwriting new images, except for special needs for further storage in connection with holidays or closure of offices or in the event that it is necessary to comply with a specific request for investigation by the Judicial Authority or the Judicial Police.

The aforesaid period of registration has been established trying to reconcile the purposes of protection of privacy with those pursued through the video surveillance system (considering, in particular, that offences of not great dimensions, but of high danger in terms of potential damage to company assets, could not be discovered in the 24 hours of time from the commission).

Access, cancellation, limitation and portability rights.

As a data subject, you are entitled to the rights set out in Articles 15 to 20 of the GDPR. By way of example, you may:

• obtain confirmation that personal data concerning you are being processed or not;

• if any processing is in progress, obtain access to your personal data and information relating to the processing and request a copy of your personal data;

• to obtain, if one of the conditions provided for by art. 17 of the GDPR is met, the cancellation of personal data concerning you;

• obtain, in the cases provided for in Article 18 of the GDPR, a limitation of treatment;

• receive personal data concerning you in a structured format, commonly used and readable by automatic device and request their transmission to another owner, if technically feasible.

 Right of opposition.

You have the right to object at any time to the processing of your personal data. In case of opposition, your personal data will no longer be processed, unless there are legitimate reasons to proceed with the processing that prevail over your interests, your rights and your freedoms and provided that the processing is not necessary for the establishment, exercise or defense of a right in court.

Right to complain to the Guarantor.

You may also lodge a complaint with the Personal Data Protection Authority if you believe that your rights under the GDPR have been violated, in accordance with the procedures indicated on the website of the Personal Data Protection Authority accessible at: www.garanteprivacy.it .