ITSRIGHT S.r.l., with its registered office at Verziere 2, 20122 Milan (Italy), VAT Number 07083740964, Tel. +39 02.66668900, Fax. +39 02.66668915, in its quality of the personal data controller (“the Controller”, “ITSRIGHT”, “The Controller ITSRIGHT”) informs you (“Data subject”, “you”) – according to EU Regulation 2016/679 (“GDPR”) – that your personal data will be processed with the mechanisms and for the purposes set forth below.

1. What personal data do we collect from you?

Personal data collected directly from the Data subject
The Controller ITSRIGHT processes the personal data (such as, first name, surname, State and place of birth, citizenship, date of birth, fiscal code/VAT number, address of residence and/or address of domicile, telephone number, email address, information for payment) that you as the Data subject provide ITSRIGHT with:

1. Upon entering into or executing the Artist’s Contract/Producer’s Contract for the services rendered and the activities carried out by ITSRIGHT;
2. By filling in the “First Contact Form” available in the “Contact” section contained in ITSRIGHT’s website;

Personal data collected through your use of ITSRIGHT’s website
In the normal course of operation of ITSRIGHT’s website, the IT system and the relative procedures - enabling the functioning itself - acquire some personal data whose transmission is implicit in any communication protocol.
This information is not gathered to be associated with identified Data subjects, but because of its own nature, it could indeed enable the identification of users through elaboration and association with data kept by third parties.
This category of data may include the IP addresses or the domain names of the computers used by users connecting to the website, URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numeric code indicating the response status given by the server (successful, error, etc.) as well as other parameters relating to the operating system and the user’s IT environment.
Such data are used only to obtain anonymous statistical information on the website’s use and to control its proper functioning and are erased immediately after elaboration. Such data could also be used to ascertain liability in case of hypothetical IT crimes to the detriment of the website. Browsing data will be kept for 26 (twenty-six) months.
Cookies 
Detailed information about our Cookie Policy can be found in a dedicated section of ITSRIGHT’s website.

2. Legal basis and purposes of the processing

Your personal data are processed for specific purposes and on distinct legal bases:

1. As necessary to perform the Artist’s/Producer’s Contract you signed with ITSRIGHT, in particular for the following purposes (“Service-related Purposes”):
   
   • To sign contracts for the services rendered by ITSRIGHT;
   • To comply with pre-contractual, contractual and fiscal obligations deriving from the relationship with you.
2. On grounds of the legitimate interest of the Controller, for the following purposes (“Communication-related purposes”):
   
   • To send – via email, mail and/or text message and/or contact details – newsletters and commercial information regarding the services rendered by ITSRIGHT;
   • To display your personal data – strictly limited to name and surname – on ITSRIGHT’s website (http://www.itsright.it/en/) in the following sections:
     
     • Performers/Who is with us” roster and in “Mandators-Performers” (constantly updated) available under the section “Who we are”;
     • Producers/Who is with us” roster and in “Mandators-Producers” (constantly updated) available under the section “Who we are”;
3. When filling in the “First Contact Form” available in the “Contact” section contained in ITSRIGHT’s website, for the purpose of  enabling ITSRIGHT to contact you back to provide you with information on the activities carried out and services rendered by ITSRIGHT (“Contact-related Purposes”);
4. To exercise the rights of the Controller and to comply with legal obligations laid down by law, regulation, EU legislation or by measure issued by a public authority. More specifically, according to the provisions of Italian Legislative Decree No. 35/2017, the Controller display the roster of its Mandators in the “Corporate Governance” section of its website, in a download suitable format.

With reference to the browsing data, please read what provided for in the above “Personal data collected through your use of ITSRIGHT’s website” section (point 1. second paragraph).

