Privacy & cookies

Notice on the processing of personal data for the AI WEEK event

Pursuant to Articles 13 and 14 of EU Regulation 679/2016 (“GDPR”), you are informed that the personal data provided by the data subject and/or acquired by Intelligenza Artificiale Spiegata Semplice S.r.l. (“IASS”), hereinafter also the “Controller” or “IASS”, in relation to the “AI WEEK” event (the “Event”) and the organisational phases preceding it, organised by IASS also in collaboration with third-party partners, are processed in compliance with the principles of lawfulness, fairness, correctness, proportionality, necessity, accuracy, completeness and security, and with the other applicable legal obligations.

To make what follows easier to understand, we provide a summary of how we process your personal data in connection with the AI WEEK event. The full notice follows.

Scope: This notice describes how we process users’ personal data when they interact with the AI WEEK services through: the website and its pages (including any landing pages and registration/purchase pages); the official AI WEEK app (Android and iOS), used for registration and access to the event services, for managing participation in talks/seminars/sessions and for the operational features connected to the event; the app features that allow users, on their own initiative, to share their data with exhibitors/partners (e.g. by scanning a QR code or equivalent tools). When data is shared with exhibitors/partners following a voluntary action by the user, those parties may process the data as independent controllers, according to their own notices. IASS will also use the QR code to allow access to the event and to certain areas, such as the restaurant or the backstage.

Who processes your data: Intelligenza Artificiale Spiegata Semplice S.r.l., also in collaboration with third-party partners.

We process your data to:

• organise and manage your participation in the event;
• send you informational or promotional communications;
• manage your personalised services (badge, translations, catering);
• ensure the security of the event and of the platform.

What data we process: Identification, contact and professional data, collected through forms, the app, business cards or event partners.

How long we process your data: For the time necessary for the requested service and in any case no longer than 10 years, depending on the purpose. After that, we delete or anonymise everything.

What your rights are: You always have the right to access, rectify and erase your data or to object to the processing, including for marketing purposes. Write to us at: info@aiweek.it.

Full notice

1) Controller and data protection officer

The Controller is Intelligenza Artificiale Spiegata Semplice S.r.l., with registered office at Claustro M. S. Tubito n.15 – Altamura (BA) – VAT number and tax code 08717290723, email info@iaspiegatasemplice.it. The Controller has appointed FinData s.r.l., in the person of Dr. Cino Wang Platania, as Data Protection Officer (DPO), email dpo@iaspiegatasemplice.it.

2) Categories of data subjects. Processing operations and methods of collection

The data processed concern customers (that is, exhibitors, visitors/buyers/trade professionals, conference delegates/congress participants, speakers of the Event, leading companies, stakeholders, opinion leaders, participants in championships/competitions and/or workshops, licensees of exhibition and/or advertising spaces, third-party organisers and sponsors who have held the respective role during the last 10 years) and prospects (persons who have expressed interest in the Event during the last 10 years – for example also by handing over their business card or requesting information or quotes – and journalists), meaning natural persons over the age of 14 who act on their own behalf and/or as internal contacts of legal entities, bodies or other organisations.

The individual categories of data collected are indicated in point 3. The processing is carried out with electronic and paper tools and with logic connected to the individual purposes declared below.

We collect the data referred to in point 3 through online forms or paper forms or participation forms completed by you and/or acquired from third-party operators authorised by us, or through the app made available to users.

The data collected may be processed by personnel expressly authorised by the Controller, within the limits strictly necessary for carrying out the respective assigned activities (e.g. legal, sales, marketing, administration, logistics, IT, management control departments, etc.).

IASS does not adopt automated decision-making processes that produce legal effects or significantly affect the person pursuant to Article 22 of the GDPR.

3) Categories of data

The personal data processed may vary depending on the services requested and on the ways of interacting with the Event (website and app) and may include, by way of example and not exhaustively:

