IT

Information on the Processing of Personal Data

(Art. 13 – EU Regulation 679/2016 on personal data processing – rev.6 2024)

1. Purpose and Legal Basis of Personal Data Processing

The data controller, The Story Group, processes personal and identifying data (e.g. name, surname, company name, address, phone number, email, banking and payment details) – hereinafter referred to as “personal data” or “data” – provided by you in the context of contract conclusion or communication and media relations activities. It also processes contact data linked to any requests received via public email.

The type of activity carried out by the Controller involves the following data processing:

  1. Pre-contractual data processing, including inquiries received through contact email (legal basis: contract)
  2. Processing of contact data for business representatives during project design and delivery phases by Lifonti & Company SRL, Cabiria BrandUniverse SRL, Social Content Factory SRL (legal basis: contract)
  3. Processing of mailing list or contact data from our clients’ clients for event organization (legal basis: contract)
  4. Organization and management of digital PR campaigns / distribution of content on social media channels developed under contract (legal basis: contract)
  5. Building and maintaining relationships with individuals and professionals relevant to the contract and brand/reputation development of current and potential clients (legal basis: legitimate interest)
  6. Video recording of general and/or specific shots, including interviews, in compliance with applicable laws (legal basis: contract)
  7. Use of data (usually business data) for billing and administrative processes (legal basis: legal obligation)
  8. Processing of supplier data as part of contractual activities (legal basis: contract)

2. Nature, Methods and Duration of Data Processing

  1. Only common personal data strictly necessary and relevant to the purposes stated in point 1 will be processed.
  2. Data will be processed in both paper and electronic format, stored in multiple databases and used with due confidentiality and security measures.
  3. Processing is carried out directly by the data controller's organization.
  4. Data is stored within the EU.
  5. Retention periods are defined by the purposes mentioned above, administrative timelines for documentation, and project timelines up to a maximum of two years from conclusion. Data related to quotations is stored for up to six months. Specific notices are issued in particular cases.

3. Nature of Data Provision and Consequences of Refusal

  • Provision for contractual purposes and legal obligations – The provision of personal data is required to fulfill the purposes indicated. Failure to provide data may compromise, in whole or in part, the establishment or continuation of the contract, pre-contractual obligations, or the requested service.
  • Provision for accessory purposes: is voluntary, and refusal to consent (which may be revoked later) does not affect the establishment or continuation of contractual relationships.
  • PR Activities: although the data processing is contractual, individuals may object at any time to their involvement in the campaign/project or to the use of their personal data for network development by The Story Group.

4. Data Disclosure and Access

Your data may be made accessible for the purposes listed in Article 3.

Entities that may receive or access your personal data will act as:

  • Appointees or Data Processors (employees, consultants, and collaborators of the Company, in particular accounting and labor consultants, software providers, legal advisors, etc.)
  • Media partners and general partners involved in the specific campaign or project covered by the contract

5. Data Controller and Contact Information

The data controller is The Story Group SRL.

6. Data Subject Rights

As a data subject, you have the rights set out in Art. 15 GDPR...

7. How to Exercise Your Rights

You can exercise your rights at any time by sending: