Information for fairs and events

When you take part in an event organised by Valcucine S.p.A. – or in which Valcucine participates – we may collect and use certain information about you. With this notice, we want to explain clearly and transparently which data we process, why we do so, and which rights you can exercise.

1. Who processes your data
   Your data is processed by Valcucine S.p.A., Tax Code 00407160936, with registered office in Via Luciano Savio 11, 33170 Pordenone (PN). For any request or doubt, you can write to us at: privacy@valcucine.it
   Valcucine has not appointed a DPO.

2. Which data we collect during events
   During the activities, we may collect:
   • photographs;
   • video and audio recordings;
   • contact details you voluntarily provide (for example through forms, business cards, newsletter subscriptions, etc.).

Images may capture the overall event (ambient or group shots) or, in some cases, close-ups.

3. Why we process this data (purposes of the processing and legal basis)

During events, we take photos and videos to document the atmosphere, the activities carried out and the most significant moments.
This material may be shared through:
• Valcucine and ICG Group websites;
• official social media;
• brochures, catalogues and corporate materials;
• press releases and editorial content.

On which legal basis?
• If you appear in generic and non-prevalent images, the legal basis is the Controller’s legitimate interest.
• If the image portrays you in a recognisable close-up, we rely on your consent.

b) To manage the event
We may use data for organisational communications, registration management, access control, recordings and logistical activities.
Legal basis: performance of pre-contractual or contractual measures.

c) To send you updates or post-event communications
If you decide to subscribe to newsletters or request informational materials, we will use your data to keep you updated.
Legal basis: your consent.

4. How data is processed (Processing methods)
   We process images, videos and any contact data collected during the event in a simple, secure manner that respects your privacy.
   This means that:
   • we use electronic and digital tools (e.g., cameras, camcorders, storage software);
   • in some cases, we also store images in analogue form (e.g., frames or exported copies for the communication office);
   • access to images is granted only to authorised, trained personnel bound by confidentiality;
   • we do not use facial recognition, profiling or biometric analysis systems;
   • we adopt security measures to avoid:
   – unauthorised access,
   – alterations,
   – accidental deletion,
   – unintentional disclosure through devices.

In practice, files concerning you are processed exclusively for event and corporate communication purposes, and we do not carry out any operation that may affect your behaviour, rights or personal freedoms.

If you request deletion or restricted use, we will block the image within the technical limits of our systems (for example: we can remove photos from our archives, but we cannot delete images already shared by third parties on their social profiles).

5. Transfers abroad
   If we publish content on platforms such as Facebook, Instagram, LinkedIn or YouTube, some data may be transferred to countries outside the European Union. These transfers always comply with the safeguards provided for in Articles 45–49 of the GDPR.

6. How long we store images
   Images and videos created during the event are stored only for the time strictly necessary to achieve communication and documentation purposes. The maximum retention period is 5 years.

However:
• if you ask to withdraw consent or no longer wish to appear, we will delete the image from our systems;
• if the files are still on our servers, deletion can be performed quickly;
• if they have already been shared on online platforms (e.g., Instagram, Facebook, YouTube), removal also depends on the providers’ policies and may not always be complete;
• if the content has been reused by third parties (news outlets, press agencies, content creators), we can only notify them of your request, but we cannot guarantee deletion on their side.

Data is also automatically deleted:
• if no longer necessary,
• if no longer consistent with the original purposes,
• or if a legal obligation requires its deletion.

7. Who we share data with (Recipients)
   To correctly manage event activities and content communication, certain categories of recipients may access your data.
   Here is who may access it:

a) Authorised internal staff
Only trained and authorised personnel of Valcucine S.p.A., such as:
• marketing and communication office,
• events office,
• staff managing social channels.
These persons process data only when necessary and in compliance with confidentiality.

b) External suppliers supporting us (Processors)
These are subjects working for or with us, processing data solely on behalf of Valcucine:
• photographers, videomakers, appointed journalists;
• communication and PR agencies;
• companies managing social channels or websites;
• IT providers helping us manage IT systems, hosting, storage, cloud, server maintenance;
• companies producing contents, brochures, catalogues.

These subjects:
• are bound by a Data Processing Agreement (Art. 28 GDPR),
• process data only according to our instructions,
• cannot use it for their own purposes.

c) Independent third parties
Some subjects do not act under our instructions but may nonetheless process the data once disseminated:
• social platforms (Meta, LinkedIn, Google/YouTube, etc.);
• media outlets, news organisations or broadcasters;
• commercial partners involved in the event;
• trade fair organisers or hosting venues (if necessary);
• public authorities (only when required by law).

