Information on the processing of personal data for participants in the GoBeyond Program

The Data Controller is Sisal S.p.A., with registered office in 20159 Milan, via Ugo Bassi n. 6, which can be contacted at privacy_sisal@legalmail.it.

The Data Controller employs a Data Protection Officer, also known as a “Data Protection Officer” or “DPO”. The DPO can be contacted at the following email address: dpo@fluttersea.com.

The personal data subject to processing are acquired by the Data Controller and/or through third parties specifically appointed directly by the Data Subject at the time of registration and use of the Site by the Data Subject, as well as on the occasion of the Data Subject’s participation in activities related to the Site (e.g. GoBeyond Academy, Innovation Program, etc.). The data may also be acquired from third parties, such as partners of the GoBeyond Program, in order to verify that the Data Subject meets the criteria for participation in the Programs described in the relevant calls, and social media such as Google, if the Data Subject uses the social login method made available by the Data Controller for registration and access to the Site.

The Data Controller processes the personal data of the data subject for the following purposes:

1. a)To allow the Data Subject to register on the Site, use it and participate in activities reserved for members such as, for example, the GoBeyond Innovation Program and the Academy, and to manage the related activities (e.g. identification of Program winners, awarding of prizes, sending information communications about the performance of GoBeyond). The legal basis for such processing is the execution of a contract to which the Data Subject is a party (Article 6, paragraph 1, letter b) of the Regulation);
2. b)Comply with legal obligations and orders/provisions of public authorities and/or supervisory bodies: the processing of personal data referred to in this point is necessary for the fulfilment of legal obligations by the Data Controller and/or orders/provisions of public authorities (e.g. public security authorities, judicial authorities) and/or supervisory bodies. The legal basis for this processing is the fulfilment of a legal obligation to which the Data Controller is subject (Article 6, paragraph 1, letter c) of the Regulation);
3. c)Subject to the consent of the Data Subject, to share the Data Subject’s personal data for marketing activities related to the GoBeyond Program, such as, but not limited to: opening of new calls and opportunities to participate, invitations to events, webinars and networking initiatives, editorial content, newsletters, as well as communications relating to programs, initiatives and opportunities promoted by the Data Controller or developed in collaboration with partners in the innovation ecosystem. The legal basis for this processing is the consent of the Data Subject (Article 6, paragraph 1, letter a) of the Regulation);
4. d)Subject to the consent of the Data Subject, to share the Data Subject’s personal data for marketing activities promoted by third parties and/or partners who collaborate with the Data Controller for the performance of further activities similar/similar to those covered by this policy (i.e. GoBeyond Program), such as, by way of example: opening of new calls and opportunities to participate, invitations to events, webinars and networking initiatives. The legal basis for this processing is the consent of the Data Subject (Article 6, paragraph 1, letter a) of the Regulation);
5. e)Pursue the legitimate interests of the Data Controller relating to the verification of the existence of the conditions for participation in the activities reserved for the Data Subjects, such as the Innovation Program conveyed through the Site, the monitoring and verification of the quality of the service (including the activities of sending to the Data Subject, by the Data Controller, any surveys aimed at investigating the degree of interest aroused by the initiatives reserved for the Data Subjects). registered on the Site or collect evidence on the startup market, also for the purpose of evolving the Program or the Academy), to the management of any disputes and to exercise or defend a right out of court and in court. The legal basis for this processing is the pursuit of the legitimate interest of the Data Controller (Article 6, paragraph 1, letter f) of the Regulation).

The personal data of the Data Subject processed by the Data Controller as part of this activity are:

• personal data (e.g. name and surname);
• contact details (e.g. email address);
• audio and video recordings (as acquired as part of participation in the activities planned for members of the Site, for example on the occasion of the elevator pitch provided as part of the Innovation Program) and photographs (for example if provided by the Data Subject or received from social media following the use, by the Data Subject, of the social login functionality made available by the Data Controller);
• payment data (e.g. IBAN of the Data Subject for the possible disbursement of funding following the victory of the Program);
• data relating to the Data Subject’s relations with the Data Controller and/or with the Data Controller’s partners (in order to verify that the Data Subject meets the criteria for participation in the Programme described in the relevant calls);
• any other data voluntarily communicated to the Data Controller by the Data Subjects in the context of communication with them.

