We inform you that the personal data subject to processing may consist of an identifier such as a name, an identification number, location data, an online identifier or one or more elements characteristic of your physical, physiological, mental, economic, cultural or social identity.

The personal data processed are as follows:

a. Browsing data

The IT systems and software procedures used to operate the Platform acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified data subjects, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of computers used by users who connect to the Site, addresses in URI (Uniform Resource Identifier) notation of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the user's IT environment. These data are used solely to obtain anonymous statistical information on the use of the Platform to check its correct functioning, to identify anomalies and/or abuses, and are deleted immediately after processing. The data could be used to ascertain liability in the event of hypothetical computer crimes against the Controller or third parties.

b. Data provided voluntarily by you

Except for reference to specific privacy notices, this Privacy Policy applies to the processing of data voluntarily provided by you through the Platform. In this regard, we invite you not to enter in the forms contained therein information that may fall within the categories of special categories of personal data referred to in Article 9 of the Regulation, unless expressly requested.

c. Third-party data provided voluntarily by you

When using particular services, processing of personal data of third parties may occur, communicated by you to the Controller. With respect to these cases, you act as an independent data controller, assuming all legal obligations and responsibilities.

d. Data processed in interaction with social networks

Your registration on the Platform may also take place through the transmission of relevant data by another data controller (e.g. Facebook, Google, etc.). For example, by simply clicking on the "Register with Facebook" button, Facebook will automatically send some of your data, specified in the appropriate "pop-up" window, and there will be no need for you to fill in other forms.

e. Special categories of data

The Controller may process special categories of data, where such processing is necessary for carrying out its legitimate activities, or concerns personal data manifestly made public by the data subject.

f. Geolocation

The Controller may process data relating to your location and movements in order to provide you with the requested services. For example, the data subject will have the possibility to view their geographical position within a map showing the nearest locations where they can practice their performing art. The user always has the possibility to deny the Platform access to location data through their device settings. 

Your personal data will be processed, with your consent where necessary, for the following purposes, where applicable:

• 3.1. to allow your membership in OAI and/or to allow the provision of services requested/offered on the Platform; among these services, some necessarily involve data processing for profiling purposes, as they are personalized services.

• 3.2. to respond to specific requests addressed to the Controller;

• 3.3. for OAI's institutional and statutory purposes as well as to fulfill legal, administrative and tax obligations.

• 3.4. to carry out direct marketing activities, unless you expressly refuse during registration or subsequently object by simple communication to the Controller.

• 3.5. for statistical purposes, without it being possible to trace your identity.

Specific security measures are observed to prevent data loss, unlawful or incorrect use and unauthorized access.

The legal basis for the processing of personal data for the purposes referred to in sections 3.1 and 3.2 is Article 6(1)(b)(c) of the Regulation, as processing is necessary for the provision of services and to fulfill a legal obligation. With particular reference to processing concerning your data belonging to special categories and related to the provision of services referred to in section 3.1, it is based on Article 9(2)(d)(e) of the Regulation; as regards the processing of your data for profiling purposes related to the provision of services, referred to in section 3.1, such processing finds its legal basis in Article 22(2)(a) as it is necessary for the conclusion or performance of a contract between the data subject and a data controller.

The purpose referred to in section 3.3 represents lawful processing of personal data pursuant to Article 6(1)(c) of the Regulation ([…]processing is necessary to comply with a legal obligation to which the controller is subject). Once personal data has been provided, processing is indeed necessary to comply with legal obligations to which OAI is subject.

The provision of personal data for the purposes described above is optional, but failure to provide it would make it impossible for OAI to establish the membership relationship and/or to provide the requested services.

The processing carried out for the marketing purposes described in section 3.4 is based on Article 6(1)(f) ([…]processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child). OAI's legitimate interest is based on the existence of a relevant and appropriate relationship between the Controller and the data subject and on the latter's reasonable expectations of receiving information aimed at satisfying their needs ("Processing personal data for direct marketing purposes may be regarded as carried out for a legitimate interest" See Recital 47 of the Regulation).