3. Methods of Processing

Your personal data are processed – in conformity with GDPR’s provisions and the national legislation – with the following operations: collection, recording, organization, storage, consultation, adaptation, alteration, selection, retrieval, alignment, use, combination, restriction, disclosure, erasure or destruction.
Your personal data are processed both in paper and in electronic form.
Since ITSRIGHT provides its services by means of advanced IT systems – in the interests of the rights held/owned by its Mandators – the personal data processing may be carried out with partially automated methods which do not exclude the human intervention on the part of the Controller ITSRIGHT. In case of disagreement with such methods of processing, you have the right to express your opinion and to challenge the decision taken with the procedures as per points 9 and 10. In such case, however, ITSRIGHT may not guarantee the Services described in point 2.A).
The Controller ITSRIGHT will process your personal data for no longer than is necessary for the purposes as per point 2., but, in any case, for the “Service-related Purposes” no later than ten (10) years after termination of the relationship, for the “Communication-related Purposes” no later than two (2) months from the termination date of the Artist’s/Producer’s Contract, for the “Contact-related Purposes” no later than two (2) years from the data on which the form is sent and according to the limits provided by law for the purposes under point 2.D)..
With reference to the browsing data, please read what provided for in the above “Personal data collected through your use of ITSRIGHT’s website” section (point 1. second paragraph).

4. Sharing of personal data

Your personal data may be shared for the purposes laid down in points 2. A) and 2. B):

• With employers and collaborators of the Controller ITSRIGHT in charge of personal data processing and/or in their capacity of data processor;
• With companies, entities and societies in general (such as other collecting societies) in charge – on a collective and/or individual basis – of managing neighboring rights and collecting money deriving from relevant exploitations of the repertoires of ITSRIGHT’s Mandators in their capacity of data processors or independent data controllers;
• With third-party companies or other individuals carrying out IT outsourced services on behalf of the Controller ITSRIGHT in their capacity of data processors.

Personal data you provide ITSRIGHT with for the purposes as per point 2. C) will be indeed shared exclusively among those employers and collaborators of the Controller ITSRIGHT who are in charge of processing personal data.
With reference to the browsing data, please read what provided for in the above “Personal data collected through your use of ITSRIGHT’s website” section (point 1. second paragraph).

5. Disclosure of personal data

The Controller ITSRIGHT may disclosure your personal data for the purposes as per points 2.A) and 2.D) to supervisory authority, judicial authorities, insurance companies for the provision of insurance services, as well as to those individuals to whom such disclosure is mandatory or allowed by law. Such individuals will process the data in their capacity of independent data controllers.
Other than what provided for in the previous paragraph, your personal data will remain confidential.
With reference to the browsing data, please read what provided for in the above “Personal data collected through your use of ITSRIGHT’s website” section (point 1. second paragraph).

6. Access to website www.gorights.it 

As a user of the Controller’s website, you may access its website www.gorights.it, by clicking on “gorights” button.
You may access such website:

• By means of an intermediate web page which notifies users of the automatic re-addressing to www.gorights.it and contains a brief description of its content;
• Directly, if – after the first access – you have selected “Don’t show this message again” on the pop-up message on the intermediate web page.

Your personal data - you provide the Controller with during your browsing www.gorights.it - shall be processed by the Controller in accordance with GoRights Privacy policy (https://www.gorights.it/privacy).

7. Transfer of personal data

The Controller ITSRIGHT may transfer your personal data to third parties located in countries which are not members of the European Union. In such instances, the Controller ITSRIGHT shall ensure that the transfer of your personal data is carried out in accordance with the GDPR and, in particular, by means of standard contractual clauses approved by the EU Commission or on the basis of adequacy decisions of the European Commission.

