Privacy Policy Information notice for newsletter

PRIVACY POLICY – Newsletter Subscription
Information notice for the processing of personal data pursuant to and for the effects of Article 13 Reg. (EU) 2016/679

In compliance with the provisions of EU Reg. 2016/679 (European General Data Protection Regulation), we provide you with the necessary information regarding the processing of personal data provided for sending the newsletter.

FOREWORD
“EFIM–ENTE FIERE ITALIANE MACCHINE SPA” and “CEU – CENTRO ESPOSIZIONI UCIMU S.P.A.” (hereinafter the “Parties”), through a joint controllership agreement, have expressed their intention to jointly manage the services and organisational activities of BI-MU.

1. (JOINT) DATA CONTROLLERS AND POINT OF CONTACT
The joint data controllers for the processing of personal data subject to this information notice (hereinafter also referred to simply as “joint controllers”) are:

• CEU – CENTRO ESPOSIZIONI UCIMU S.P.A., with registered office in Viale Fulvio Testi 128, 20092 – Cinisello Balsamo (MI), Italy, represented by its pro-tempore legal representative (hereinafter, “CEU”)
• EFIM–ENTE FIERE ITALIANE MACCHINE SPA, with registered office in Viale Fulvio Testi 128, 20092 – Cinisello Balsamo (MI), Italy, represented by its pro-tempore legal representative (hereinafter, “EFIM”)

Without prejudice to the data subject’s right to exercise their rights against each joint controller, the point of contact for data subjects has been identified at the following email addresses: privacy@ucimu.it and the DPO at the following contact: rdpefim@ucimu.it.

DATA PROTECTION OFFICER AND CONTACT DETAILS
For CEU: Email: rdpefim@ucimu.it
For EFIM: Email: rdpefim@ucimu.it

2. MAIN DEFINITIONS
Personal data: any information relating to an identified or identifiable natural person («data subject»); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

3. PURPOSE OF PROCESSING, LEGAL BASIS, RETENTION PERIOD, NATURE OF DATA PROVISION

PURPOSE OF PROCESSING	LEGAL BASIS	DATA RETENTION PERIOD	NATURE OF DATA PROVISION
A) Subscription to EMO MILANO newsletters	Processing is based on consent to the processing of personal data (C42, C43). Art. 6 par. 1 point a) of the GDPR.	Until withdrawal of consent (or opt-out).	The provision of data is optional. Failure to provide the data makes it impossible to receive direct marketing communications, but does not affect your participation as an exhibitor for the purposes indicated under letter A).
B) Management of requests concerning personal data protection and requests from other data subjects, pursuant to Articles 15 et seq. of the GDPR (rights of the data subject).	Processing is necessary for compliance with a legal obligation to which the data controllers are subject (C45). Art. 6 par. 1 point c) of the GDPR.	5 years from the closure of the request, except in case of disputes.	The provision of personal data is mandatory, as it is essential to comply with legal obligations.

4. RECIPIENTS OF DATA
Personal data may be disseminated strictly within the limits of the purpose referred to under letter d). The personal data provided will be communicated to employees or collaborators of the joint controllers who will process the data as authorised persons acting under the authority of each joint controller for the purposes listed above (Art. 29 GDPR). The personal data provided may be communicated to third parties contractually linked to the joint controllers in order to comply with contractual obligations and related purposes indicated above, and specifically, data will be communicated to:

• entities providing services for the management of the information system used by the joint data controllers and telecommunication networks;
• freelancers collaborating with the joint data controllers for the purposes set out in this information notice;
• competent authorities for compliance with legal obligations and/or provisions of public bodies.

The list of appointed Data Processors is available by writing to the contact point indicated above.

5. DATA TRANSFER TO NON-EEA COUNTRIES | INTERNATIONAL ORGANISATIONS
Personal data will not be transferred to Non-EEA Countries.

6. IS THERE AN AUTOMATED PROCESS?
Personal data will be subjected to traditional manual, electronic, and automated processing. It is specified that fully automated decision-making processes are not carried out.

7. RIGHTS OF THE DATA SUBJECTS
Data subjects may assert their rights as expressed in Articles 15 et seq. of the GDPR, by writing to the single point of contact privacy@ucimu.it or by contacting the DPOs at the address rdpefim@ucimu.it.

The joint controllers guarantee data subjects the possibility to request, at any time, access to their personal data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18). The data controllers shall communicate (Art. 19) any rectification, erasure, or restriction of processing carried out to each recipient to whom the personal data have been disclosed. The data controllers shall inform the data subject about those recipients if the data subject requests it.

To no longer receive automated direct marketing communications (email), it will be sufficient to write an email at any time to privacy@ucimu.it with the subject “cancellation from automated” or use the automatic unsubscription systems provided for emails by the joint controllers.

If data subjects believe that the processing of personal data carried out by the Data Controllers occurs in violation of the provisions of Regulation (EU) 2016/679, they are free to lodge a complaint with a national Supervisory Authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement (Italian Data Protection Authority https://www.garanteprivacy.it/), or to take appropriate judicial action.

8. CHANGES TO THE PRIVACY POLICY
The controllers may change, modify, add, or remove any part of this Privacy Policy. In order to facilitate the verification of any changes, the policy will contain an indication of the update date of the policy itself.

Update date: 1 June 2026