Privacy policy - Processing of the User's personal data for commercial purposes

In compliance with Article 13 of Regulation (EU) 2016/679 ("GDPR"), Ipack Ima S.r.l. ("Ipack Ima") and UIV – Unione Italiana Vini Servizi Società Cooperativa ("UIV"), as joint Controllers (“Joint Data Controllers” or "Joint Controllers") intend to provide the User with some information regarding the processing of personal data concerning them for commercial or marketing purposes.

For some of the purposes described below, Ipack Ima and UIV may also operate as independent controllers.

1. Contact details of the Joint Data Controllers

The Joint Controllers of the processing of personal data are Ipack Ima S.r.l., with registered and operational office in S.S. del Sempione 28, 20019 Rho (Milan), e-mail address: privacy@ipackima.it, and UIV – Unione Italiana Vini Servizi Società Cooperativa, with registered office in via S. Vittore al Teatro no. 3 – 20123 Milan, email address: privacy@uiv.it.

2. Categories of personal data processed

The Joint Controllers, for the purposes indicated below, process the following categories of personal data belonging to the User:

• personal data provided by the User by completing the form relating to the Bevertech event (the "Event") such as identification data (name and surname), contact details or contacts (e.g., e-mail address), services requested and used, payment data, reference company, position and role held, relevant business area;
• additional data provided freely by the User, such as additional telephone numbers and information relating to the company to which they belong, decision-making power held within the company, interest in the Event.

3. Purpose and legal basis of processing

The personal data are collected and processed for the following purposes:

1. sending advertising material, direct sales, carrying out market research (including surveys on the quality of services and the degree of User satisfaction) or commercial communications relating to fairs, events and services by the Joint Controllers, by post, telephone, automated call systems, fax, e-mail, SMS, mms (direct marketing purposes);
2. Automated analysis and evaluation of User behaviour and preferences regarding events and services of interest for statistical purposes related to participation in the Event and improvement and personalisation of services provided (for the purpose of aggregated data analysis to optimise activities, ensure adequate resource planning and management, and respond more effectively to User needs, especially for future editions, without resorting to automated decision-making);
3. communication of data to UCIMA, Proma-Pack S.r.l., Fiera Milano S.p.A. and other companies of the Fiera Milano Group (referred to in the updated list available at the link www.fieramilano.it), as well as other companies, such as market research institutes, for autonomous processing, as data controllers, for the purpose of sending direct marketing communications of their services and products. An updated list of these subjects is available at the contact details indicated in paragraph 1;
4. sending advertising material, direct sales, carrying out market research (including surveys on the quality of services and the degree of User satisfaction) or commercial communications relating to fairs, events and services by Ipack Ima as an independent controller, by post, telephone, automated call systems, fax, e-mail, SMS, mms (direct marketing purposes of Ipack Ima – independent controller);
5. sending advertising material, direct sales, carrying out market research (including surveys on the quality of services and the degree of User satisfaction) or commercial communications relating to fairs, events and services by UIV as an independent controller, by post, telephone, automated call systems, fax, e-mail, SMS, mms (direct marketing purposes of UIV – independent controller);

For the purposes referred to in points 1, 2, and 3, the Joint Controllers process data based on the User's consent, which can be withdrawn at any time (without prejudice to the lawfulness of processing based on consent given before such withdrawal), pursuant to art.  6, para. 1, letter a) of the GDPR.

For the purposes referred to in points 4 and 5, Ipack Ima and/or UIV, each as an independent data controller for its own purpose, process/es the data based on the User's consent, which may be withdrawn at any time (without prejudice to the lawfulness of the processing based on the consent given before such withdrawal), pursuant to art. 6, para. 1, letter a) of the GDPR.

If requested by the User via the online form, Ipack Ima may also use the email address provided by the User for the Ipack Ima newsletter service.

4. Data processing methods

The processing of personal data is carried out for the aforementioned purposes, in accordance with the provisions set out in art. 5 of the GDPR, both on paper and digital media, using electronic or otherwise automated tools.

The processing is carried out directly by the Joint Data Controllers (and by Ipack Ima and/or by UIV, as independent data controllers), by their employees and collaborators, as authorised parties, as well as by Fiera Milano S.p.A. and other companies of the Fiera Milano Group and service providers (e.g. IT and telematics service companies, exhibition service providers, call centres, research companies, etc.) operating as data processors on behalf of the Joint Data Controllers (and/or Ipack Ima and UIV).

As a rule, the Joint Controllers do not transfer personal data to third countries outside the EU. Any transfers will only be made in compliance with the decisions of the European Commission that have recognised the adequacy of the data protection regulations in force in those countries, or on the basis of adequate guarantees (such as standard contractual clauses or binding corporate rules), or, in the absence of such conditions, if the transfer is authorised by the User or necessary for the execution of the contract with or for the User. In any case, should data be transferred outside the EU, the Joint Controllers will provide the information prescribed under Article 13, para. 1, letter f) of the GDPR.

