Download this Privacy & Cookie Policy in PDF format.

Preamble

What is this document? This document is the policy on the processing of personal data related to the website and social pages.

Why this document? National and international regulations on the protection of personal data request that you – the data subject – shall be informed on the personal data being processed and who will process it, in order to ensure that the processing is fair and transparent.

Who shall process the personal data, which personal data shall be processed, the purposes for which personal data shall be processed, how long shall personal data be processed, which are the rights and how to exercise them are all clearly listed hereinafter.

Which regulations does this document refer to?

• Law 171/2018 on the protection of natural persons with regard to the processing of personal data (hereinafter “Law”)
• Regulation (EU) 2016/679 on the Protection of Personal Data (hereinafter “Regulation”)
• European Directive 2002/58/CE, the so-called “e-Privacy”

Privacy Policy

1.     DATA CONTROLLER

General Commissioner’s Office of the Government for the participation in Expo, Contrada Omagnano, 20 – 47890 Repubblica di San Marino –  E-mail info.expo@gov.sm – Tel. (+378) 0549 882519 (hereinafter “Controller”)

2.     DATA PROTECTION OFFICER – DPO

OU Procurement, contracts and personal data protection Office, Via della Capannaccia,13 47890 San Marino – ufficio.rdp@pa.sm – Tel. (+378) 0549 885872

3.    PURPOSES, LEGAL BASES, STORAGE PERIOD AND NATURE OF THE PROCESSING

Personal data, according to the actions carried out by the data subject, shall be processed for the following purposes:

a. Replying to requests received by email with reference to the EXPO 2025 Osaka:

• the legal basis of this processing is the carrying out of tasks that are of public interest or in the exercise of public authority;
• the storage period of the personal data processed for this purpose is equal to the time necessary to process the request;
• the personal data provided is necessary to reply to the data subject.

b. Replying to press accreditation requests received by form with reference to the EXPO 2025 Osaka:

• the legal basis of this processing is the carrying out of tasks that are of public interest or in the exercise of public authority;
• the storage period of the personal data processed for this purpose is for the whole duration of the event;
• the personal data requested is necessary to reply to the data subject.

c. Replying to requests received by means of social platforms (direct messages or on the wall):

• the legal basis of this processing is the carrying out of tasks, that are of public interest or in the exercise of public authority (for instance: replying and handling an enquiry with regard to the Expo 2025 Osaka present on the social platforms by means of private messages) and, in that event, your name or  user name and any other data you provide will be used to reply to your request;
• the storage period of the personal data processed for this purpose is equal to the time necessary to process the request;
• the personal data provided is necessary to reply to the data subject.

d. Administrative and management purposes and for compliance with obligations laid down by law, regulation or order of the Authority:

• the legal basis derives from the necessity to comply with a legal obligation to which the Controller is subjected;
• the storage period of the personal data processed for this purpose is connected to each legal obligations regulated by specific legislation;
• the provision of personal data is mandatory, since the Controller has to comply with a legal obligation to which he is subjected or with requests of the competent Authorities.

4.     PERSONAL DATA PROCESSED

By processing of personal data we mean any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Personal data which can be described as “special categories of personal data”, pursuant to Article 8 of the Law and Article 9 of the Regulation, could be sent by the data subject to the Controller. Such data reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, data concerning health or a natural person’s sex life or sexual orientation of the person. This category of personal data will be processed by the Controller in order to process the request received pursuant to Article 8(2) point e) of the Law and Article 9(2) point e) of the Regulation. Further processing of  special categories of personal data by the Controller will be carried out only upon and explicit consent.

Further personal data processed by the Controller:

• Browsing data: Access to this website and navigation within it takes places through the use of a web browser. Some data required to surf the Internet, by their very nature, could allow users to be identified through processing and association with data held by third parties. In particular, this refers to the IP addresses or domain names of the computers used by users connecting to this website; the URI (Uniform Resource Identifier) notation addresses of the resources requested; the time of the request, etc. Such data is used for the sole purpose of obtaining anonymous statistical information on the use of this website and to check that it is functioning correctly, and is deleted immediately after processing. The data could be used for possible liability in the event of cybercrimes connected with this website.
• Data provided voluntarily by the user: The discretionary, explicit and voluntary sending of messages to the contact addresses of the Controller entails the acquisition of the contact data of the sender, which are necessary to reply, as well as the personal data included in the communications;
• Social Media Platforms: The use of the social pages of the Controller entails a further processing of your personal data by the respective social platform provider, not strictly related to your interaction with us. The processing of users’ personal data complies with the policies in use on the platforms used. Personal data shared by users via private messages sent directly to the managers of the channels will be processed in compliance with data protection regulations in force and with this privacy policy.
• Cookies and other tracking systems: 
  • Definitions and characteristics of cookies: Cookies and similar technologies are information that websites send or read on your devices when you first visit them and the same information will be retransmitted at your next visit. Thanks to these technologies, websites remember actions and preferences (such as access credentials, language preferences, the character dimension, other display settings, etc.) so that they don’t have to be retransmitted in the following visits to the website. These technologies are used to perform digital authentication, to monitor sessions and to store information concerning users’ activities, that may also include a unique identifier that allows to keep track of the browsing for statistical or advertising purposes. There are different types of cookies that, according to their functions and characteristics, can persist on your device for different periods of time: the so called session cookies, which are automatically deleted when you close the browser; and the so called persistent cookies, which are stored on your device for an allotted time. In line with the applicable legislation, the prior consent of the user for the cookies’ use is always requested “analytics” cookies not anonymized and for the “profiling” ones: i.e. those that offer statistical analysis on the use of a website or create users profiles in order to send them advertising messages based on the preferences they have set during the browsing.
  • How to see and change cookies by means of the browser: You can authorise, block or delete (wholly or partly) cookies by means of specific functions of the browser or by additional components of third parties. Nevertheless, disabling the technical cookies of the website may entail the unavailability of some services or functionalities of the website itself or their malfunctioning. For further information on how to set preferences about the cookies’ use from the browser, the user can consult the guidelines made available by the browsers.
  • Type of cookies used: 