• Identification and personal data (e.g. first name and last name);
• Contact data (e.g. email, telephone number, website) and data relating to residence/registered office and country of origin;
• Professional data and information about the organisation of affiliation (e.g. company name, job position and level of responsibility, business sector, types of products or services offered, markets of interest, information about the company contact person) and, for specific categories, further data such as publication/sector and language (journalists) or professional background/topics covered (speakers);
• Data relating to participation and to the services connected with the event (e.g. issue and management of tickets/accreditations/entry passes, participation in workshops, seminars, talks and sessions, services requested such as translations/hostesses/catering/accompaniment) and information connected with checking that a payment made through third-party services has been successful;
• Data collected through online forms/paper forms and, where applicable, through the handing over of business cards or through event partners;
• Data connected with the use of the app to access the event and the workshops, seminars, talks and sessions and, if the user uses the app to access stands, data acquired by the partner by scanning the QR code (with subsequent processing by the partner as an independent controller);
• Browsing and digital interaction data, also used for profiling activities, which may include data acquired while browsing the websites (e.g. cookies relating to the pages visited and the country from which you connect), data from other channels (e.g. social media) and data relating to interactions with email communications (e.g. which emails were opened and which actions were taken on content/links);
• Images and video recordings (including voice) made during the event;
• Technical data and log records connected with security and with proof of online operations (e.g. log-ins, failed logs, log-outs, logs of the reading of notices and logs of the actions by which consent is given);
• Contact data, specifically the email address only, used for automatic communications about abandoned carts/uncompleted purchases, where provided for;
• Geolocation data (only if permissions are enabled on the device; aimed at orientation and contextual services during the event).

4) Purposes of the processing

The processing has the following purposes:

(a) Fulfilment of contractual and legal obligations arising from participation or connected with the already contracted or potential participation of the data subject in the Event.

(b) Organisational planning and management of the Event, e.g. issue and payment of tickets, accreditations and entry passes (including checking that a payment made through third-party services has been successful), planning and management of specific services requested by you (for example translation services, hostesses, catering, accompaniment), management of the contracts we have entered into with third-party suppliers of goods and/or services used by you during or on the occasion of the Event; where agreed/contracted, publication of first name and last name or company name, telephone number, fax, email, website on the website of the Event in which you take part; communication, at your request, of pre-contractual information (e.g. programmes, proposals, etc.) connected with the Event, drafting of invitation letters for requesting consular visas.

(c) Access to the event, to the individual sessions/talks however indicated and, optionally, to the Partners’ stands. Within this purpose, the visitor must use the AI WEEK App to access the event and the individual sessions/talks for the whole duration of the event. The App may be used to access the Partners’ stands, which will scan the QR code, acquiring the visitor’s related personal data; in that case the data will be processed by the exhibitor as Independent Controller. In the specific case of access to seminars/workshops/sessions/talks, your data will be shared with the Partner as specified below.

(d) Sending, in accordance with the law in force (through the email address provided at registration), commercial, promotional and informational communications and offers for the sale of products/services similar to those you are interested in or relating to innovation, new technologies, Artificial Intelligence and/or related topics (e.g. industry publishing, other events, etc.) – overall activities defined as “soft spam” (carried out exclusively by IASS). However, if you do not wish to receive such communications, you may notify IASS at any time using the contact details given in the Contacts paragraph at the end of this notice or the link always available in the body of the email. IASS will in that case stop the above activity without delay.

(e) Profiling (carried out exclusively by IASS). The profiling carried out by IASS concerns natural persons, including sole proprietorships or partnerships and their partners/directors, or internal contacts of corporations, bodies or organisations. Profiling activities use some of the data you have provided to us and sometimes associate them with company data taken from public databases (e.g. the Register of Companies of the Chambers of Commerce).

For example, IASS processes the following data:

• i) in the case of AI WEEK participants: first name and last name, company name of the organisation of affiliation, contact data, job position and level of responsibility, residence or registered office, country of origin, website, business sector, types of products or services offered, markets of interest, information about the company contact person, residence or registered office, country of origin and website;
• ii) in the case of journalists: first name and last name, company name of the organisation of affiliation, contact data, job position and level of responsibility, residence or registered office, country of origin, website, business sector, types of products or services offered, markets of interest, information about the company contact person, residence or registered office, country of origin and website;
• iii) in the case of speakers of the AI WEEK Event: first name and last name, company name of the organisation of affiliation, contact data, job position and level of responsibility, residence or registered office, country of origin, website, business sector, types of products or services offered, markets of interest, information about the company contact person, residence or registered office, country of origin and website.

In some cases, if you are a customer or a prospect, we associate the data you have provided to us with further personal data of yours acquired while you browse our websites or while you use the services provided through those sites (e.g. cookies relating to the pages of our website you have visited, the country from which you connect) or through other communication channels (e.g. social media) or through bulk commercial email sending services (e.g. which messages reached you, which emails you opened, which proposals you accepted through specific actions such as opening an attachment or following a request of ours to link to landing pages or to attachments to the email message, etc.). Profiling allows IASS, in particular, to limit the sending to you of promotional communications that are not relevant to your likely expectations and needs or that are sent through channels you do not like.

The limited nature of the profiling does not exclude you from specific advantages or from the possibility of freely exercising your privacy rights, nor does it have particular legal effects; in particular, it does not in any way affect your ability to take part in the Event and/or to use the services offered by IASS (e.g. online pre-registration, purchase of services).