8. Provision of the personal data and consequences of the refusal

The provision of your personal data - as the Data subject - is essential in order to perform the activities and services for the purposes as per points 2.A) and 2.D), since they constitute the core business of the Controller ITSRIGHT and/or they are necessary for the compliance with legal obligations to which the Controller is subject or for the exercise of the Controller’s rights. Otherwise, the Controller ITSRIGHT can’t guarantee its services and activities to you.
The provision of your personal data - as the Data subject - is optional as per the purposes described in point 2.B). You can therefore choose not to provide the Controller ITSRIGHT with any of your personal data. In such instance, you may neither receive newsletters and commercial communications regarding the Services of the Controller ITSRIGHT nor being displayed in the roster of ITSRIGHT’s Mandators available on ITSRIGHT’s website.
The above is without prejudice of the provisions laid down with regard to the Service-related purposes as per point 2.A).
The provision of your personal data - as the Data subject - is optional as per the purposes of point 2.C). However, should you choose not to provide your personal data, the Controller ITSRIGHT may not be able to supply you with the information you request by filling in the above-mentioned “First Contact Form”.
Without prejudice to what is set forth above, please read what provided for in the “Personal data collected through your use of ITSRIGHT’s website” section (point 1. second paragraph).

9. Rights of the Data subject 

As the Data subject and in relation to your personal data, you are given the rights listed in Articles 15-22 of the GDPR, and precisely:

1. The right to obtain from the Controller confirmation as to whether or not personal data concerning you are being processed and – even if not recorded yet – to obtain the communication of such data in intelligible form;
2. The right to obtain from the Controller:
   
   1. any available information as to the source of personal data not collected from you;
   2. any available information regarding purposes and methods of the personal data processing;
   3. any meaningful information about the logic involved in the processing carried out with the use of electronic instruments;
   4. the contact details of the Controller and the processors;
   5. information regarding the recipients or categories of recipients of your personal data, including those who may become acquainted with them in their capacity of designated representatives within the Territory of the State, processors or those who are in charge of processing.
3. Right to obtain:
   
   1. the update, rectification or – when interested – completion of incomplete personal data without undue delay and receiving also a supplementary statement.
   2. the erasure of personal data – without undue delay – where the grounds as per Art. 17 of the GDPR apply or the interruption in case of personal data unlawfully processed: including personal data which do not require storage in relation to the purposes for which they have been originally collected and/or further processed;
   3. the confirmation that the operations as per previous letters a), b) and c) have been communicated – even with reference to their content – to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
4. Right to object – in whole or in part:
   
   1. on legitimate grounds - to the processing of personal data, even if it is pertinent to the purpose of their collection;
   2. to the processing of personal data relating to you for  Communication-related purposes, at any time. In such event, the Controller shall cease to process your personal data for such purpose within 30 days from the receipt of your request. Right to object to the processing with regard to Communication-related purposes may be exercised also in part, i.e. with regard to a single purpose of those mentioned under point 2.B) or to a single marketing process (email, traditional mail, SMS, telephone).  
5. The right to obtain restriction of processing, where one of the circumstances as per Art. 18 of the GDPR occurs (such as, contestation of the accuracy of the personal data, unlawful processing, exercise of a legal claim before a Court, objection to processing);
6. The right to data portability that is the right to receive the personal data concerning you in a structured commonly used and machine-readable format and the right to transmit such data to another controller, with respect for third-party rights and freedoms;
7. The right to lodge a complaint with the Authority for the protection of personal data.

10. Procedures for exercising the rights

As the Data subject, you can exercise your rights at any time:

• By sending a registered letter to ITSRIGHT S.r.l. – Verziere 2, 20122 Milan (MI) Italy;
• By sending a certified letter (PEC) to the email address: infoitsright@legalmail.it

You can exercise your right to object as per point 9.iv.b by sending an email to dpo@itsright.it.

11. Data Protection Officer – other persons in charge of processing

The Data Protection Officer – appointed by the Controller ITSRIGHT – is Mr. Fernando Mantovani, reachable at any time: via email to dpo@itsright.it,  via regular mail to ITSRIGHT’s registered offices at Verziere 2, 20122 Milan (MI) Italy or by phone at +39 02. 66668900.
The updated list of processors and of other persons in charge of personal data processing is kept at ITSRIGHT’s registered offices.

12. Amendments and changes

This present regulation of personal data processing was updated on 30 June 2021. The Controller may amend or update its content at any time. Should the occurred amendments lead to substantial modifications in the processing or have a significant impact on data subjects, the Data subject shall be adequately notified by the Controller.
An updated version of personal data processing regulation is available in the personal area Myrights.