SUMMARY OF THE JOINT OWNERSHIP AGREEMENT IN THE PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH ARTICLE 26 OF REGULATION (EU) 2016/679 ("GDPR")

ICE Agency and Italian Exhibition Group Spa ("IEG") jointly carry out research activities for buyers / operators in the product sectors for the exhibition / events of interest (from now on the "Events"), also inviting buyers / sector operators to the Events themselves. ICE Agency and IEG collaborate for the contact activities of buyers, also interacting together on the Digital Platform also dedicated to Buyers;

With this agreement, the ICE Agency and IEG establish a relationship of joint ownership for the processing of personal data acquired, managed and processed in the context of the activities and determine their respective responsibilities regarding compliance with the obligations regarding the protection of personal data . With this agreement, the Parties also establish their respective obligations regarding the exercise of the rights of the interested parties and their respective roles regarding the disclosure of the information.

The joint ownership refers to the processing of personal data, as defined in Article 4, paragraph 2 of the Regulations and concerns the processing of all personal data acquired and managed within the scope of the activities.

The Parties agree that, pursuant to Article 26, paragraph 3 of the Regulations, regardless of the provisions of this agreement, the interested party may exercise their rights towards each Joint Data Controller.

OBLIGATIONS AND RESPONSIBILITIES OF THE CO-HOLDERS

The Joint Controllers share the decisions relating to the purposes and means of the processing of personal data acquired, managed and processed as part of the activities.

In particular, with this agreement, ICE Agency and IEG agree that:

in compliance with the principles of proportionality and minimization referred to in Article 5 of the Regulation, only adequate, relevant and limited to what is necessary with respect to the specific purposes pursued through the processing will be acquired and processed

1. the processing will be carried out through the use of paper and computerized procedures;
2. the data may be disclosed to: i) external structures, which perform support tasks on behalf of the ICE Agency and IEG (eg IT services), in their capacity as Data Processors; ii) public (eg. Embassies, foreign institutions) and / or private entities (eg. structures hosting the mission) for the fulfillment of the obligations established by law or contract, which carry out their respective processing activities as independent data controllers;
3. the information referred to in Article 13 of the Regulation will be drawn up jointly by the Joint Controllers, who must specify in the information itself, in a clear and understandable way for the interested party, the joint ownership of the processing between the ICE Agency and IEG;
4. the information referred to in Article 23 of the Regulations will be provided when collecting personal data by the Joint Controller who, from time to time, is responsible for the collection activity;
5. the personal data will be processed for the time strictly necessary to achieve the purposes pursued through the processing.

The Joint Controllers undertake to authorize and provide suitable instructions to the natural persons who are part of their organization to process personal data and to appoint, where the conditions exist, as Data Processors the external subjects who may possibly intervene in the processing operations on behalf of the Joint Controllers. .

The interested parties may exercise their rights separately with respect to each Joint Data Controller (Article 14 to 21 of the Regulation), in relation to the processing of data under the respective competence of each, as from now on it is expressly understood that any joint and several liability between the Co-owners. In any case, the Parties will promptly inform each other in writing about complaints and any requests to exercise the rights by the interested parties, and will provide each other with the necessary collaboration to promptly deal with the aforementioned requests. coming from them. The Parties also undertake, on request, to make the essential content of this agreement available to interested parties, pursuant to Article 26, paragraph 2, of the Regulation.

In the event that Italian Exhibition Group intends to process, for its own marketing or soft spam and / or profiling purposes, in a totally independent way from Agenzia ICE and outside the scope of the purposes described above connected to the activities specified in the introduction, the personal data of buyers and / or representatives of third party partners and / or other interested parties, provided by Agenzia ICE or otherwise acquired in relation to the planning and management of the activities described above, Italian Exhibition Group will have to comply with any legal obligation relevant in this case, in compliance with all applicable regulations, with the express exclusion, in any case, of any responsibility of the ICE Agency with respect to such further processing which is the exclusive competence of IEG.

In the event that Agenzia ICE intends to process the personal data of buyers and / or representatives for its own direct marketing purposes, in a totally independent manner from Italian Exhibition Group and outside the scope of the purposes described above connected to the activities envisaged in the introduction. of third party partners and / or other interested parties, provided by Italian Exhibition Group or otherwise acquired in relation to the planning and management of the aforementioned activities, Agenzia ICE must assess, under its sole responsibility, the need to independently obtain a prior separate consent expressed by the persons to whom the data refer, and to fulfill any other legal obligation relevant to the case in point, in compliance with any applicable law; with the express exclusion, in any case, of any liability of Italian Exhibition Group with respect to any such further processing.

CONFIDENTIALITY

The Parties undertake to maintain and have their employees and collaborators and authorized consultants maintain the confidentiality of the personal data acquired, managed or processed by virtue of the joint ownership relationship established with this agreement.

SAFETY OF THE INFORMATION

The Joint Controllers are required to put in place all the appropriate technical and organizational security measures to protect the personal data acquired, managed or processed by virtue of the joint ownership relationship established with this agreement.

The Joint Controllers will adopt all technical and organizational security measures for the timely recovery of the availability of personal data in the event of a physical or technical accident.

In the event of a breach of personal data pursuant to Article 4, paragraph 1, no. 12) of the Regulations, the Party that has undergone it promptly informs the other Party and provides pursuant to Articles 33 and 34 of the Regulations.

SUMMARY OF THE JOINT OWNERSHIP AGREEMENT ICE-IEG – REV.14.12.2020