Information regarding the processing of personal data pursuant to art. 13 of EU Regulation 2016/679

Pursuant to and for the purposes of Article 13 of EU Regulation 2016/679 (hereinafter referred to as the “Privacy Regulation” or “GDPR”), the Company XMetaReal Italia Srl hereby issues this information notice regarding the processing of personal data, on the occasion of the Metaverse Generation Summit 2023 (hereinafter also referred to as the “Summit” or “event”).

1. Data Controller and Data Processor

The “Data Controller” is the Company XMetaReal Italia Srl, with registered office in Via Mascheroni no. 14 – Milan, and Operational Headquarters in Via Cassala no. 57 – Milan, in the person of the legal representative pro tempore domiciled at the registered office of the Company (hereinafter referred to as the “Controller”).

The Data Controller may appoint other ‘Data Processors’ (hereinafter referred to as the ‘Processors’), as well as Persons in Charge authorised to carry out processing operations.

Pursuant to Article 37 of the GDPR, the Company has appointed a ‘Data Protection Officer’ (hereinafter referred to as the ‘DPO’), in the person of Mr. Cosimo Calabrese.

You can contact the Controller and the DPO at the following e-mail address: privacy@xmetareal.com.

2. Type of data processed

The Company may collect and process data referring to participants of the event; this is ordinary personal data, such as: identification data, contact data (telephone number and e-mail address), data referring to work activity (company, location, role, professional experience). This is data provided directly by the data subject.

In addition, images or audio/videos of event participants may be recorded, live or via the Metaverso platform.

No special category data will be collected or processed.

Participating in the event while connected to the Metaverso platform will allow the participant to optionally enter other personal information such as a photograph and e-mail address, which will be immediately visible to all participants. It will not be possible to disclose data referring to other persons, which is not collected and recorded by the data controller.

3. Purpose of data processing

The processing will be carried out, first and foremost, for the purpose of participating in the Metaverse Generation Summit 2023 event. This involves related administrative and management activities, such as managing registrations for the event, activating the session via a special link and sending participants notices related to the event or immediately following the event.

In accordance with Art. 6 of the GDPR, the legal basis for the processing is the performance of the services requested by the data subject (para. 1(b)).

The same data may be processed for invitations to participate in subsequent editions of the ‘Metaverse Generation Summit’.

In accordance with Art. 6 of the GDPR, the legal basis for the processing is the legitimate interest of XMetaReal Italia Srl in developing a relationship with the event participants, to enable them to continue their experience of learning about the Metaverse (para. 1(f)).

4. Nature of data provision and consequences of a refusal to provide data

The provision of data for participation in the event is compulsory; indeed, failure to provide such data would make it impossible to take part in the event, for which a registration is required and during which audio/video recordings will be made.

 

 

5. Methods of data processing

Data processing is carried out by personnel expressly appointed by the Data Controller and duly trained in data processing, also by means of electronic or, in any case, automated, computerised and telematic tools, and in any case with methods strictly related to the aforementioned purposes, in order to guarantee the confidentiality and security of the data.

During the course of the event, those participating while connected to the Metaverso platform will be able to view the data of other participants in real time:

• Full name, company affiliation and role: entered by the organiser;
• any other personal data: entered voluntarily by participants and in any case related to the theme of the event and their work.

The Company processes data in compliance with the principles of lawfulness, correctness, transparency, accuracy, integrity and non-excessiveness, relevance and necessity with respect to the purposes intended, guaranteeing the protection of confidentiality and the rights of third parties.

6. Data retention

Data will be processed for the period necessary to achieve the purposes for which it was collected:

1. personal data related to the platform used will be transmitted live; such personal data will therefore not be stored beyond the end of the event session (login data);
2. the data collected for registration to the event will be retained for a period of 24 months after the end of the event, also in order to allow the Organisation to process the data to invite participants to a new event;
3. Image and audio/video data will be stored indefinitely, within the materials collected during the event.

7. Data recipients and transfer to third countries

In order to fulfil specific legal obligations or for reasons strictly related to the organisation and management of the event and the Community, the data may be disclosed to the following recipients: service providers, including IT and technology providers; consultants and freelance professionals in legal, tax and commercial matters; police or judicial authorities.

The communication of the data of third parties to the above-mentioned entities shall take place in compliance with the levels of protection and safeguarding of the rights of the data subject as set out in the Privacy Regulation.

The data will be processed within the European Union.

8. Data subject’s rights

 As stipulated in Article 13 of the EU Privacy Regulation 2016/679, you may at any time:

• request from the Data Controller access to your personal data and the rectification or deletion thereof or the restriction of processing that concerns you;
• the purpose of the processing of your personal data;
• exercise the right to data portability;
• file a complaint with a supervisory authority.

The rights described above may be exercised by making an informal request to the Data Controller at the addresses given in paragraph 1.

9. Release for use of audio/video recordings

By attending the event, the registered participant:

Authorises XMetaReal Italia S.r.l. or its successors in title to use the recording made by camera of my image, photographic images and voice, including where appropriate by reduction or adaptation.

Authorises publication, distribution and broadcasting on the Internet/Intranet/Metaverse and in any other possible and new medium via film, tape, and digital and other media, present and future.

Acknowledges that XMetaReal Italia Srl may use, at its own discretion, the video footage and audio recordings for promotion purposes, as well as through publication in any other material promoting the initiative.

Grants to XMetaReal Italia Srl exclusively and definitively, all rights to the video and photographic images and voice recordings without any limitation of space or time, for their use in any form and by any means, for the purposes related to the promotion of XMetaReal Italia Srl’s activity on any media.

Declares that he/she shall have nothing to claim from XMetaReal Italia Srl and/or its assignees, for any reason whatsoever, in respect of the use by the same Company and/or its assignees and/or related companies of his/her image and voice.

10. Amendment of the personal data processing notice

The Controller reserves the right to change, update, add or remove parts of this privacy policy at its own discretion and at any time. In order to facilitate this, the disclosure will contain an indication of the update date.

Revision 01

Update: March 9, 2023