INFORMATION ON THE PROCESSING OF PERSONAL DATA FOR PARTICIPANTS IN CONFERENCES, SEMINARS, TECHNICAL MEETINGS
pursuant to article 13 of the General Data Protection Regulation
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter "GDPR")
Dear Participant,
We are writing to follow up on what has already been communicated verbally to inform you again, in writing, that your personal data will be processed in accordance with the legislation referred to above and the confidentiality obligations underpinning the activities of AiCARR – Italian Association of Air Conditioning, Heating and Refrigeration (hereinafter also “Association” or “AiCARR”).
1) Source of personal data
The personal data held by the Association is that which you provided upon registration or which was collected during the event in which you are participating.
2) Purposes and methods of processing (Article 13(1)(c) of the GDPR)
Your personal data will be used for institutional purposes and for purposes connected with or instrumental to the activities relating to your participation in the conference/seminar/technical meeting, specifically:
- your registration for the event organised by AiCARR;
- management of the related administrative formalities;
- sending of material relating to the event;
- the awarding of any training credits;
- compliance with legal obligations (tax, accounting, etc.);
- customer administration and accounting;
- sending newsletters and other communications via email regarding the Association’s activities (conferences, technical meetings, courses, publications, etc.), including training activities/events organised by the Association through AiCARR Educational S.r.l. - SB, and sending selected issues of the print magazine AiCARR Journal to your address;
- disclosure of your contact details to Supporting Members and/or Meritorious Supporting Members (as defined in Article 4 of the Association’s Bylaws) and/or to sponsors collaborating on the event for commercial purposes;
- the security and functionality of the IT system;
- management of disputes in the event of non-compliance, complaints, legal disputes or settlements;
- anonymous and/or aggregated statistical analysis.
The processing of your personal data will be based on principles of fairness, lawfulness and transparency, purpose limitation, relevance, adequacy, non-excessiveness in relation to those purposes, and accuracy; the processing will also be carried out whilst safeguarding your privacy and your rights, as well as using appropriate tools to ensure security and confidentiality.
The methods used to process your personal data will involve the use of manual, IT and telematic tools, with procedures strictly related to the purposes indicated above.
3) Categories of personal data
Within the limits strictly relevant to the purposes set out above, we will need to process your personal data (first name, surname, address, professional details, VAT number, email address, name of any company you belong to, etc.). In the case of training events organised as webinars, the Association will also need to process, including in the form of reports generated using the specific function provided by the platform used on each occasion, your IP address – the transmission of which is implicit in the use of internet communication protocols – as well as data relating to attention tracking in compliance with the guidelines issued by the competent bodies for the recognition of training credits.
4) Legal basis for processing (Article 13(1)(c) GDPR)
In accordance with Article 6 of the GDPR, the legal basis for processing:
- with regard to purposes 1), 2), 3), 4), 5) and 6) is the performance of the contract to which you are a party and the fulfilment of legal obligations to which the Data Controller is subject;
- with regard to purposes 7) and 8), it is the consent you have given via the form below;
- with regard to purpose 9), it is the Data Controller’s legitimate interest in the security of networks and information systems;
- with regard to purpose 10), it is the need to establish, exercise or defend a legal claim in court.
- with regard to purpose 11), it is the Data Controller’s legitimate interest in optimising the services offered.
We invite you to notify us promptly of any changes to your personal data so that we can keep our records up to date.
5) Mandatory or optional nature of the provision of personal data and consequences of failure to provide such data (Article 13(2)(e) of the GDPR)
The provision of your personal data in relation to purposes a), b), c), d), e), f), i) and j) is optional but necessary for the establishment, performance and proper management of the contractual relationship relating to your participation in the event, and is also mandatory for the fulfilment of legal obligations. Therefore, failure to provide your data will make it impossible for you to participate in the event and to receive the relevant information material.
The provision of your personal data in relation to purposes g) and h) is optional, and should you choose not to give your consent, this would in no way affect your participation in the event but would simply mean that you would be unable to make use of the specific services referred to in the aforementioned purposes.
6) Recipients or categories of recipients of personal data (Article 13(1)(e) of the GDPR)
Within the limits strictly relevant to the purposes indicated above, your personal data may be disclosed to:
- service providers (e.g. companies that manage enveloping, labelling and dispatch services), consultants and freelancers;
- to the relevant bodies responsible for recognising training credits;
- to employees and/or collaborators of AiCARR in any capacity;
- to AiCARR Educational S.r.l. - SB;
- only with your specific consent, to Supporting Members and/or Meritorious.
Supporting Members and/or sponsors collaborating on the event.
The aforementioned parties will process your personal data, as appropriate, in their capacity as independent Data Controllers, or as Data Processors or System Administrators appointed in accordance with the law, including with regard to security measures to protect and safeguard your data.
In the case of training events organised as webinars, reports relating to the tracking of participants’ attention will not be disclosed to anyone.
Your data will not be disseminated in any way.
7) Transfer of personal data abroad (Article 13(1)(f) of the GDPR)
Your personal data may be transferred abroad through the use of the Outlook email service (Microsoft 365) and, specifically, may be transferred outside the European Economic Area (EEA).
With regard to such transfers, the contractual safeguards provided by Microsoft apply, and in particular the use of standard contractual clauses adopted or approved by the European Commission (Article 46(2)(c) and (d) of the GDPR), or adherence to the EU-US Privacy Shield, which guarantee an adequate level of protection.
8) Retention period for personal data (Article 13(2)(a) of the GDPR)
Your personal data will be retained for the time strictly necessary to achieve the purposes indicated above, as well as to fulfil the retention obligations required by law, and in any case for the limitation period provided for by law.
In the case of training events organised as webinars, reports relating to the tracking of participants’ attention will be retained for two years.
9) Rights of the data subject (Article 13(2)(b), (c) and (d) of the GDPR)
We remind you that you may at any time request the Association to grant you access to and rectify the data concerning you (Articles 15 and 16 GDPR).
Furthermore, where the conditions are met, you may request the erasure of your personal data (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (i.e. to receive your data from the Association in a structured, commonly used and machine-readable format, and to transmit it to another data controller without hindrance, Article 20 GDPR), and you may object to the processing of your data (Article 21 GDPR).
You also have the right to withdraw your consent at any time (where consent has been given), without affecting the lawfulness of processing based on consent given prior to withdrawal, and the right to lodge a complaint with the supervisory authority (Article 13(2)(c) and (d) of the GDPR).
10) Identification details of the Data Controller and contact details of the Data Protection Officer (Article 13(1)(a) and (b) of the GDPR)
The Data Controller is the AiCARR Association – Italian Association of Air Conditioning, Heating and Refrigeration, with registered office in Milan, Via Melchiorre Gioia, 168 (telephone 02 67479270, fax 02 67479262, email
info@aicarr.org ), whom you may contact, should you deem it necessary, for any further information.
The Association has not, at present, exercised its right to appoint a Data Protection Officer (“DPO”), as it is not obliged to do so under the GDPR.
The full text of the legislation referred to is available on the website of
Garante Privacy
Milan, updated April 2026
The Data Controller
AiCARR – Italian Association of Air Conditioning, Heating and Refrigeration
The Secretary General and Privacy Officer
Luca A. Piterà