Privacy Notice for Event and Webinar Participants

1. Data Controller
The Data Controller is Start 4.0, Corso Perrone 24, 16152 Genoa, Italy, Tax Code and VAT No. 02586330991, email segreteria@start4-0.it (the “Controller”).

2. Scope
This notice applies to personal data collected when registering for and taking part in events, workshops and webinars organised or co-organised by Start 4.0, whether in person or online. Information specific to an individual event is provided on its page or registration form.

3. Data processed

• Registration data: first name, surname, email address, organisation, role, sector and any other information requested in the form.
• Participation data: attendance, connection times on online platforms, questions and contributions.
• Images and recordings made during the event, as described in section 4.c.
• Accessibility needs: only if voluntarily provided, they are processed solely to provide assistance and with the data subject’s consent (Article 9(2)(a) GDPR).

4. Purposes and legal bases

• a) Management of registration and participation: registration confirmation, sending of access links and organisational communications, attendance records and any certificates of attendance. Legal basis: steps taken at the data subject’s request (Article 6(1)(b) GDPR).
• b) Administrative tasks and legal obligations, including reporting on activities to funding bodies and competent authorities. Legal basis: legal obligation (Article 6(1)(c) GDPR).
• c) Documentation and promotion of the Controller’s activities through photos and audio-video recordings of the event, which may be published on Start 4.0’s official channels.
  • For general shots, the legal basis is the Controller’s legitimate interest (Article 6(1)(f) GDPR), without prejudice to the right to object.
  • For publishing images in which the data subject is individually portrayed, or their contributions, the legal basis is consent (Article 6(1)(a) GDPR and Italian Law No. 633/1941).
  • If a webinar is recorded, participants are informed at the start of the session. Anyone who does not wish to appear may keep their camera and microphone off and take part via chat.
• d) Aggregated statistical analysis of participation, to improve future initiatives. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
• e) Sending information on Start 4.0 events, initiatives and activities, only with express consent (Article 6(1)(a) GDPR), which may be withdrawn at any time.
• f) Establishment, exercise or defence of legal claims. Legal basis: legitimate interest (Article 6(1)(f) GDPR).

5. Provision of data
Data marked as mandatory in the form are required for registration: without them, participation in the event is not possible. Consent for purposes 4.c (individual images) and 4.e is optional, and refusing it has no effect on participation.

6. Methods of processing
Data are processed using electronic and manual tools by authorised staff, in accordance with the principles of lawfulness, fairness and data minimisation. Appropriate security measures are adopted pursuant to Article 32 GDPR. No automated decision-making or profiling takes place.

7. Recipients
Data may be disclosed to:

• providers of IT, communication and online event platform services, such as Microsoft or videoconferencing and email service providers, appointed as data processors pursuant to Article 28 GDPR;
• partners and co-organisers of the event, only where necessary for its organisation and as specifically indicated on the registration page;
• funding bodies, public entities and authorities, where required by law or reporting obligations.

Data are not disseminated, except for the publication of images and recordings described in section 4.c. During online events, a participant’s display name may be visible to other participants. The updated list of data processors is available on request.

8. Transfers outside the EU
Where service providers process data outside the European Economic Area, transfers take place on the basis of a European Commission adequacy decision (e.g. the EU-US Data Privacy Framework) or other safeguards under Articles 46 and 49 GDPR, such as Standard Contractual Clauses.

9. Retention

• Registration and participation data: 24 months from the date of the event. They are kept longer where required by legal or reporting obligations, for the period those obligations require.
• Photos and recordings: for as long as they remain useful for documenting the Controller’s activities, unless the data subject objects or withdraws consent.
• Data used for promotional communications: until consent is withdrawn, and in any case no longer than 24 months from the last interaction.

10. Data subject rights
At any time, data subjects may request:

• access, rectification, erasure, restriction and portability of their data (Articles 15–20 GDPR);
• objection to processing based on legitimate interest (Article 21 GDPR);
• withdrawal of consent, without affecting the lawfulness of processing carried out before withdrawal.

Requests should be sent to segreteria@start4-0.it. Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali – www.garanteprivacy.it).

Last updated: October 2026