PRIVACY NOTICE PURSUANT TO ARTICLE 13 OF REGULATION (EU) 2016/679

1. General information

This document describes the way OUR FILMS S.p.A. (“OUR FILMS”) processes the personal data provided by users of the website www.ourfilms.it (the “Website”).

Personal data provided by users shall be processed in accordance with Regulation (EU) 2016/679 (the “GDPR”) and applicable national legislation, in compliance with the principles of lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality.

This privacy notice is provided pursuant to and for the purposes of Article 13 of the Privacy Regulation.

• Data controller

The Data Controller is OUR FILMS S.p.A., with registered office at Via Giovanni Nicotera no. 29, 00195 – Rome (RM), Italy, VAT No., Tax Code and Rome Companies’ Register No.: 17506111008, REA: RM – 1722456, Share capital: €102,000 fully paid, certified email (PEC): ourfilmsspa@pec.it.

• Categories of data processed

1. Browsing data

The information systems and software procedures used to operate the Website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

Such data include, by way of example, IP addresses, domain names of the devices used by users, the addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the server response status code, and other parameters relating to the user’s operating system and IT environment.

This information is not collected to be associated with identified identified or identifiable natural person; however, by its very nature, it may allow users to be identified through processing and association with data held by third parties.

Browsing data are used exclusively to obtain aggregated statistical information on the use of the Website and to monitor its proper functioning. Such data are retained only for the time strictly necessary and are deleted or anonymized after processing, unless they are required for the investigation of liability in the event of cybercrimes to the detriment of the Website.

• Cookies and tracking tools

Detailed information regarding the types of cookies and tracking tools used is set out in the Cookie Policy available at the following link:

• Data voluntarily provided by the user

OUR FILMS processes personal data voluntarily provided by users when they contact the Data Controller through the contact details indicated on the Website (e.g. email/PEC, telephone) and/or through any contact features available on the Website (e.g. forms).

Such data may include, by way of example:

identification and contact details (e.g. first and last name, email address, telephone number, any company/organization of affiliation and role);

the content of the communication and information provided in connection with the request (e.g. message text, information necessary to formulate a response);

any attachments sent by the user and the related technical metadata (where applicable).

As a rule, OUR FILMS does not request the provision of special categories of personal data pursuant to Article 9 GDPR (e.g. data relating to health, religious beliefs, political opinions, trade union membership) or data relating to criminal convictions and offences pursuant to Article 10 GDPR. Users are therefore invited not to transmit such information unless it is strictly necessary in relation to the specific request.

• Methods and purposes of processing

Personal data provided by users are processed using IT and electronic tools, in compliance with the security measures required under applicable law, for the following purposes and on the basis of the corresponding lawful basis pursuant to Article 6 of the Privacy Regulation:

1. to enable browsing of the Website, ensure its proper technical functioning and safeguard system security (e.g. log management and monitoring, prevention of unauthorized access, fraudulent activities or abuse, management of malfunctions and security incidents).

Legal basis: Article 6(1)(f) GDPR (legitimate interest): ensuring the operation, integrity and security of the Website and information systems, preventing and combating unlawful or harmful activities, and protecting the rights of the Data Controller and users;

• to provide users with the information requested regarding the activities, projects and/or services of OUR FILMS (e.g. sending informational materials or detailed responses), exclusively following a specific request by the user, and to manage subsequent contacts strictly related to that request.

Legal basis: Article 6(1)(f) GDPR (legitimate interest): responding to received requests, effectively managing communications with users, and maintaining records of correspondence for organisational purposes and to protect the Data Controller in the event of disputes;

• to comply with legal obligations, regulations, or orders issued by judicial or administrative authorities.

Legal basis: compliance with a legal obligation pursuant to Article 6(1)(c) GDPR.

• Nature of data provision

The provision of browsing data (e.g. IP address, technical logs) is necessary to enable access to the Website and to ensure its security and proper functioning; failure to provide such data may result in the inability to access the Website or properly use its functionalities.