5. Nature of data provision and consequences of refusal

For the purposes referred to in points 1, 2 and 3 of paragraph 3, the communication of data is optional and failure to provide them has no consequences on the use of the services requested by the User. However, refusal to provide data may prevent receipt of commercial communications relating to fairs, events and services by the Joint Controllers and/or by the indicated third parties, and preclude statistical analysis and evaluations or the improvement or personalisation of the services provided.

For the purposes referred to in points 4 5 and 3, of paragraph 3, the communication of data is optional and failure to provide them has no consequences on the use of the services requested by the User. However, refusal to provide data may prevent receipt of commercial communications relating to fairs, events and services by Ipack Ima and/or UIV as independent data controllers, and/or by the indicated third parties, and preclude statistical analysis and evaluations or the improvement or personalisation of the services provided.

Period of retention of personal data

The personal data processed for the purposes referred to in points 1 and 3 will be stored for a period of 48 months from the consent acquisition date, given that the Event organised by the Joint Controllers is held every three years and that direct marketing communications by the Joint Controllers are made, specifically, to those who have expressed interest in the Event and in the lead-up to the next edition of the event.

The personal data processed for the purposes referred to in point 2 will be stored for a period of 36 months from the consent acquisition date due to the three-yearly frequency of the Event organised by the Joint Controllers.

The personal data processed for the purposes referred to in points 4 and 5 will be stored, respectively, by Ipack Ima for a period of 48 months from the consent acquisition date and by UIV for a period of 48 months from the consent acquisition date, given that (i) the further Events organised by Ipack Ima are held every three years and the further Events organised by UIV are held every two years and (ii) direct marketing communications by Ipack Ima and/or UIV are made, specifically, to those who have expressed interest in further Events and in the lead-up to the next edition of such events.

The Joint Data Controllers (Ipack Ima and/or UIV as independent data controllers) reserve the right, before the end of the defined retention period, to send the User a request for renewal of consent for the purposes referred to in paragraph 3, in the most appropriate manner and in compliance with the legislation on the protection of personal data.

The personal data communicated to third parties will be processed by the latter, as independent data controllers, for the purposes and in the manner provided for in their respective privacy policies.

After this period, your data will be deleted, i.e., removed from the active systems of the Joint Data Controllers (of Ipack Ima and/or UIV as independent data controllers).

6. Recipients of the personal data

Within the scope of the purposes indicated in paragraph 3, your personal data may be disclosed to the following categories of recipients. The complete list of such subjects or categories of subjects is available at the registered offices of Ipack Ima and UIV.

• data controllers, pursuant to art. 28 of the GDPR, appointed from time to time;
• UCIMA, Proma-Pack S.r.l., Fiera Milano S.p.A. and other companies of the Fiera Milano Group (see updated list available on the website www.fieramilano.it);
• companies and professionals that the Joint Controllers use to fulfil the obligations for the execution of the contract or required by law or in order to protect their own rights (for example, accountants, lawyers, tax advisors, auditors, consultants for auditing or due diligence operations, etc.);
• banks, insurance financial institutions;
• companies for the technical management of networks and computer systems;
• trade fair service providers, call centres, research companies;
• public agencies;
• judges and courts, for any request or within the scope of a proceeding/trial;
• public authorities authorized by law, in the event of checks, assessments, and/or inspections.

Personal data shall not be disseminated.

7. Rights of the data subject

You have the right to exercise at any time the rights recognised by Articles 15-21 GDPR, as briefly summarised below:

• Right of access: you may request information about how we process your data or confirmation as to whether or not the Joint Data Controllers (Ipack Ima and/or UIV) process your personal data. In this case, you may ask us to provide a copy of your data and to verify what data is in our possession.
• Right to rectification: you have the right to request that the Controllers rectify your personal data if they are incorrect, including the right to request the completion of incomplete personal data.
• Right to erasure: you have the right to request that we delete the data (or part of it) that you have provided us with, including data that is no longer necessary for the purposes for which it was collected or otherwise processed.
• Right to restriction of processing: you may request that we restrict the processing of your personal data if the legal conditions are met.
• Right to object: you may object to the processing of your personal data, unless there is an overriding legitimate ground for the continuation of such processing.
• Right to data portability: you may obtain from the Joint Controllers (Ipack Ima and/or UIV), in a structured, commonly used and machine-readable format, the personal data you have provided, for the purpose of transmitting them to another party.   This right is applicable in cases where the Joint Controllers (Ipack Ima and/or UIV) carry out the processing of such data through automated tools, based on consent or for the purpose of providing services.
• Withdrawal of consent: where processing is based on consent, you have the right to withdraw your consent at any time, without prejudice to the lawfulness of processing carried out before said withdrawal.
• Right to lodge a complaint with the Supervisory Authority: without prejudice to any other administrative or judicial appeal, you have the right to lodge a complaint with the competent Supervisory Authority where you consider that the processing carried out infringes the applicable data protection legislation.

Any requests made, for the exercise of your rights, may be forwarded to the Joint Data Controllers (Ipack Ima and/or UIV) by writing to the email address indicated in paragraph 1 of this Policy.

Updated 21.11.2025