Data Subjects who choose to use the social login method offered by the Data Controller are informed that, in this case, the data relating to the Data Subject transmitted by social media to the Data Controller concern name, surname, email and profile picture, as well as language preferences.

The processing of such data is carried out using manual, computerised and telematic tools, with logics strictly related to the purposes highlighted above and, in any case, in compliance with the precautions, guarantees and necessary measures prescribed by the relevant legislation, aimed at ensuring the confidentiality, integrity and availability of the data, as well as avoiding damage, whether material or immaterial (e.g. loss of control of personal data or limitation of rights, discrimination, theft or usurpation of identity, financial loss, unauthorized decryption of pseudonymization, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social damage).

In order to pursue the purposes indicated above, the Data Controller reserves the right to communicate personal data to recipients belonging to the following categories:

• public authorities and/or supervisory bodies (e.g. judicial authorities, public security authorities, etc.);
• other companies of the group to which the Data Controller belongs, or in any case parent, subsidiary or associated companies, pursuant to art. 2359 of the Italian Civil Code, also located abroad, within the framework of existing intra-group agreements for the management of the activities referred to in the purposes in question;
• partners who contribute, together with the Data Controller, to the promotion, organization and management of activities reserved for members of the Site (Call, GoBeyond Lab);
• people who participate in events related to the GoBeyond Program as the public;
• managers of the web platforms where the videos of the participants in the Innovation Programme will be published;
• online and offline printing organisations;
• subjects who carry out data acquisition, processing, processing and storage services;
• entities that provide services for the management of the Data Controller’s information system and telecommunications networks (including chat and mailing services);
• subjects who carry out documentation archiving and data-entry activities;
• subjects who carry out assistance activities to the Data Subject;
• professional firms or companies in the context of assistance and consultancy relationships;
• subjects who carry out communication assistance and consultancy activities;
• subjects who carry out control, review and certification of the activities carried out by the Data Controller;
• persons who in various capacities succeed the Company in the ownership of legal relationships (e.g. transferees or potential assignees of goods, receivables and/or contracts).

The subjects belonging to the categories listed above operate independently as separate Data Controllers, or as Data Processors appointed for this purpose by the Data Controller. The updated list of third parties to whom personal data is communicated is available by sending a request to privacy_sisal@legalmail.it. The data may also be known, in relation to the performance of the tasks assigned, by the Data Controller’s own staff, specifically authorised by the Data Controller to process the data.

The personal data of the Data Subject may be disseminated within the limits of what is indicated from time to time by the Data Controller and communicated to the Data Subject (e.g. with regard to the Programs conveyed through the Site, the publication of the videos of the Data Subjects is envisaged, on the web platforms of the Data Controller or third parties, as well as the communication of the names of the winners to the online and offline press) or with the consent of the Data Subject, even if requested.

The Data Controller acknowledges that, for the pursuit of the above purposes, the personal data of the Data Subjects may be communicated to subjects located in countries outside the European Union, who cooperate with the Data Controller in the achievement of the aforementioned purposes. Such transfer will take place only in the event of the existence of international agreements or adequacy decisions by the Commission (pursuant to Article 45 of the Regulation) or in the context of the stipulation of binding corporate rules (“Binding Corporate Rules” or “BCR” pursuant to Article 47 of the Regulation) or in any case on the basis of other appropriate guarantees that guarantee an adequate degree of protection to the personal data communicated or transferred. A copy of any personal data transferred abroad, as well as the list of third countries/international organizations to which the personal data have been transferred, may be requested from the Data Controller at the email address privacy_sisal@legalmail.it.