(f) On the occasion of participation in the Event, IASS may communicate to the Sponsors the personal data strictly necessary for the management and enhancement of the sponsorship and for the related organisational and reporting activities, such as, by way of example, first name, last name, job title, company, country and email address. Once they have received such data, the Sponsors will process them as independent controllers for their own purposes, in compliance with the applicable legislation and providing the data subject with the required information. Where the data subject has also given a specific, free and optional consent to the communication of their data to the Sponsors for marketing purposes, the Sponsors may immediately use the data received to send informational, commercial and promotional communications relating to their own products, services, initiatives and events, and for subsequent contact by email, telephone, SMS, instant messaging or other channels indicated in the notice provided by the Sponsor itself. In the absence of such specific consent to the transfer for marketing purposes, the communication of data to the Sponsors will remain limited to the organisational, administrative and sponsorship-enhancement purposes indicated above, excluding any direct promotional use by the Sponsors until they have obtained from the data subject a suitable lawful basis, where required by the applicable legislation. Failure to give consent to the communication of data for marketing purposes by the Sponsors does not in any way affect registration, participation in the Event or use of the related services. The updated list of the recipient Sponsors, or of the relevant categories, is made available on the website of the Event.

(g) Automated contact for abandoned cart / uncompleted purchase. Processing of the data subject’s contact data in order to send automatic email communications aimed at reminding or prompting the completion of a purchase or order that was started but not finalised, relating to services or products connected with the Event or offered by IASS.

(h) If the user enables location services on their device, the app may process location data (also by means of device technologies) in order to enable location-based features connected with the enjoyment of the event, for example to facilitate orientation within the event and access to relevant services/information depending on the area where the user is located. Providing location data is optional and the user may disable geolocation at any time through the device settings; disabling it may make unavailable, or limit the operation of, only the features that require location. The processing takes place within the limits strictly necessary for the purpose indicated above and, where provided for, subject to the user’s consent.

(i) During the Event, video recordings (including voice) and/or photographs are made by us and/or by photographers and/or videomakers authorised by us. These generic images concern trade-fair Events that qualify as public events and are therefore processed, without the need for your consent, for publication on our websites/landing pages and social profiles (e.g. Twitter, Facebook, WhatsApp, YouTube, Vimeo, etc.) and on brochures, catalogues, flyers and other paper material of the Partners that promote the Event.

If, however, the above images/videos portray you as the main subject and make you clearly recognisable with reasonable immediacy, IASS may publish them for the same promotional purposes, on the aforementioned paper materials or electronic/digital channels intended for the public (e.g. catalogues, brochures, flyers, websites/landing pages, blogs, social networks), only with your prior specific consent (which is the legal basis of the processing), given on site to our official photographer and/or videomaker.

In the latter case you may refuse consent, thereby preventing us from carrying out the above processing; if you give consent, you expressly waive any financial compensation for the use of your image. At any later time you may request the blurring of your face in images published online, without prejudice to the lawfulness of the processing carried out up to the date of the blurring.

5) Legal basis of the processing. Whether providing data is mandatory or optional and consequences of not providing it

The processing for purposes 4a, 4b, 4c and 4f has its legal basis in our need to fulfil the obligations undertaken through the contract entered into or to be entered into with you (and to carry out all the actions functional to the correct and complete performance of the commitments undertaken therein) and/or the legal obligations connected with it. Therefore, such processing does not require your prior consent and you are also free not to provide your data; however, in that case we will not be able to enter into the requested contract and/or regularly provide the service requested by you or by the organisation to which you belong (e.g. enabling you to take part in the Event of interest and providing you with the related services) and/or we will not be able to fulfil the legal obligations connected with the contract.

The processing for purposes under 4d, where it concerns only customers and only through the sending of emails (soft spam), has its legal basis in IASS’s legitimate interest in freely re-contacting its customers, in order to be able to propose new opportunities relating to services or products similar to those previously purchased/contracted. Therefore, the so-called soft spam just described may lawfully take place even without your prior consent, which is therefore not necessary.

The processing for purposes under 4e (profiling) has its legal basis in IASS’s legitimate interest.

These processing activities will be carried out by IASS on the basis of its own legitimate interest in optimising its purchasing procedures, by offering products and services that are more functional and useful for the specific needs of customers and prospects, also by re-contacting the data subjects after the event. The legitimate interest has been duly balanced against your interests and expectations in the data protection impact assessment, in which certain technical and legal measures were provided in order to minimise the impact of the profiling carried out by IASS on your legal sphere. This being the case, the profiling activities are carried out without your prior consent, which is therefore not necessary.