The provision of data required to send communications or requests for information through the Website’s contact channels is voluntary; however, failure to provide data marked as necessary to provide the request will make it impossible for OUR FILMS to respond or provide the requested information.

• Data retention period

Personal data are retained for no longer than is necessary to achieve the purposes for which they are processed, in accordance with the principle of storage limitation under Article 5(1)(e) of the Privacy Regulation.

In particular:

browsing data are retained for the time strictly necessary to ensure the operation and security of the Website, and in any case within the limits set by applicable law;

data provided by users for information requests are retained for the time necessary to process the request and manage any subsequent contacts, and in any event no longer than 12 months from receipt of the request, unless further legal obligations apply;

any data processed for administrative or legal-compliance purposes are retained for the period required under applicable laws.

• Disclosure and sharing of personal data

Personal data shall be processed by personnel of the Data Controller who are expressly authorised to process such data pursuant to Article 29 GDPR and Article 2-quaterdecies of Legislative Decree No. 196/2003, who are appropriately instructed and bound by confidentiality obligations.

In addition, personal data may be processed by third parties providing services to OUR FILMS, acting, as applicable, as:

(i) data processors pursuant to Article 28 GDPR, on the basis of specific documented instructions; and/or
(ii) independent data controllers, where they independently determine the purposes and means of processing (e.g. for the fulfilment of legal obligations or for the management of their own professional activities).

By way of example, personal data may be processed by:

• IT service providers, hosting providers, application maintenance and technical support providers;
• cybersecurity service providers (e.g. monitoring, prevention and incident-response services, anti-abuse systems);
• companies or professionals supporting OUR FILMS in organisational and operational activities related to the management of the Website and users’ requests;
• professionals and consultants (e.g. legal, tax and accounting advisors), within the limits necessary to perform their respective assignments.

As a rule, personal data are processed within the European Economic Area (“EEA”).
Where, due to the use of specific suppliers or services, it becomes necessary to transfer personal data to countries outside the EEA and/or to international organisations, OUR FILMS ensures that such transfers are carried out in compliance with Articles 44 et seq. of the GDPR, on the basis of:

• an adequacy decision issued by the European Commission; or
• in the absence thereof, appropriate safeguards (e.g. Standard Contractual Clauses adopted by the European Commission) and, where required, supplementary measures; or
• as a last resort, one of the derogations provided for under Article 49 GDPR.

Data subjects may request information on data transfers and/or obtain a copy of the applicable safeguards by contacting the Data Controller using the contact details set out in this Privacy Notice.

• Automated decision-making

Personal data provided by users are not subject to automated decision-making processes, including profiling, pursuant to Article 22 of the Privacy Regulation.

• data subject rights

Pursuant to Articles 15 et seq. of the Privacy Regulation, data subjects have the right to:

• obtain confirmation as to whether or not personal data concerning them are being processed;
• access their personal data;
• obtain rectification or updating of inaccurate or incomplete data;
• request erasure of personal data (right to be forgotten);
• obtain restriction of processing;
• object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them carried out pursuant to Article 6(1)(f) GDPR (legitimate interest); in such case, OUR FILMS shall refrain from further processing unless it demonstrates compelling legitimate basis for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims;
• receive personal data in a structured, commonly used and machine-readable format and transmit such data to another data controller (data portability);
• lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

The exercise of these rights may be subject to the limitations provided for by applicable law.

1. Amendments to this privacy notice

OUR FILMS reserves the right to amend or update this Privacy Notice at any time, including as a result of regulatory changes, technological developments or changes in the organisation of processing activities.

Updated versions will be published on the Website. Users are therefore invited to review this Privacy Notice periodically.

1. Exercise of rights and contact details

To exercise their rights or to obtain any information regarding the processing of personal data, data subjects may contact OUR FILMS using the contact details set out in this Privacy Notice, in particular at the following certified email (PEC) address: ourfilmsspa@pec.it.