As required by Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”), Finproject S.p.A. (“Company” or “Data Controller”) sets out below the privacy notice relating to the processing of personal data (“Personal Data”) related to you (“Data Subject”) in relation to the XL EXTRALIGHT® PRESENTS AIRSTONE. EXPLORING THE PARADOX OF LIGHTNESS AND MASS, A DIALOGUE BETWEEN PAOLO FERRARINI AND LUCA NICHETTO to be held on the 23 April 2026 at Spazio Big Via Santa Marta 10 ("Event") in which you request to participate.
in which you request to participate.
1. Data Controller
The Data Controller is Finproject S.p.A., VAT no. 01744770437, with registered office at Via San Gabriele 96, 62010, Morrovalle (MC).
2. Data protection officer
For any information about the processing of Personal Data, you can reach out to the Data Protection Officer ("DPO") appointed by the Company at the following email address: dpo@eni.com.
3. Personal Data processed
Personal Data processed are:
- personal and contact data provided directly by the Data Subject;
- photographic shooting, video and audio recordings collected during the Event (“Materials”).
4. Purposes of the processing
Personal Data are processed:
a. with reference to personal and contact data, for the purpose of the organization and operational management of the Event as well as for the purpose of protection and safety of the participants in the Event;
b. with reference to the Materials, for the purposes indicated in the consent form attached to this privacy information notice ("Consent Form");
c. to ascertain, exercise or defend a right of the Data Controller or of a third party before the courts or out of the courts.
5. Legal basis
Processing of personal and contact data for the purposes indicated in paragraph 4, let. a) above is, in accordance with article 6, par. 1, let. f) GDPR, the legitimate interest of the Data Controller to identify, also for security reasons, the individuals participating in the Event and to ensure their correct and regular participation in the Event also by sending them special communications concerning the organization and operational management of the Event.
Processing of the Materials for the purposes indicated in paragraph 4, let. b) above, in accordance with article 6, para. 1), let. a) GDPR, is based on the consent of the Data Subject which is purely voluntary and optional.
Processing of Personal Data for the purposes indicated in paragraph 4, let. c) above is, in accordance with article 6, para. 1, let. f) GDPR, the legitimate interest of the Data Controller or a third party in protecting its rights.
6. Persons authorised to process and recipients of Personal Data
Personal Data are processed by personnel appointed by the Data Controller to pursue the purposes described in paragraph 4, as persons authorised to process.
Personal Data may be disclosed by the Data Controller not only to public authorities, where requested by them or where required by law, but also to the following categories of recipients, solely for the purposes indicated in paragraph 4 above:
- Eni S.p.A. and other companies controlled by Eni S.p.A.;
- companies that provide support services for the organization and management of the Event;
- photographers, video editing service providers, marketing consultants, as the agency Xister Reply S.r.l.;
- companies providing IT services;
- professional and advisory firms engaged in connection with ordinary business and litigation.
With respect to Personal Data disclosed to them, recipients in the above categories may operate, as the case may be, as data processors (in which case they will receive appropriate instructions from the Data Controller) or as independent data controllers.
The Company guarantees that it will take the utmost care to ensure that the disclosure of Personal Data to the above recipients will be restricted to the information necessary to achieve the specific purposes for which Personal Data are required.
Materials, within the limits set forth in the Consent Form, will be disseminated outside the corporate context (e.g. xlextralight.com finproject.com shop.nichetto.com @14septembre @barbatibertolissi @xlextralight @nichettostudio @damnstudio @lucanichetto @matteoragnistudio @theinstalosopher @paoloferrarini_).
7. Transfer of Personal Data outside the European Economic Area
Where this serves the purposes described in paragraph 4, Personal Data might also be transferred abroad to companies based outside the European Economic Area (“EEA”). Some of the jurisdictions outside the EEA might not guarantee the same level of Personal Data protection guaranteed within the EEA. In this case, the Data Controller undertakes to regulate the transfer and subsequent processing of Personal Data through the Standard Contractual Clauses provided by the European Commission and to adopt every other safeguard required by article 46 GDPR if it is not possible to use one of the derogations listed in article 49 GDPR.
8. Means of the processing and Storage of Personal Data
Personal Data may be processed with the aid of electronic or automated systems, managed through tools that ensure security and confidentiality, and will include every operation or set of operations necessary for the processing.
Personal Data will be stored in the Data Controller's filing systems, including automated ones, and protected by appropriate security measures, until the purposes described in paragraph 4 above have been achieved, after which they will be erased.
Personal Data might be retained for longer in the event of litigation or requests from competent authorities, or where required by applicable law.
9. Rights of Data Subjects
Where applicable, and within the limits set by the GDPR, Data Subjects are entitled to:
- obtain confirmation from the Data Controller as to whether or not their Personal Data are being processed, and, where that is the case, access to the information listed in article 15 GDPR;
- obtain from the Data Controller the rectification of inaccurate Personal Data, or, taking into account the purposes of the processing, have incomplete Personal Data completed in accordance with article 16 GDPR;
- obtain from the Data Controller the erasure of Personal Data, where one of the grounds listed in article 17 GDPR applies;
- obtain from the Data Controller the restriction of processing of Personal Data in the cases listed in article 18 GDPR;
- receive - in a structured, commonly used and machine-readable format - Personal Data provided to the Data Controller, so that the Data Subject may transmit those data to another data controller without hindrance, in accordance with article 20 GDPR;
- object to the processing of their Personal Data on the basis of their particular situation, unless there are compelling legitimate grounds for the processing that override their interests, rights and freedoms or compelling legitimate grounds for the establishment, exercise or defence of legal claims, in accordance with article 21 GDPR.
- withdraw their consent at any time. Processing of Personal Data carried out by the Data Controller before the withdrawal of consent, however, remains valid. These rights may be exercised by emailing the DPO at dpo@eni.com.
Without prejudice to their right to initiate other administrative or judicial proceedings, Data Subjects also have the right to lodge a complaint with the competent supervisory authority (for Italy: Garante per la Protezione dei Dati Personali) if they believe that there has been a breach of their rights with regard to the protection of their Personal Data.
