Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 on the protection of personal data (GDPR)

Dear User,

This document provides you with all the necessary information regarding the processing of personal data collected by HonBoard Srl, in its capacity as Controller, in connection with the organisation and management of projects and events.

Should you require any clarification, you may contact the Controller using the contact details provided below.

Controller

The Controller is HonBoard Srl, with registered office at Viale S. Michele del Carso 10, 20144 Milan, Italy, and operational headquarters at BASE, Via Bergognone 34, 20144 Milan, Italy.

The Controller may also be contacted at the following email address: privacy@honboard.com

Data Subjects to whom the data relate

The processing may concern personal data relating to any individual involved in various capacities in projects undertaken by the Controller on its own behalf or on behalf of its Clients. These may include, by way of example and without limitation:

• healthcare and social care professionals (e.g. nurses, healthcare assistants, physicians, pharmacists and psychologists);
• scientific researchers working for public or private research organisations;
• patients, former patients and caregivers;
• journalists, media partners, influencers and spokespersons;
• suppliers of products and services used in the delivery of projects and events;
• representatives of public or private organisations involved in the initiatives.

Purposes and legal basis of processing

Personal data are processed strictly for the following purposes:

• organising and managing projects, initiatives and related events (legal basis: performance of a contract or steps taken prior to entering into a contract);
• sending communications concerning events and/or activities planned as part of the project (legal basis: performance of a contract or steps taken prior to entering into a contract);
• assessing participant satisfaction with an event or initiative (legal basis: performance of a contract; the Data Controller’s legitimate interests);
• sending institutional communications that are not strictly related to the project but concern other similar initiatives and events (legal basis: the Data Controller’s legitimate interests, subject to the right to object; the Data Subject’s consent where necessary);
• complying with legal requirements and regulatory obligations arising under laws, regulations and contracts (legal basis: compliance with a legal obligation);
• managing any objections, complaints and disputes (legal basis: the Data Controller’s legitimate interests).

Should the Controller introduce any processing purposes other than those described above, it will update this Privacy Notice and, where required, request consent to the processing by the most appropriate means.

Categories and sources of data processed

Personal data may be collected directly from Data Subjects during events and initiatives carried out as part of the projects. They may also be disclosed to the Controller by other controllers, such as patient associations or other organisations involved in the project. In such cases, the party disclosing the data must have an appropriate legal basis and must provide Data Subjects with the information for which it is responsible.

HonBoard collects only the personal data strictly necessary to carry out project activities and send related communications. Such data may include, by way of example, first name, surname, email address, telephone number, postal address and details of the organisation to which the individual belongs.

During public events, or more generally during the project, audiovisual materials may be produced, including photographs, event footage, and video and/or audio interviews. In full compliance with applicable law and with due regard for the rights, dignity and reputation of the individuals concerned, the materials collected may be published on the websites and social media platforms of HonBoard and/or the other project partners.

Given the Controller’s field of activity, processing may occasionally and indirectly involve sensitive data, namely ‘special categories of personal data’ within the meaning of Article 9 of the GDPR. These include data revealing racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership of political parties, trade unions, religious, philosophical, political or trade-union associations or organisations, as well as personal data revealing an individual’s health status or sex life. Such data are processed only where one of the conditions for lawful processing set out in Article 9 of the GDPR is met.

Methods and duration of processing

Processing is carried out primarily by electronic means, with data stored on cloud platforms and local company resources. Access to these data is restricted to the Controller, its authorised personnel and formally authorised Processors, where applicable. To a lesser extent, processing may also be carried out on paper; documents containing personal data are kept in appropriately protected archives.

Personal data are retained for as long as necessary to fulfil the purposes for which they were collected and, in all cases, in accordance with applicable law. Administrative and accounting records are normally retained for ten years. Data relating to an individual project are retained for the duration of that project and for any subsequent applicable limitation periods. Data used for consent-based communications are processed until consent is withdrawn, without prejudice to any retention necessary to document compliance. Audiovisual materials are retained for a period consistent with the purposes communicated and on the applicable legal basis.

A request for erasure or the withdrawal of consent will not affect processing already carried out lawfully and will not result in the erasure of data that the Controller is required to retain by law or for the establishment, exercise or defence of its legal rights.

The Controller has implemented appropriate physical, technical and organisational security measures to ensure the integrity, confidentiality and availability of the data.

Nature of the provision of data

The provision of data is generally optional but is necessary for the delivery of the project and therefore for the Controller’s compliance with its contractual obligations. If the data are not provided, it will not be possible to participate in the project and the opportunities connected with it, receive organisational communications or remain informed about Controller’s initiatives.

Where processing relates to a statutory or contractual requirement, the provision of data is necessary.

Where processing requires consent, the Data Subject may withdraw that consent at any time by contacting the Controller.

Disclosure and transfer of personal data

Personal data may be disclosed to Controller’s employees or contractors who have been formally appointed and authorised to process such data and have received appropriate operational instructions.

In addition, data may be processed by external legal or natural persons whose involvement may be necessary for project management or for organisational and technical purposes. Where applicable, such subjects are appointed as Processors pursuant to Article 28 of the GDPR.

HonBoard may also disclose the data to other third parties to comply with obligations imposed by law or contract (e.g. public bodies, supervisory authorities, law enforcement agencies and banks).

Controller uses services supplied by certain providers that may process or store data outside the European Union or the European Economic Area. In such cases, transfers are carried out in accordance with Chapter V of the GDPR, on the basis of an adequacy decision, the EU–US Data Privacy Framework for participating recipients, or Standard Contractual Clauses, where appropriate together with supplementary measures.

Personal data will not be disseminated in any way without specific authorisation.

Data Subject’s rights

Articles 15–22 of the GDPR set out the rights that Data Subjects may exercise against the Controller. These include, in particular:

• the right of access to personal data, including the right to:
• obtain confirmation as to whether or not personal data concerning the Data Subject are being processed and gain access to those data;
• be informed of the safeguards applied where data are transferred to a third country or an international organisation;
• obtain a copy of the personal data undergoing processing, provided that this does not adversely affect the rights and freedoms of others;
• the right to rectification of personal data;
• the right to erasure of all data (the ‘right to be forgotten’), unless the data are required for legal or public-interest reasons or in the other circumstances set out in Article 17(3) of the GDPR;
• the right to restriction of processing;
• the right to data portability;
• the right to object to processing, to withdraw consent previously given, and not to be subject to processing based on automated decision-making.

Data Subjects also have the right to receive prompt notification of any personal data breach likely to prejudice their dignity and freedom.

Lastly, Data Subjects have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy – urp@gpdp.it