INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

(pursuant to Articles 13 and 14 of EU Regulation 2016/679)

Introduction

Pursuant to Articles 13 and 14 of EU Regulation 2016/679 (“GDPR”) concerning the protection of natural persons with regard to the processing of personal data, ITALIAN BLUE GROWTH SRL, as Data Controller, informs participants in the Event about the use of their personal data.

Data Controller

The Data Controller is ITALIAN BLUE GROWTH SRL – LIMITED LIABILITY COMPANY, represented by its legal representative pro tempore, VAT No. 01469820110, with registered office at Viale N. Fieschi, 18 – 19123 LA SPEZIA (SP), Email: info@ibgsrl.it.

External Data Processor

The Controller relies on METODO SRL UNIPERSONALE, with registered office at P.zza Paita, 1 – 19124 La Spezia (SP), VAT No. 00691270458, as the website manager and external Data Processor, limited to the processing and management of the website.

The Data Controller disclaims any responsibility for unlawful processing resulting from the communication of personal data relating to third parties other than the person making the reservation. The person making the reservation assumes responsibility for having obtained the consent of the third party, where required, and for having provided them with this information notice, pursuant to Article 14 of EU Regulation 2016/679.

Personal Data Processed and Purpose of Data Collection

The following data will be requested:

• First name
• Last name
• Email
• Company name
• Address
• Country
• Date of birth
• Place of birth
• Phone number
• Copy of identity document
• Passport-style photo

The Data Controller collects this personal data for the following purposes:

1. Registration for the SEAFUTURE 2025 Event and management of related activities (e.g., sending communications regarding the organizational aspects of the event).
   Legal basis: Art. 6, para. 1, letter b)
2. Management of access badges for participants to military areas hosting the SEAFUTURE 2025 Event.
   Legal basis: Art. 6, para. 1, letter c)

Providing this data is necessary for the data subject to reserve participation in the event activities.

Processing Methods

The Controller adopts appropriate security measures to prevent unauthorized access, disclosure, modification, or destruction of Personal Data. Processing is carried out using IT and/or telematic tools, with organizational methods and logic strictly related to the stated purposes.

Authorized Categories and Data Recipients

Personal data will be processed, in compliance with current legislation, by employees and collaborators authorized by the Data Controller, according to their roles and responsibilities.

In some cases, other parties involved in the organization of the website or external parties (e.g., third-party technical service providers, hosting providers, IT companies, communication agencies) may also access the data, and may be appointed as Data Processors by the Controller.

Data may also be communicated to other public or private entities, exclusively in cases provided for by law and regulations.

Data may be disclosed, in accordance with the law, to Public Security Authorities, Judicial Authorities, or other public bodies for purposes of defense, state security, and crime detection, as well as to comply with legal obligations where criminal offenses are suspected.

Data Retention

Personal data collected will be retained until the purposes outlined in this notice are fulfilled.

Transfer of Personal Data

The Controller does not transfer personal data to third countries. However, it reserves the right to use cloud services, in which case service providers will be selected among those offering adequate guarantees as provided by Article 46 of GDPR 2016/679.

User Rights

Users may exercise certain rights regarding their data processed by the Controller. Specifically, the User has the right to:

• Withdraw consent at any time.
• Object to the processing of their data when it is based on legal grounds other than consent.
• Access their data, obtain information about the processing, and receive a copy.
• Verify and request rectification of their data.
• Request restriction of processing under certain conditions.
• Request deletion of their personal data under certain conditions.
• Receive their data or have it transferred to another controller in a structured, commonly used, and machine-readable format, where technically feasible.
• Lodge a complaint with the competent data protection authority or take legal action.

Exercising these rights is free of charge under Article 12 of the GDPR, except in cases of manifestly unfounded or excessive requests (Art. 12, para. 5).

Data subjects who believe their data is being processed in violation of the Regulation have the right to lodge a complaint with the Data Protection Authority (Art. 77) or seek judicial remedy (Art. 79).

How to Exercise Rights

To exercise their rights, Users may send a request to the contact details of the Controller provided in this document.