Dear User, 

Pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter the “GDPR”), Business Integration Partners S.p.A. (hereinafter “Bip” or the “Controller”) hereby informs you that your personal data (hereinafter the “Data”), as a data subject (hereinafter the “Data Subject”), collected through a dedicated section of the Controller’s website, will be processed in accordance with the GDPR and this Privacy Notice. 

1. DETAILS OF THE DATA CONTROLLER 

The Data Controller is Bip, with registered office at Piazza San Babila No. 5, 20122 Milan (MI), Italy, tel. 02.4541521, email [email protected]. 

1. DETAILS OF THE DATA PROTECTION OFFICER – DPO 

The Data Protection Officer (hereinafter the “DPO”), appointed by the Controller, may be contacted by: 

• Post (registered mail with acknowledgement of receipt), addressed to: Piazza San Babila No. 5 (20122 Milan), for the attention of the DPO

• Telephone: +39 02.4541521 

• Email: [email protected] 

 

1. PURPOSES, LEGAL BASIS AND METHODS OF PROCESSING  

The Data provided through the dedicated section of The Visual Agency website (including, for example, first name, surname and email address) will be processed to: 

1. Promote information and services offered by sending informative and promotional email communications (newsletters); 

1. Share new initiatives, including, but not limited to, events, workshops, webinars and/or meetings, and invite the Data Subject to participate. 

Processing of Data for the above purposes requires the Data Subject’s explicit consent pursuant to Article 6(1)(a) of the GDPR. 

Furthermore, The Visual Agency newsletters may use tracking pixels and similar technologies provided by the Substack platform to collect information about subscribers’ interactions with communications sent. Depending on the features enabled, this information may include data on email opens, the date and time of viewing, clicks on links contained in communications, and other statistical information useful for measuring newsletter effectiveness and improving the content offered to subscribers. 

The use of these tracking technologies is subject to the Data Subject’s specific consent where required by applicable law. 

Consent may be withdrawn at any time and, where technically possible, without discontinuing receipt of the newsletter. 

 

Bip will process the Data electronically and/or by means of IT and telecommunications systems, using tools suitable for ensuring their security and confidentiality. Bip will also process the Data in accordance with the principles of fairness, lawfulness, transparency and protection of the confidentiality and rights of Data Subjects. 

The Data will be stored in the relevant databases and/or archives, to which only duly authorised personnel will have access. 

1. PROVISION OF DATA AND CONSEQUENCES OF FAILURE TO PROVIDE DATA 

The provision of Data for the stated purposes is necessary to send the communications described in section 3 of this Privacy Notice. Accordingly, failure to provide the Data will prevent the Data Subject from receiving such communications. 

1. RECIPIENTS OR CATEGORIES OF RECIPIENTS 

The Data may be made accessible, disclosed or communicated to the Controller’s personnel duly authorised to carry out Processing, and may also be disclosed to parties outside the Controller’s organisation who will act, as applicable, as Data Processors. 

By way of example and without limitation, the Data may be disclosed to the following parties: 

• Employees and collaborators of the Controller authorised to carry out such Processing; 

• Substack Inc., with registered office at 111 Sutter St., San Francisco, CA 94104, United States of America, acting as Data Processor pursuant to Article 28 of the GDPR, for the provision of the platform used by the Controller to send newsletters; 

 

1. TRANSFER OF DATA TO THIRD COUNTRIES 

The Controller will process the Data at its offices located in Italy, while the platform used by the Controller to send newsletters will be provided by Substack Inc. from the United States of America. Accordingly, the Controller has entered into Standard Contractual Clauses with Substack Inc. pursuant to Article 47(2)(c) of the GDPR (as approved by the European Commission), to safeguard transfers of Data outside the European Economic Area. 

1. RETENTION PERIOD 

Data collected for the purposes set out in this Privacy Notice will be retained for no longer than 24 months from the date consent is given. At the end of this period, the Data Subject will be asked to renew the consent previously given. If the Data Subject chooses not to renew it, the Data will no longer be used for that purpose and will be permanently deleted. 

 

The Data Subject may withdraw consent to receive the newsletter and to the use of tracking pixels and similar technologies at any time, using the opt-out button included in each communication or by contacting the Controller or DPO at the contact details provided above. 

1. EXERCISE OF DATA SUBJECT RIGHTS 

Each Data Subject has the rights provided for under Article 7(3) and Articles 15 to 20 of the GDPR. In particular, each Data Subject may: 

1. Obtain confirmation as to whether or not Data concerning them are being processed; 

1. Where Processing is taking place, obtain access to their Data and information about the Processing, and request a copy of those Data; 

1. Obtain rectification of inaccurate Data and completion of incomplete Data; 

1. Obtain erasure of Data concerning them where one of the conditions set out in Article 17 of the GDPR applies; 

1. Obtain restriction of Processing in the circumstances provided for in Article 18 of the GDPR; 

1. Receive Data concerning them in a structured, commonly used and machine-readable format and request their transmission to another Controller, where technically feasible. 

Furthermore, each Data Subject has the right to object at any time to the Processing of their Data for the purposes of the Controller’s legitimate interests. In the event of an objection, their Data will no longer be processed unless compelling legitimate grounds for Processing override the interests, rights and freedoms of the Data Subject, or the Processing is necessary for the establishment, exercise or defence of the Controller’s legal claims. 

Finally, each Data Subject may lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) if they believe that their rights under the GDPR have been infringed, in accordance with the procedures described on the Authority’s website at: www.garanteprivacy.it 

Data Subjects may exercise their rights using the contact details of the Controller and DPO provided above.