The extended information published on our website www.meetandwork.it is an integral part of this document and the data subject declares to have read it.

1. Categories of data. The Data Controller may process the following data concerning you: name, surname, date and place of birth, residence, telephone, fax, e-mail, tax data, credit card data, tax identification number, images, whether you are a government employee or not, data of the public body for which you work. "Sensitive data" and "Judicial data" will not be processed (see articles 9 - 10 of EU Regulation 679/2016).

2. Legal basis and purpose of the processing. The processing of the aforementioned data is lawful as it is carried out:

c) with the prior consent of the data subject. After receiving the data subject’s consent, the Data Controller processes the data subject's personal data to send (via email/fax/SMS/other automated systems/calls without operator assistance/traditional mail/calls with operator assistance) news and information concerning his/her sector of work (example: communications about new conventions, events, courses, etc.). Furthermore, with the prior consent (and only in the event that it becomes necessary pursuant to the law on copyright) the Data Controller processes images of the data subject for the provision of remote educational (FAD) courses/for advertising purposes, etc. The data provided for these purposes will be kept until the revocation of the consent that the data subject may exercise at any time (see art. 7 EU Regulation no. 679/2016 on the right of revocation). The revocation does not affect the lawfulness of any processing based on consent provided before the revocation;

d) based on the legitimate interest of the Data Controller. Regardless of consent and in contrast based on the legitimate interest of the Data Controller, the sending - via email/fax/SMS/other automated systems/calls without operator assistance/traditional mail/calls with operator assistance - of communications regarding new events, conferences, refresher courses for those who have already established a relationship with the Data Controller or who have expressed an interest in the activities carried out by the Data Controller (by way of illustration only, the sending of the communication is permissible even without consent when it is sent to one who has already used the services of the Data Controller and who receives new communications regarding similar services). This processing - according to a careful assessment by the Data Controller does not invalidate the rights and freedoms of the data subject as the latter has expressed interest in the Data Controller's activities and expects information, updates and news regarding new services from the latter.

3. Obligatory/optional provision of data. The data subject is not obliged to provide the aforementioned data, however the failure to provide the data will prevent the data subject from participating in the course, event, conference, or to obtain the training credits from the competent institution.

4. On the communication of data to third parties. To comply with legal and contractual obligations, some of the aforementioned data may be communicated to third parties: 1) credit institutions for the payment of the registration fee; 2) insurance institutions in the event of accidents or other liabilities; 4) the Health Professions Registry Management Committee as a public body in charge of monitoring the event; 5) the National Agency for Regional Health Services (Agenas) as the body in charge of assigning credits; 6) to other public bodies, if this is required by law; 7) the lawyers representing our company to enforce the rights or to defend them in court, to the police forces in the case of offenses, or to the Judicial Authority.

6. Profiling and processing methods. The Data Controller does not engage in profiling. Data processing is carried out using computer systems (using PCs, management systems, e-mails, certified e-mail, telephone, fax, etc.) and paper documents (by printed documents, traditional mail, etc.) and the Data Controller protects the data subject's personal data with adequate security measures.

7. Data retention period. In relation to the processing referred to in point a) the data provided will be kept for a maximum period of 10 years starting from the end of the event, conference, refresher course, to comply with legal, accounting, tax obligations or to take legal action or to defend against a claim made by third parties. In relation to the processing referred to in point c), the data provided will be kept until the consent is revoked, which the data subject can assert at any time. The revocation does not affect the lawfulness of any processing based on consent provided before the revocation. In relation to the processing referred to in point d), the data provided will be kept until an opposition in that respect is submitted by the data subject, which is a right the data subject may exercise at any time.

8. The rights of the data subject. With regard to the processing of the aforementioned data, the data subject may at any time assert the following rights as per EU Reg. no. 679/2016 under articles: 15 - right of access to data; 16 - right of rectification; 17 - right to be forgotten; 18 - right to restrict processing; 20 - right to portability; 21 - right of opposition; 13 - right to revoke the consent given; 77 - right to lodge a complaint with the Italian Data Protection Authority in the event of violations.