Information on the Processing of Special Categories of Data
for Participation in Events/Courses/Activities
pursuant to European Regulation 2016/679 (GDPR)
DATA CONTROLLER
LA FATTORIA DELL’AUTOSUFFICIENZA – AGRICULTURAL LIMITED LIABILITY COMPANY – BENEFIT CORPORATION
Loc. Paganico snc, 47021 Bagno di Romagna (FC) | VAT No. 03777150404 | Tel. +39 335 8137979 | Email info@autosufficienza.it |
PEC lafattoriadellautosufficienza@pec.it (hereinafter “Company” or “Data Controller”).
NATURE OF THE DATA PROCESSED
Dear Participant, to guarantee you the best experience and your safety during your participation in our events/courses/activities organised at Autosufficienza farm, we may need to ask you to provide us with certain information that falls within the “special categories of personal data” (so-called sensitive data), pursuant to Art. 9 of European Regulation 2016/679 (GDPR). This concerns data relating to, for example:
- Allergies and food intolerances: for meal management and your food safety.
- Significant physical or psychological issues: to enable us to implement any specific measures or provide the necessary support during the activity.
PURPOSE OF PROCESSING AND LEGAL BASES
The data collected will be used exclusively for the following purposes:
- Management of your safety: to prevent risks or handle emergencies related to your health during the activity.
- Personalisation of experience: to tailor activities or services (e.g. meals) to your specific needs.
The processing of this particular data occurs solely on the basis of your explicit consent, which you provide by ticking the appropriate box during the registration process. Without your consent, we will not be able to acquire such information and, consequently, we may not be able to fully guarantee your safety or personalise your experience based on these specific needs (Article 6(1) GDPR).
PROCESSING AND STORAGE METHODS
The data subject to processing, including with the aid of IT systems, will be stored in dedicated paper and/or electronic archives, adequately protected. Paper and electronic documentation will be kept by the Data Controller for the entire time necessary for processing, using adequate organisational, technical and physical security measures, so as to minimise the risks of destruction or loss, unauthorised access or processing that does not comply with the purposes of collection. They will be kept for the time strictly necessary to provide the service and subsequently deleted in accordance with current regulations. Access to such data will be limited only to strictly authorised and trained personnel.
DATA RECIPIENTS
Your data will not be disseminated. It may be communicated to duly authorised personnel within our organisation, strictly on a need-to-know basis, for the provision of the service (e.g. to the manager and reception staff, to the cook for dietary requirements, to the instructor for adapting the experience to specific needs, etc.), always in compliance with your privacy and with the guarantees provided.
DATA TRANSFER
The management and storage of personal data will take place on servers located within the European Economic Area (EEA) owned by and/or available to the Data Controller and/or third-party companies duly appointed as data processors. Should it become necessary for technical, organisational and/or operational reasons to use entities located outside the EEA, the Data Controller hereby ensures that the transfer of Data will take place in compliance with the provisions set out in Chapter V of the Regulation, through the adoption of standard contractual clauses (SCCs) drafted on the basis of the versions prepared by the European Commission.
OBLIGATION OR OPTION TO PROVIDE DATA
Providing data is optional. However, failure to provide it may prevent us from taking the necessary precautions for your safety or from offering a service fully adapted to your specific conditions.
DATA SUBJECT RIGHTS
In accordance with Articles 15 et seq. of the GDPR, “Data Subjects” may exercise, vis-à-vis the Data Controller, the rights of access to their personal data, rectification of data, erasure or to be forgotten, limitation, data portability, as well as object to their use for legitimate reasons or withdraw consent provided, without prejudice to the lawfulness of processing based on consent prior to withdrawal. The request for data erasure is subject to the document retention obligations imposed by legal provisions. The exercise of rights is not subject to any formal constraints and is free of charge and may be carried out by sending a request via certified email (PEC) / registered post with return receipt or email to the Controller’s contact details, set out at the beginning of this notice. Finally, should you believe that the processing of data violates EU Reg. 2016/679, the data subject has the right to lodge a complaint with the Data Protection Authority pursuant to Article 77 of the Regulation itself.
Last update 25/06/2025
