The PRIVACY POLICY adopted by the Organisation in connection with the handling of personal data concerning those who have provided them is described on this page. This notice is also sent to those who interact with the Organisation’s Web services. This notice is given solely in connection with this site and not also with other Web sites that may be consulted by the user via Site links. For the sake of clarity, the full text of the notice drawn up according to article 13 of the Privacy Act is set out below.

1. The methods adopted to handle requested or acquired personal data, either before a working /cooperative/business relationship has been established or in the course of such a relationship, set out to satisfy legal and contractual obligations and ensure such obligations are correctly fulfilled by MODENAFIERE Srl, thereby allowing said company conduct the business activities most closely linked to its corporate purpose as efficiently as possible.
2. Data may also be handled with the use of electronic or, in any event, automated means and may involve any operation or series of operations including those set out in article 4, paragraph 1, letter a) of the Act.
3. You are not obliged to provide personal data unless required by law or contract.
4. Refusal to reply shall lead to the consequences envisaged by law or contract.
5. Personal data may be transferred to:
a) companies operating in the same sector as that of MODENAFIERE Srl;
b) the parent company (Bologna Fiere SpA), subsidiaries and/or associated companies, sales networks (agents, dealers and distributors), sub-suppliers and sub-contractors involved in conducting contractual or business relations;
c) service companies operating in the EU and domestic financing and/or auditing sector;
d) external associates of MODENAFIERE Srl, such as tax and/or accounting consultants;
e) domestic, EU and international Public Administrations.
6. Bearing in mind that our organisation operates at an international level, we inform you that the data covered by this notice may be transferred abroad, and possibly outside the EU.
7. Being of a strictly commercial nature, the data covered by this notice may be circulated via the Internet site “www.modenafiere.it” and by publication in trade periodicals and magazines.
8. Data shall be handled using appropriate methods and tools that guarantee its confidentiality and may be processed using electronic or automated (networked data processing systems not accessible to the public) and non-automated means (paper-based archives and records), both protected by adequate security measures, such as personalised passwords offering exclusive access, personal identity codes and limited access to records, as provided for and regulated by articles 31 to 36 inclusive of the Act and also in compliance with article 11 of the Act.
9. More precisely, data capable of revealing the racial and ethnic origins, religious, philosophical or other convictions, political opinions, membership of political parties, trade unions, associations or organisations of a religious, philosophical, political or trade union nature, as well as personal data indicating the state of health or sexual orientation of data subjects may only be handled with the written consent of the data subject and adopting the methods and accepting the restrictions imposed by Authorisation no. 1/2002 issued by the Data Protection Registrar and subsequent extensions thereto.

The provision of data is necessary for reasons connected with normal business and administrative practice and failure to provide such data may prevent the company from executing the contract and/or establishing a working relationship with the party involved.

The Data Controller is MODENAFIERE Srl - with registered offices in Viale Virgilio 58/B, 41100 Modena, Italy, acting through its current legal representative.

You may contact the Data Controller if you wish to exercise your rights under articles 7, 8 9 and 10 of the Act, which, for your information, are
reproduced in their entirety below:

Art.7 Right of access to personal data and other rights
1. The data subject has the right to be duly informed as to the existence or otherwise of personal data relating to his/her person including instances where data has not as yet been recorded. Such data shall be delivered to the data subject in an intelligible manner.
2. The data subject shall be advised of the following:
a) source of personal data;
b) data processing purposes and procedures;
c) methods employed in case data be processed by electronic means;
d) name/surname of the Data Controller and Data Processors pursuant to the provisions of article 5, paragraph 2;
e) the entities or groups of entities to whom the personal data may be communicated or who otherwise might have access to the personal data either as the designated representative of the data controller in Italy, as the duly nominated responsible data controller, or as the duly nominated data processor of the personal data.
3. The data subject shall be entitled:
a) to update, correct when necessary and to integrate his/her personal data;
b) to delete, to transform into an anonymous format, to deny access to data processed in an illicit manner including data not requiring its storage for the purposes for which it was originally collected and subsequently processed;
c) to written certification that the activities requested and their completion, as described in a) and b) above, have been reported to those entities to whom the data had been forwarded or disseminated, except in those instances when it would be impossible to do so or would entail the use of resources and other means manifestly disproportionate to the protection of the individual's personal right;
4. The data subject shall be entitled to object in whole or in part:
a) to the processing of personal data, including the scope of the data collection, for legitimate motivations;
b) to the processing of personal data for purposes of advertising/sales or the performance of market surveys or advertising campaigns.