Necessary

These cookies are used to carry out the transmission of the communication or to provide the service required by the user. More precisely, they allow to enable and optimize the functioning of the website, to perform digital authentication and prevent breaches, to monitor sessions and enhance the web surfing experience (for example by keeping the connection to secure areas active while browsing the website without the need to re-enter the username and password or by storing the language preference set by the user).

Analytics

These cookies allow third parties to carry out aggregated or statistical analysis on the functioning of the Website and they could keep the possibility to identify the User.

5.     RECIPIENTS OF THE PERSONAL DATA

Personal data, depending on the actions carried out by the data subject, will be processed for the above-mentioned purposes by:

• Personnel explicitly authorized by the Controller necessary to carry out activities strictly related to the role entrusted, who have committed themselves to confidentiality and who have received adequate operational instructions pursuant to Article  28 of the Law and Article 29 of the Regulation;
• entities, who act as “Processors”, pursuant to Article 30 of the Law and Article 28 of the Regulation namely persons, companies or professionals, who assist and advise the Controller;
• entities, bodies or Authorities to whom it is mandatory to communicate your personal data by virtue of provisions laid down by law or orders of the Authority;
• entities with whom it is necessary to interact for the provision of services, as independent controllers.

The full list of Data Processors is available by sending a written request to the Controller.

6.     TRANSFER OF THE PERSONAL DATA

Some of your personal data is shared with recipients who could be located out of the Republic of San Marino and out of the European Economic Area (EEA). The Controller ensures that the processing of your personal data by these recipients is carried out in compliance with the Law and Regulation. Indeed, transfers shall be based on an adequacy decision or on Standard Contract Clauses approved by the European Commission. Further information is available at the Data Controller.

7.     EXISTENCE OF AN AUTOMATED DECISION-MAKING, INCLUDING THE PROFILING 

The Controller shall not employ automated decision-making on the processing of personal data, including the profiling, as set out in Article 22 of the Law and Regulation. Further information is available at the Controller.

8.     PERSONAL DATA RELATED TO MINORS UNDER 18 YEARS OF AGE

Minors under 18 years of age may not give personal data. The Controller shall not be liable in any way for any collection of personal data, nor for any false declarations provided by the minor, and in any case, if the use of such data is detected, the Controller shall facilitate the right to access and erasure submitted by the guardian, trustee or by who exercises the parental responsibility.

9.     RIGHTS OF THE DATA SUBJECT

Data subject shall have the right to obtain from the Controller, in the cases envisaged, the access to the personal data, the rectification or erasure of such data or the restriction of processing concerning him/her or to object to processing (Article 15 and followings of the Law and Regulation). The specific request to the Controller shall be presented by contacting the email designed for the feedback to the data subject.

10. RIGHT TO LODGE A COMPLAINT

The data subject, who believes that the processing of his/her personal data is taking place in breaching of the provisions of the Law and Regulation, shall have the right to lodge a complaint:

• to the Data Protection Authority (www.garanteprivacy.sm), as provided for in the Article 66 of the Law, or to bring the issue before the competent courts (Article 70 of the Law), if the breach happened in the territory of the Republic of San Marino;
• to the Italian Data Protection Authority (www.gpdp.it) as provided for in the Article 77 of the Regulation, or to bring the issue before the competent courts (Article 79 of the Regulation), if the breach happened in the territory of the European Union.

11. HOW TO EXERCISE THE RIGHTS

To exercise the rights above, you can contact the subjects appointed to respond to the data subjects:

• Data Controller: Commissariato Generale del Governo per la partecipazione ad Expo, Contrada Omagnano, 20 – 47890 Repubblica di San Marino –  E-mail info.expo@gov.sm – Tel. (+378) 0549 882519
• Data Protection Officer (DPO): OU Procurement, contracts and personal data protection Office, Via della Capannaccia,13 47890 San Marino – ufficio.rdp@pa.sm – Tel. (+378) 0549 885872

12. MODIFICATIONS

The Controller reserves the right to modify and/or integrate this policy at any time and undertakes to publish the modification on the company website in the Privacy section. Data subjects are invited to periodically check its content. This policy is effective from 29/11/2024.