The data will be stored by the Data Controller for the entire duration of the relationship with the Data Subject, i.e. as long as the Data Subject’s account on the Site remains active. In the event that the Data Subject participates in an Innovation Program, the data will also be kept for 10 years from the end of such Program in accordance with tax legislation. For the pursuit of legitimate interests, the Data Controller will retain the personal data of the Data Subjects until such legitimate interests have been exhausted, taking into account the balancing of the rights of the Data Controller and the Data Subject. It should be noted that, in relation to the activities of sending to the Data Subject, by the Data Controller, any surveys relating to investigating the degree of interest received by the initiative or collecting evidence on the startup market, also for the purpose of evolving the Program, the Data Subject’s personal data will be stored for 36 months from the end of the Program.

After these deadlines, the Data Controller will delete the Data Subject’s personal data, or transform them into anonymous form in an irreversible manner. In the event of any further processing carried out for the management of complaints or complaints, for the exercise of a right in court or to comply with other obligations provided for by law, these periods may be extended until the end of the management of the complaint or complaint, the exhaustion of any judicial proceedings initiated or the end of the obligation provided for by law.

The data subject is guaranteed the rights referred to in articles 15 to 22 of the Regulation. In particular, the Data Subject may obtain: a) confirmation of the existence of processing of personal data concerning him/her and, in this case, access to such data; b) the rectification of inaccurate personal data and the integration of incomplete personal data; c) the erasure of personal data concerning him/her, in cases where this is permitted by the Regulation; d) the limitation of processing, in the cases provided for by the Regulation; e) the communication, to the recipients to whom the personal data have been transmitted, of the requests for rectification/erasure of the personal data and restriction of processing received from the Data Subject, unless this proves impossible or involves a disproportionate effort; f) the receipt, in a structured, commonly used and machine-readable format, of the personal data provided to the Data Controller, as well as the transmission of the same to another data controller.

The Data Subject also has the right to object at any time, for legitimate reasons, to the processing of personal data concerning him/her, even if pertinent to the purpose of the collection, except in the case in which the Data Controller demonstrates the presence of prevailing compelling legitimate reasons or the exercise or defense of a right pursuant to art. 21 of the Regulation. The data subject also has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him/her, unless such decision: a) is necessary for the conclusion or performance of a contract between the Data Subject and the Data Controller; b) is authorised by Union or Member State law to which the Data Controller is subject; c) is based on the explicit consent of the Data Subject. In the cases referred to in the aforementioned letters a) and c), the Data Subject has the right to obtain human intervention from the Data Controller, to express his or her opinion and to contest the decision.

The Data Subject may submit requests to the address privacy_sisal@legalmail.it indicating in the subject “Privacy – exercise of Privacy rights”, detailing which right he/she intends to exercise and providing the Data Controller with the information useful for identifying him/her pursuant to Articles 11 and 12 of the Regulation. The Data Subject also has the right to lodge a complaint with the supervisory authority, in particular in the Member State where he/she habitually resides, works or the place where the alleged violation for which the complaint is lodged occurred (e.g. the Guarantor for the protection of personal data in Italy), as provided for by art. 77 of the Regulation, as well as to bring the appropriate proceedings before the courts pursuant to art. 78 and 79 of the Regulation.

Registration on the Site and participation in related activities by the Data Subject requires the provision of personal data of the same. The provision of data is mandatory for the purposes referred to in paragraph 4, letters a) and b). Any refusal by the Data Subject to provide the necessary information will make it impossible for the Data Subject to register on the Site and participate in related activities (e.g. Call, GoBeyond Lab). Processing for the purposes referred to in point c) is not mandatory and the Data Subject may object to such processing in the manner indicated in the paragraph “Rights of the Data Subject” of this policy, and if the Data Subject objects to such processing, his/her data may not be used for this purpose, unless the Data Controller demonstrates the presence of overriding compelling legitimate reasons or the exercise or defence of a right pursuant to of art. 21 of the Regulation.

The Data Controller reserves the right to periodically update the content of this page. The Data Subject is therefore invited to periodically consult the information contained herein in order to stay updated with respect to any changes that have occurred since the last consultation.