According to the indicated legislation, the processing related to this service will be based on principles of correctness, lawfulness, transparency, and the protection of

your privacy and your rights.

With reference to the processing of personal data, strictly relevant to the execution of the activities entrusted through the associative relationship between the Parties, the list of processing purposes is indicated:

• Administrative checks, management of registration, renewals, and member payments
• Management of agreements with suppliers of goods and services
• Management for universal civil service
• Management for newsletters and magazines in digital and paper format for communication of events, projects, and initiatives
• Management for communication of services offered by UNPLI partners
• Management of names for insurance and accident coverage
• News related to associative life
• Management for support in fiscal, administrative, legal, and accounting activities
• Management for Pro Loco-UNPLI club memberships
• Management of IT protocol security

Pursuant to Article 13 of GDPR 2016/679, therefore, we provide you with the following information:

The personal data that will be collected and processed upon activation of this service concern:

• Common data: first name, last name, date and place of birth, gender, address, telephone number, email, membership card number
• Fiscal data: tax code, VAT number, IBAN
• Insurance data
• Technical data (IP address, browser type, cookies, social)

No processing of special categories of data (formerly sensitive data) is planned.
The collected data will be processed because:

• the data subject has expressed consent to the processing of their personal data for one or more specific purposes (in this case, consent will be acquired through a separate act);
• processing is necessary for the performance of a contract to which the data subject is a party or for the execution of pre-contractual measures taken at their request;
• processing is necessary for compliance with a legal obligation to which the data controller is subject;
• processing is necessary for the pursuit of the legitimate interest of the data controller or third parties, provided that the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data do not prevail, particularly if the data subject is a minor.

The personal data provided will be subject to collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, restriction, erasure, or destruction.

In the event of communication, the data will be transmitted to UNPLI Nazionale and Peripheral Branches in the role of Data Processors and Joint Controllers pursuant to Art. 28 of the GDPR (EU) 679/2016, through the Myunpli application or other suitable means.

The processing does not involve the activation of an automated decision-making process.

Please be informed that, given the purposes of the processing as illustrated above, the provision of data is voluntary, and their failure, partial, or inaccurate provision may result in the impossibility of carrying out the activities provided by the service.

The processing will be carried out using both manual and/or IT and electronic tools with organizational and processing logics strictly related to the purposes themselves and in any case in such a way as to guarantee the security, integrity, and confidentiality of the data in compliance with the

organizational, physical, and logical measures provided by current regulations.

In particular, the following security measures have been adopted: specific measures implemented to counter risks of destruction, loss, modification, unauthorized access, or disclosure, the effectiveness of which is regularly assessed; authentication systems; authorization systems; protection systems (antivirus; firewall; anti-intrusion; other) adopted for processing; and logistical security.

Personal data will be used until the termination of the associative relationship and in any case no later than the following 12 months. In any case, pursuant to Art. 5, paragraph 1, letter e) of the GDPR, they may be stored for a period of time not exceeding the achievement of the purposes

for which they were collected and processed, without prejudice to the legal obligations provided.

You may, at any time, exercise the following rights:

• to access personal data;
• to request more information regarding the contents of this information notice;
• to access personal data;
• to obtain the rectification or erasure of the same or the restriction of processing concerning you (in the cases provided for by law);
• to object to the processing (in the cases provided for by law);
• to data portability (in the cases provided for by law);
• to withdraw consent, where provided: the withdrawal of consent does not affect the lawfulness of processing based on consent given before its withdrawal;
• to lodge a complaint with the supervisory authority (Privacy Guarantor);
• to mandate a non-profit body, organization, or association to exercise your rights;
• to request compensation for damages resulting from the violation of the legislation (Art. 82).

Should the data controller intend to further process the personal data for a purpose other than that for which they were collected, information regarding this different purpose and any other relevant information will be provided prior to such further processing.

The exercise of your rights may take place through direct contact and/or by sending a request, including via email, to the President of the Pro Loco.

We inform you that you can obtain further information on the processing of data and the exercise of your rights, as well as on the regulatory discipline in the matter, at the following references:

Contact details of the President and/or Privacy Representative of Pro Loco Trieste: Daniele Muha info@proloctrieste.it

Italian Data Protection Authority http://www.garanteprivacy.it