In such cases, data is processed independently according to their respective privacy notices.

d) We never transfer images to third parties for commercial purposes
Valcucine does not sell, transfer or commercially exploit images of data subjects for purposes other than those declared.

8. Your rights (Arts. 15–22 GDPR)
   The GDPR grants you several rights concerning your personal data. Below, we explain them clearly with specific reference to the context of events and photographic/video recordings.
   You can exercise your rights by writing to: privacy@valcucine.it
   We will reply within 30 days, extendable if necessary.

8.1. Right of access (Art. 15 GDPR)
What it means:
You can ask to know whether Valcucine processes data about you and, if so, receive:
• confirmation of the processing,
• detailed information about methods and purposes,
• a copy of the personal data processed (in this case, images or videos in which you appear).

When you can exercise it:
Always, whenever you wish to verify:
• whether you were recorded,
• whether images were stored,
• where they were published.

Practical limitations in event contexts: access may be limited when:
• the image contains other people who cannot be technically obscured,
• the image has already been overwritten or deleted from systems,
• the request concerns recordings already transferred to third parties (e.g., media, social networks),
• the delivery could compromise the security or rights of third parties.

In such cases, we will still provide a reasoned response and, if possible, a general description of the processing or a still image that does not identify third parties.

8.2. Right to rectification (Art. 16 GDPR)
What it means:
This right allows you to correct inaccurate personal data.

Application to photos/videos:
Images cannot be “rectified” like written data — it is not technically possible to modify your face in a video or “correct” a shot without creating new content.

When rectification is not possible:
• for content already published on platforms we do not control (e.g., social media),
• for images already shared with media outlets or distributed based on previously granted permissions.

8.3. Right to erasure – “right to be forgotten” (Art. 17 GDPR)
What it means:
You can request that images in which you are recognisable be deleted.

When you can exercise it:
• if you gave consent and now withdraw it,
• if you no longer want your images to be used,
• if you believe the use is not compliant with the GDPR.

When deletion is possible:
• when the images are in Valcucine’s systems,
• when they are no longer necessary,
• when withdrawal of consent does not affect overriding interests.

When it may not be possible to delete everything:
• if the file was already published online and cannot be fully removed,
• if it was shared by third parties (media, websites, social networks),
• if it is necessary to defend a right in legal proceedings.

We will always inform you about the extent of our control and what is technically feasible.

8.4. Right to restriction of processing (Art. 18 GDPR)
What it means:
You can request that an image no longer be used for a certain period, without being deleted.

Practical examples:
• suspending publication while we examine a complaint,
• blocking use of the image while awaiting clarification,
• preventing further dissemination even if the file remains archived.

When applicable:
• if you contest the lawfulness of the processing,
• if we need time to verify a request,
• if data is necessary to exercise a right but not for publication.

8.5. Right to data portability (Art. 20 GDPR)
What it means:
You can ask to receive personal data you have provided in a readable format (e.g., contact details provided at the desk or in forms).

In the context of photos/videos:
This right does not apply to images because:
• they are not “data provided by the data subject”,
• they are not processed based on contractual consent,
• they are not generated by automated processing.

You may instead receive your identification data collected during event registration.

8.6. Right to object (Art. 21 GDPR)
What it means:
You can object at any time to:
• the use of images,
• their publication,
• their storage,
• recordings that portray you in an identifiable way.

When it is effective:
For recordings based on legitimate interest, Valcucine will assess your objection and, if no overriding compelling reasons exist, proceed with removal.

Practical examples:
• you do not want to appear in event photos,
• you notice you appear in a recording published on social channels,
• you request that a video interview no longer be used.

When it may be rejected:
Only if the use of the image is necessary to:
• defend a right in court,
• document relevant facts,
• respond to an authority’s request,
• in cases of technical impossibility or lawful dissemination through channels beyond the Controller’s control.

8.7. Right not to be subject to automated decision-making (Art. 22 GDPR)
What it means:
No software may take decisions about you without human involvement.

In Valcucine event contexts:
• we do not use facial recognition systems,
• we do not use algorithms that analyse your behaviour,
• we do not perform automated profiling on your face or images.

8.8. How to submit a request and right to lodge a complaint
You can write to: privacy@valcucine.it
We will respond within 30 days. If the request is complex, we will inform you in advance—before the 30-day deadline—that more time is needed.

You retain the right to lodge a complaint directly with the Supervisory Authority as provided for in Art. 77 GDPR, by contacting the Italian Data Protection Authority at: https://www.garanteprivacy.it