Art.8 Exercise of rights
1. The rights described in article 7 are exercised by making a straightforward request to the data controller or the data processing supervisor, also through an authorised data processor, to which an appropriate reply must be given without delay.
2. The rights described in article 7 may not be exercised by making a request to the data controller or the data processing supervisor, or by filing an application pursuant to article 145, if the personal data is processed:
a) on the basis of the provisions of decree-law no. 143 of 3rd May 1991, converted, with amendments, by law no. 197 of 5th July 1991, and subsequent amendments thereto, concerning money-laundering;
b) on the basis of the provisions of decree-law no. 419 of 31st December 1991, converted, with amendments, by law no. 172 of 18th February 1992, and subsequent amendments thereto, concerning support to the victims of extortion;
c) by parliamentary committees of inquiry set up in accordance with article 82 of the Constitution;
d) by a public figure other than public economic bodies, on the basis of an express legal provision, exclusively for purposes related to monetary and currency policy, to the system of payments, the monitoring of brokers and credit and financial markets, as well as the protection of their stability;
e) pursuant to article 24, paragraph 1, letter f), with regard solely to the period during which any defence investigations being carried out or the rights being exercised before the judicial authorities may be effectively and tangibly prejudiced;
f) by suppliers of electronic communication services accessible to the public in relation to incoming telephone communications, provided that there is a risk that any defence investigations referred to in law no. 397 of 7th December 2000 being carried out may be effectively and tangibly prejudiced;
g) on grounds of justice, at judicial offices at any stage or instance or the Upper Counsel of the Bench or other self-governing bodies or the Ministry of Justice;
h) pursuant to article 53, without prejudice to the provisions of legal enactment no. 121 of 1st April 1981.

3. The Data Protection Registrar takes measures in the manner envisaged in articles 157, 158 and 159, also in response to notification by the data subject, in cases covered by paragraph 2, letters a), b), d), e) and f), and in cases covered by letters c), g) and h) of said paragraph, takes measures in the manner envisaged in article 160.
4. The rights described in article 7 may be exercised, when data of an objective nature is not involved, unless such action would amount to the adjustment or addition of personal data of an evaluative type relating to judgments, opinions or other appraisals of a subjective nature, or an indication of forms of conduct to be followed or decisions being taken by the data controller.

Art.9 Methods by which rights can be exercised
1. The request made to the data controller or the data processing supervisor may be made by registered letter, telefax or e-mail. The Data Protection Registrar may establish other appropriate systems in the light of new technological solutions. When the rights envisaged under article 7, paragraphs 1 and 2 are being exercised, the request may also be made verbally and, in such circumstances, a summarised record must be made by the data processor or the data processing supervisor.
2. When exercising the rights described under article 7, the data subject may confer written power of attorney or proxy upon individuals, bodies, associations or organisations. The data subject may also seek the assistance of an entrusted person.
3. The rights described in article 7 referring to personal data relating to deceased persons may be exercised by a person who has his or her own interests in such data or acts in order to safeguard the data subject or acts for family reasons worthy of protection.
4. The identity of the data subject is ascertained using appropriate evaluation tools, including available deeds or documents or the exhibition or attachment of a copy of an identification document. The person who acts on behalf of the data subject must exhibit or attach the copy of the power of attorney or proxy, signed in the presence of a data processor or signed and submitted together with an uncertified photocopy of a document identifying the data subject. If the data subject is a corporate body, organisation or association, the request must be made by the individual authorised to do so under the respective articles of association or regulations.
5. The request referred to under article 7, paragraphs 1 and 2, is made freely, without restrictions, and may be renewed, unless just grounds exist, after a period of at least ninety days.

Art.10 Reply to data subject
1. To ensure that the rights described under article 7 can be exercised, the data controller must take suitable measures directed, in particular:
a) at facilitating access to personal data by the data subject, also by using processor programmes purposely designed to precisely select data relating to individual parties concerned who have been or can be identified;
b) at simplifying procedures and reducing the time taken in replying to the applicant, also within the scope of offices or services set up to handle relations with the public.
2. The data is extracted by the data processing supervisor or the data processors and may also be passed on to the applicant verbally, or submitted for examination using electronic equipment, provided that in these circumstances, the data can be easily understood, also bearing in mind the quality and quantity of the information. If requested, the data can be transferred onto paper-based or computerised media, or transmitted via computer.
3. Unless the request relates to a particular handling operation or specific personal data or categories of personal data, the reply to the data subject shall include all the personal data relating to the data subject in any event handled by the data controller. If the request is addressed to a subject exercising a profession within the health sector or to a health organisation, the provisions of article 84, paragraph 1 must be complied with.
4. If it proves particularly difficult to extract the data, the reply to the request made by the data subject may also be given by exhibiting or delivering copies of deeds and documents containing the personal data requested.
5. The right to receive data in intelligible form does not cover personal data relating to third parties, unless the decomposition of the data handled or the lack of certain elements renders the personal data relating to the data subject incomprehensible.
6. The data may also be transferred in intelligible form through the use of comprehensible forms of text. If codes or symbols are transferred, the parameters applied in order to comprehend the relevant meaning must also be supplied.
7. When, following a request made under article 7, paragraphs 1 and 2, letters a), b) and c), the existence of data relating to the data subject is not confirmed, a contribution towards costs may be demanded, not to exceed the actual costs incurred for the research carried out in the case in question.
8. The contribution referred to in paragraph 7 cannot, in any event, exceed the amount calculated by the Data Protection Registrar under directions of a general nature, which may be established as a lump sum in the event that the data is handled with the use of electronic equipment and the reply is given verbally. Under the same directions, the Data Protection Registrar may provide that a contribution be demanded when the personal data appears on a special form of medium whose reproduction is expressly required, or when the complexity or extent of the requests demand the extensive use of equipment, by one or more data controllers, and the existence of data relating to the data subject is confirmed.
9. The contribution referred to in paragraphs 7 and 8 may also be paid through the post office or bank, or by cash or credit card, if this can be done when the reply is received and, in any event, no later than fifteen days from the date of the reply.