Information on the processing of personal data (VIP)

Information pursuant to Articles 12, 13, and 14 of Regulation (EU) 2016/679
(Last updated: 18/07/2025)

In accordance with Article 13 of Regulation (EU) 2016/679, we hereby provide you with the following information regarding the processing of your personal data. Specifically, this privacy notice outlines:

1. Identity of the Data Controller
2. Appointment of the Data Protection Officer
3. What data we process and the nature of its provision
4. The purposes for which we process your data and the legal bases that justify such processing
5. Who may have access to your data
6. The geographical scope in which your data may circulate
7. How long we will retain your data
8. Your rights in relation to the personal data we process

1. Identity of the Data Controller
The Data Controller is Artissima S.r.l.
You may contact the company at the following address: Corso Vittorio Emanuele II, 12, Turin / Email: [email protected] / Phone: +39 011 197 44106

 2. Appointment of the Data Protection Officer
The company has appointed a Data Protection Officer (DPO), who can be contacted at: [email protected].

 3. What data we process and the nature of its provision
The Controller collects data necessary to identify the data subjects and manage the relationship aimed at assessing applications for participation, sending invitations, and handling related activities promoted by Artissima. The processed data includes contact details (postal and electronic), information about professional activity, participation in events, and other data provided by the data subject over time or obtained from publicly available and lawfully consulted sources. Where necessary for logistical purposes related to hospitality or services offered within the scope of participation in Artissima’s initiatives, a copy of an identification document may be collected. Artissima uses contact information provided by the data subject, or collected from third parties in accordance with applicable laws, during the application process to send related documents and information, as well as to create a personal VIP account on the Artissima website.

Additionally, the data processed may include photographic images and video recordings collected for institutional, public relations, or marketing purposes, in connection with exhibitions, conferences, museum events, and similar initiatives. Such data may be processed in paper or electronic form and disseminated through any communication channel, including the internet and social media.

The data is provided voluntarily by the data subject, also during direct interviews, by authorized third parties (such as gallery owners, curators, museum directors, intermediaries), or sourced from publicly available information consulted by Artissima. Furthermore, the data may have been acquired over time during previous contacts or through the completion of paper or online forms. Failure to provide the data may result in the inability to properly manage the relationship. No automated decision-making is applied to the data provided.

4. Purposes of the processing and legal bases

A) Contractual, accounting, administrative, and tax-related purposes.
The data is processed to fulfill legal obligations and to enable effective administrative management of contractual relationships. This includes handling applications to participate in invitation-only events organized by Artissima, managing participation logistics, creating accounts for VIP access on the Artissima website, sending invitations and service-related information, issuing tickets and badges, and managing all event-related and post-event activities. The data will be used to facilitate, in the event of confirmation of the application for participation, the compilation of the documentation relating to participation and ancillary services, including hospitality services, where provided.
Additionally, address data may be used for statistical purposes and logistical organization related to the invitation or participation.

Legal basis: the performance of pre-contractual or contractual measures requested by the data subject.

B) Marketing and newsletter purposes.
This includes promotional communications related to events organized or participated in by Artissima. This involves sending marketing materials, advertisements, newsletters, and other promotional content via email or phone.

Legal basis: data subject’s consent.

 C) Profiling purposes.
The data is used to analyze choices and preferences related to the services offered and/or following participation in the events organized and/or participated in by us. Profiling helps us understand users’ interests to tailor communications accordingly, always in line with their expectations and without being intrusive. Specifically, we remind you that it is our prerogative to contact our customers without intrusiveness and for this reason we want to send only communications that are of interest to them. Through profiling we get to know our customers/users better and this allows us to improve our relationship. The profiled marketing activities we carry out are, therefore, always for the benefit of our customers/users, as they are functional to offer them communications relating to the services and initiatives most suited to their interests. In compliance with the law and to protect your rights, we will only process the data that is strictly necessary for each purpose indicated in this policy.

 Legal basis: data subject’s consent.

D) Data sharing with Partners.
Data may be shared with:
– Artissima’s Partners (list available here) to increase event visibility and awareness of the event organized by Artissima and give greater visibility to participants;
– Partners providing participation services (e.g., trade fair organizers, technical suppliers, hospitality services like hotels or transport);
– Galleries, Foundations, Museums, and other cultural institutions collaborating with Artissima for the purpose of managing invitations to related events.

Legal basis: the legitimate interest of the Controller, without prejudice to the right of the data subject to object.

E) Service allocation analysis.
Information such as professional role and involvement in collecting or dealing art is used to determine what services to offer, based on Artissima’s discretionary categorization. This profiling is manual and does not involve automated processing. This profiling activity is functional to the correct management of Artissima’s activities.

Legal basis: legitimate interest, without prejudice to the right of the data subject to object.

Data recipients
A) Personal data may be disclosed to external Data Processors appointed by the Controller, including: technical service providers (for website management, databases, communication tools, event access), trade fair organizers, payroll and tax consultants, data processing centers, affiliates, subsidiaries or parent companies, retailers, banks and credit institutions, credit insurance companies. Data may also be disclosed to public or private entities (foundations, social security institutions, insurance entities), occupational health professionals, Chambers of Commerce, armed forces and law enforcement, customs and tax authorities pursuant to legal obligations.

B) Depending on your participation, data may be published in catalogues, brochures, printed materials and/or online (e.g., websites, social networks, electronic media).
Data will not be shared with third parties outside those listed above.

Please note that the publication of information or images relating to Artissima’s events is intended solely for the purpose of public interest communication and does not authorize their use for purposes other than those for which they were published.

Geographical scope
Your personal data will be processed only within the national or European Union territory.

Data retention period
– Purpose A (contractual and administrative): 10 years from the end of the relationship, in accordance with legal and fiscal requirements.
– Purpose B (marketing): 24 months, unless consent is withdrawn earlier.
– Purpose C (profiling): 24 months, unless consent is withdrawn earlier.

Your rights in relation to the data we process
You may exercise the following rights by contacting the Data Controller:

A) Right of access – To obtain confirmation as to whether or not personal data concerning you is being processed and, where that is the case, access to such data and related information (source, purposes, categories, recipients, etc.).

B) Right to rectification – To obtain the correction of inaccurate data and the completion of incomplete data.

C) Right to erasure (“right to be forgotten”) – To have your data erased when:
– It is no longer necessary for the purposes for which it was collected;
– You withdraw consent and there is no other legal basis for processing;
– Processing is unlawful;
– Erasure is required by law.

D) Right to restriction of processing – To obtain restriction when the accuracy of the data is contested, or the processing is unlawful and you oppose erasure.

E) Right to object – To object, at any time, to processing based on legitimate interest or consent, including for direct marketing.

F) Right to data portability – To receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller (applies only to consent- or contract-based processing carried out by automated means).

G) Right to withdraw consent – To withdraw previously given consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

H) Right to lodge a complaint with a supervisory authority – If you believe your data has been processed unlawfully, you may file a complaint with the competent supervisory authority, either in the Member State where you reside or work, or where the alleged violation occurred.

To exercise your rights, you can contact the Data Controller at: [email protected]. The Data Protection Officer is available at: [email protected]. Where applicable, a complaint may also be filed with the Italian Data Protection Authority (Garante per la protezione dei dati personali).