The provision of your personal data for the purpose referred to in section 3.4 is completely optional and does not affect the use of services. You may therefore deny the relevant authorization already during registration or object subsequently by simple communication to be sent to the Controller at the contacts indicated in the "Contacts" section of this privacy policy or, where available, through the Platform "settings". Finally, it should be noted that the processing referred to in section 3.5 is not performed on personal data and therefore can be freely carried out by the Controller.

Your personal data may be shared, for the purposes referred to in section 3 of this Privacy Policy, with:

5.1. subjects who typically act as data processors, namely: i) persons, companies or professional firms that provide accounting, administrative, legal, tax and financial assistance and consultancy services to OAI; ii) subjects delegated to carry out technical maintenance activities; iii) credit institutions, insurance companies and brokers;

5.2. subjects, entities or authorities to whom it is mandatory to communicate your personal data by virtue of legal provisions or orders from authorities;

5.3. persons authorized by OAI to process personal data necessary to carry out activities strictly related to the provision of services, who have committed to confidentiality or have an adequate legal obligation of confidentiality;

5.4. any licensees and/or concessionaires of the Platform.

Some of your personal data may be shared with recipients outside the European Economic Area. The Controller ensures that the processing of your personal data by these recipients takes place in compliance with the Regulation. Indeed, transfers may be based on an adequacy decision or on Standard Contractual Clauses approved by the European Commission. Further information is available by sending a written request to the Controller at the contacts indicated in the "Contacts" section of this privacy policy.

Personal data processed for the purposes referred to in sections 3.1 and 3.2 will be retained for the time necessary to achieve those same purposes.

Personal data processed for the purposes referred to in section 3.3 will be retained until the time provided by the specific obligation or applicable legal provision.

For the purposes referred to in section 3.4, your personal data – where you have not expressed your refusal – will be processed until your possible objection. In any case, the controller reserves the right to retain your personal data for the period of time provided for and permitted by Italian law to protect its interests (Article 2946 of the Italian Civil Code et seq.). Further information is available by sending a written request to the Controller at the contacts indicated in the "Contacts" section of this privacy policy.

Pursuant to Articles 15 et seq. of the Regulation, you have the right to request from the Controller, at any time, access to your personal data, their rectification or erasure, or to object to their processing pursuant to Article 21 of the Regulation. You also have the right to request restriction of processing in the cases provided for in Article 18 of the Regulation, as well as to obtain in a structured, commonly used and machine-readable format the data concerning you, in the cases provided for in Article 20 of the Regulation.

Where processing is based on Articles 6(1)(a) and 9(2)(a), you will have the right to withdraw consent at any time without prejudice to the lawfulness of processing based on consent given before withdrawal. Requests should be addressed in writing to the Controller at the contacts indicated in the "Contacts" section of this privacy policy.

Where the communication of your personal data is a legal or contractual obligation or a requirement necessary for the conclusion of a contract, you are obliged to provide your personal data. Your failure to communicate such data will make it impossible for the Controller to follow up on your request and provide services.

OAI has the right to use automated systems/processes and automated decision-making (such as profiling) to offer you the requested services. For example, if a client is looking for artists/members for certain performance shows, OAI could conduct a search among its members using certain automated criteria that take into account availability, location, area of expertise and experience gained.

In any case, you always have the right to lodge a complaint with the competent supervisory authority (Italian Data Protection Authority - Garante per la protezione dei dati personali), pursuant to Article 77 of the Regulation, if you believe that the processing of your data is contrary to the legislation in force..

OAI reserves the right to modify or simply update the content of this Privacy Policy, in part or completely, also due to changes in applicable legislation. Such changes will be binding as soon as they are published on the Site. The Controller therefore invites you to regularly visit this section to become aware of the most recent and updated version of the Privacy Policy so as to always be updated on the data collected and the use that OAI makes of it.

To exercise the rights referred to in this privacy policy, you may write to the Controller: Outdoor Arts Italia ETS, Tax Code 96395280587, VAT No. 07510401008, with registered office at Piazza della Repubblica 27 Castellamonte (TO) 10081 and at the addresses: [email protected] or  [email protected]