Alperia S.p.A.
PRIVACY NOTICE FOR THE NEWSLETTER SERVICE
INTRODUCTION
In accordance with Articles 12 and 13 of the General Data Protection Regulation (EU) 2016/679 (GDPR), and in line with the principle of transparency established by the GDPR, Alperia S.p.A. (hereinafter also the “Company” or “Alperia”) provides the following information regarding the processing of Personal Data (any information relating to an identified or identifiable individual: the “Data Subject”) of newsletter subscribers (hereinafter also referred to as the “Subscriber”).
- DATA CONTROLLER
The data controller (the entity that determines the purposes and means of processing personal data, hereinafter the “Data Controller” or “Controller”) is Alperia S.p.A., with its registered office in Bolzano, Via Dodiciville No. 8, I-39100, Tax Code and VAT No. 02858310218, certified email (PEC):
For enquiries specifically relating to the Personal Data protection, including the exercise of the rights described in Section 9 below, please use the following email address:
Please send any requests to this address.
- CONTACT DETAILS OF THE DATA PROTECTION OFFICER (DPO)
The Data Controller has appointed a Data Protection Officer (“DPO”) pursuant to Article 37 of the GDPR. The DPO may be contacted through the following channels:
- Data Protection Officer (DPO)c/o Alperia S.p.A., Via Dodiciville No. 8, 39100 Bolzano
- e-mail:
This email address is being protected from spambots. You need JavaScript enabled to view it.
- PURPOSES OF PROCESSING
Personal Data are processed when a Data Subject subscribes to the newsletter service (purpose 3.1). The service enables the periodic delivery of email communications relating to activities at Expea, Alperia SPA's interactive museum.
In addition, data collected in connection with the newsletter service may be used for the purpose of “compiling statistics” (purpose 3.2) in aggregate form, to assess recipients’ overall engagement, without associating specific opens and clicks with individual recipients.
- TYPES OF DATA PROCESSED
The data processed may include personal data (“Personal Data”) provided by the Data Subject or obtained in the course of providing the service.
By way of example, the following categories of data may be processed:
- contact details (email address and, where applicable, first name and surname, telephone number, etc.);
- technical data (IP addresses and cookie-related data);
- anonymous statistical data on opens and clicks, bearing in mind that specific opens and clicks by individual Subscribers are not tracked.
- LEGAL BASIS FOR PROCESSING AND WHETHER PROVIDING DATA IS MANDATORY
With regard to purpose 3.1, “newsletter service”, subscribing to the service and giving consent to receive the relevant communications are optional. Processing will only take place when the Data Subject has provided consent. Without such specific consent, processing will not take place, including in relation to data that the Data Subject may already have provided for other purposes.
The Controller may provide different newsletter services, differing, for example, in subject matter, type of recipient and/or frequency. In that case, specific, separate and independent consent will be managed for each service provided.
With regard to purpose 3.2, “compiling statistics”, processing is based on the Controller’s legitimate interest in assessing the effectiveness and performance of the newsletter.
- DATA COLLECTION, PROCESSING METHODS AND DURATION OF PROCESSING
Data are collected directly from the Data Subject, namely the data provided by the Subscriber.
Processing will be carried out:
- using manual and automated systems;
- by persons or categories of persons authorised to perform the relevant tasks;
- using appropriate measures to ensure data confidentiality and prevent access by unauthorised third parties.
Personal Data processed for the purposes set out in Section 3 above will be retained in accordance with the principles of proportionality and necessity and, in any event, until the purposes of processing have been fulfilled under their respective legal bases.
For purpose 3.1, “newsletter service”, Personal Data will be processed for as long as the subscription remains active. Giving or withdrawing consent to a specific newsletter service will not affect any other consent separately given by the Data Subject for other newsletter services or other specific, independent purposes.
For purpose 3.2, “compiling statistics”, processing will continue for the entire duration of the newsletter service.
- DISCLOSURE OF DATA
The data collected and processed may be disclosed, exclusively for the purposes specified above, to:
- all entities entitled to access such data under legislative, regulatory or authorisation provisions;
- the Controller’s employees, contractors and service providers, within the scope of their duties and/or contractual obligations relating to the performance of the contractual relationship with Data Subjects. Examples of the Controller’s suppliers include other Alperia Group companies providing intercompany services to the Controller, or other entities performing activities on the Controller’s behalf under cooperation agreements, such as consultants and IT service providers;
- companies engaged to perform the activities involved in the specific processing operation. In particular, the tool used for processing is Brevo.
The entities listed above will process data as independent Data Controllers or as specifically appointed Data Processors or authorized personnel to Process Data.
The Data Controller provides any appointed Data Processors and Authorised Persons with appropriate instructions for adopting suitable security measures to ensure the confidentiality, security and integrity of the data.
- LOCATION OF DATA PROCESSING
Processing takes place within the European Economic Area (EEA), namely the EU plus Norway, Liechtenstein and Iceland, and is also carried out by certain Brevo sub-processors subject to arrangements complying with Chapter V of the GDPR, specifically: i) Canada, pursuant to an adequacy decision adopted by the European Commission; ii) the USA, on the basis of the EU–US Data Privacy Framework and Standard Contractual Clauses with supplementary measures; iii) India, on the basis of Standard Contractual Clauses with supplementary measures.
Except as described above, Personal Data are not transferred outside the EEA or to any international organisation.
- RIGHTS OF THE DATA SUBJECT
The GDPR grants Data Subjects rights in relation to their Personal Data. Please refer to the GDPR, particularly Articles 15–21 (the following brief description is indicative):
In relation to the Personal Data processed, the Data Subject has the right to:
- access their Personal Data;
- request rectification of their Personal Data;
- withdraw consent (where processing is based on consent, the Data Subject may withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal);
- request erasure (the so-called “right to be forgotten”);
- obtain restriction of processing;
- object to processing;
- receive their Personal Data in a structured, commonly used and machine-readable format;
- not be subject to a decision based solely on automated processing.
The Data Subject always has the right to lodge a complaint with the Data Protection Authority (Garante per la protezione dei dati personali). The Authority may be contacted using the contact details provided on its website: www.garanteprivacy.it.
To exercise their rights, withdraw consent given for the purposes set out in Section 3 above, or obtain further information concerning Personal Data, the Data Subject may send a communication to the following dedicated email address, specifying the nature of the request in the subject line:
Alternatively, they may use the other contact details for the Data Controller and/or the Data Protection Officer (DPO) provided above.
Each newsletter contains an unsubscribe link at the bottom, allowing recipients to opt out at any time.
The latest version of this Notice is available on the alperia.eu website.
Updated October 2026