Privacy Energy Painting

Alperia S.p.A.

PRIVACY NOTICE regarding the PROCESSING of PERSONAL DATA – Energy Painting

INTRODUCTION

In accordance with Articles 12 and 13 of the General Data Protection Regulation (EU) 2016/679 / General Data Protection Regulation (GDPR), and in general in accordance with the principle of transparency set out in the GDPR itself, Alperia Alperia S.p.A.(hereinafter also referred to as the 'Company' or 'Alperia') provides the following information regarding the processing of Personal Data (i.e. any information relating to an identified or identifiable natural person: 'Data Subject') of the newsletter subscriber (hereinafter also referred to simply as 'Subscriber').

  1. DATA CONTROLLER

The data controller (i.e. the entity that determines the purposes and means of processing personal data, the 'Data Controller' or 'Controller') is Alperia S.p.A., with its registered office at Via Dodiciville 8, I-39100, Bolzano, Tax Identification Number and VAT number 02858310218, certified email address (PEC) This email address is being protected from spambots. You need JavaScript enabled to view it. Certified email address This email address is being protected from spambots. You need JavaScript enabled to view it.

For enquiries specifically relating to the protection of personal data, including the exercise of the rights referred to in point 9 below, please contact us at the following email address: This email address is being protected from spambots. You need JavaScript enabled to view it.

to whom you are kindly requested to send any enquiries you may have.

  1. CONTACT DETAILS OF THE DATA PROTECTION OFFICER (DPO)

Please be advised that the Data Controller has appointed, in accordance with Article 37 of the GDPR, a Data Protection Officer(DPO), who can be contacted via the following channels: 

  • Data Protection Officer (DPO) c/oAlperia S.p.A, Via Dodiciville, No. 8, 39100 Bolzano
  • email:This email address is being protected from spambots. You need JavaScript enabled to view it.
  1. PURPOSE OF THE PROCESSING

Personal data is processed once the Member has registered with Energy Painting (purpose 3.1). The service consists of an ‘Energy Painting’ installation, an artistic installation designed to explore light as a visible form, including a photograph being taken and sent to the email address provided, after which it is immediately deleted from the systems.

  1. TYPE OF PROCESSING

As part of the ‘Energy Painting’ art installation, the following personal data is collected

  • digital photographs taken by the visitor, including the light effects they created, captured by deliberately pressing the shutter button within the installation’s rooms;
  • Email address.
  1. LEGAL BASIS OF THE PROCESSING AND OBLIGATORY NATURE OF CONFERMENT

With regard to the aforementioned purpose 3.1) 'Fotogioco', consent by conduct (Article 6(1)(a) of the GDPR): voluntary entry into the installation and deliberate pressing of the shutter release button. Participation is voluntary. Failure to take part has no consequences for the individual concerned, other than the inability to use the installation.

  1. COLLECTION, METHODS OF PROCESSING AND DURATION OF PROCESSING 

The data is collected from the Data Subject; in other words, it is the data provided by the registered user.

The processing will be carried out:

- through the use of automated systems;

- by persons or categories of persons authorised to perform the relevant tasks;

- with the use of appropriate measures to guarantee the confidentiality of the data and prevent access to them by unauthorised third parties.

Personal Data processed for the purposes referred to in point 3) above will be retained in accordance with the principles of proportionality and necessity, and in any event until the purposes of the processing, based on their respective legal grounds, have been fulfilled.

For purpose 3.1) ‘Energy Painting’, data processing will be carried out for the time strictly necessary to complete the experience and will conclude with the photograph being sent to the email address provided. Once the process is complete, your photograph and email address will not be retained.

  1. DISCLOSURE OF DATA

The data collected and processed may be communicated, exclusively for the purposes specified above, to:

  1. all persons who are granted access to such data pursuant to legislative, regulatory and authorisation provisions;
  2. employees, contractors and suppliers of the Data Controller, in the course of their duties and/or contractual obligations relating to the performance of the contractual relationship with the data subjects; the Data Controller’s suppliers include, by way of example, other companies within the Alperia Group that provide inter-company services to the Data Controller, or other parties that carry out activities on behalf of the Data Controller under collaboration agreements, e.g. consultants and IT service providers;
  3. companies commissioned to carry out the activities involved in the specific data processing operation. 

The parties listed above will process the data either as independent data controllers, or in their capacity as data processors or authorised data processors, having been specifically designated for this purpose. 

The Data Controller provides the Data Processors and any Authorised Persons designated, where applicable, with appropriate instructions aimed at ensuring that suitable security measures are adopted to guarantee the confidentiality, security and integrity of the data.

  1. PLACE OF DATA PROCESSING 

The processing of personal data takes place within the European Economic Area (EEA) – that is, the EU plus Norway, Liechtenstein and Iceland – as well as by certain sub-processors of Brevo, who are regulated in accordance with the provisions of Chapter V of the GDPR, in particular: (i) Canada, pursuant to an adequacy decision in respect of that country issued by the European Commission; (ii) the USA, on the basis of the EU-US Data Privacy Framework, the Standard Contractual Clauses and additional measures; (iii) India, on the basis of the Standard Contractual Clauses and additional measures.

Apart from what has been stated, there is no intention to transfer data to countries outside the EEA or to an international organisation.

  1. RIGHTS OF THE DATA SUBJECT

The GDPR grants the Data Subject the right to exercise their rights in relation to their personal data; reference should therefore be made to the GDPR, and in particular to Articles 15–21 (the following summary is provided for guidance):

In relation to the Personal Data being processed, the Data Subject has the right:

  1. to access their Personal Data;
  2. to request the rectification of their personal data;
  3. to withdraw consent (where processing is based on consent, the Data Subject may withdraw their consent at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal);
  4. to request erasure (the so-called ‘right to be forgotten’); 
  5. to have the processing restricted;
  6. to object to the processing;
  7. to receive their Personal Data in a structured, commonly used and machine-readable format;
  8. not to be subject to a decision based solely on automated processing.

The Data Subject always has the right to lodge a complaint with the Data Protection Authority.  The Data Protection Commissioner can be contacted using the contact details provided on the Authority’s website www.garanteprivacy.it

To exercise their rights and to withdraw the consent given for the purposes set out in point 3 above, as well as to obtain further information regarding Personal Data, the Data Subject may send a message, stating the subject of the specific request in the subject line, to the following dedicated email address:

This email address is being protected from spambots. You need JavaScript enabled to view it.

or to the other contacts of the Data Controller and/or the Data Protection Officer (DPO) listed above.

The updated version of this Privacy Notice is available on the alperia.eu website.

Update October 2026