For the purpose relating to the communication of personal data to the Sponsors of the Event defined in point 4 f), IASS processes the data on distinct legal bases depending on the purpose of the communication. In particular, the communication of the data strictly necessary for the management and enhancement of the sponsorship, as well as for the related organisational, administrative and reporting activities towards the Sponsors, is based on the Controller’s legitimate interest, pursuant to Article 6(1)(f) of the GDPR, identified in the organisation, promotion and economic sustainability of the Event, also through the support provided by sponsorships, as well as in the proper performance of the related contractual relationships. This processing is carried out after a comparative assessment of the interests involved and in compliance with the principles of minimisation and proportionality and with the adoption of adequate safeguards. Conversely, where the communication of data to the Sponsors is made so that they can use the data for their own informational, commercial and promotional purposes, and to contact the data subject directly by email, telephone, SMS, instant messaging or other channels, the legal basis of the processing carried out by IASS is the free, specific, informed and optional consent of the data subject, pursuant to Article 6(1)(a) of the GDPR. This consent may be withdrawn at any time, without affecting the lawfulness of the processing carried out before the withdrawal. It is understood that the Sponsors, once they have received the data as independent controllers, will process them in compliance with the applicable legislation, on the legal basis identified by them from time to time for the processing within their competence and providing data subjects with the information required by Articles 13 and 14 of the GDPR.

The processing for purpose 4g has its legal basis in IASS’s legitimate interest in re-contacting the user who started a purchase process without completing it, in order to remind them of the possibility of completing it or to offer them assistance. This interest has been balanced, taking into account the data subject’s reasonable expectations and the limited impact of the processing, which is limited to communications strictly connected with a previous request or action of the data subject (starting the purchase). Consent is not required. The data subject may in any case object to this processing at any time.

For the purposes referred to in 4h that require geolocation through the app, the legal basis of the processing is the user’s consent, expressed by enabling location services and granting the related permissions on the device. Providing it is optional and failure to enable it does not affect the use of the app services that do not depend on location. Consent may be withdrawn at any time through the device settings (or the app settings, if available), without affecting the lawfulness of the processing carried out before the withdrawal.

For the photographs and/or video recordings referred to in 4 i) (including voice) made during the Event by us and/or by photographers/videomakers authorised by us, the legal basis of the processing is, in general, the Controller’s legitimate interest in documenting and promoting the Event, limited to “context” images and recordings and in any case such as not to portray the data subjects in a clearly and directly recognisable way; such content may be published on our channels (websites/landing pages, social profiles) and on promotional materials of the Event, including those of the Partners. If, on the other hand, the images and/or recordings portray you in a recognisable way (e.g. close-up, interview, pose or framing focused on the person), publication for promotional purposes on the same channels and materials will take place only with your specific consent, collected on site by the official photographer/videomaker; consent is optional and may be refused without any consequence on participation in the Event. If you give consent, you authorise the use of your image for the above purposes without compensation; you may also withdraw consent at any time, requesting – for online content – the removal and/or blurring of the face, it being understood that withdrawal does not affect the lawfulness of the processing carried out before it and that, for materials already printed/distributed, it may not be technically possible to recall the copies already circulated, any further future use being in any case prevented.

6) Communication and dissemination of data

For purposes 4a, 4b, 4c and 4h the data are communicated by IASS to: providers of the management and maintenance service of our IT systems, websites and databases, photographers and/or videomakers who produce the video-audio materials or the related post-production, journalists and news outlets, companies entrusted with services necessary for the organisation and management of the Event (e.g. installation of set-ups and equipment, publishers of paper and online catalogues, logistics, security, private security guards, first aid, hostesses, etc.), diplomatic representations, consultants, banks (for making or receiving payments connected with the Events), hotel facilities, suppliers, Public Authorities for obtaining entry visas, and personnel of the Joint Controllers authorised to process the data (Communication, Travel, Sales, Marketing areas, etc.).

For purposes 4d, 4e, 4g the data are communicated to: companies in charge of carrying out marketing analyses, advertising, communication and/or public relations agencies, digital and paper publishing companies that produce our advertising or promotional materials, website or blog production companies, web marketing companies, parties in charge of the design and/or maintenance of promotional materials, companies managing and maintaining the IT systems, websites and databases used to organise and manage the Event, image agencies.

Such third parties will process the data as External Processors, following our written instructions and under our supervision.

For all of the above purposes we also communicate the data to third-party commercial partners who take part in the realisation and/or promotion of the Event, who will process the data as independent controllers, joint controllers or processors. You may ask us for a list of the joint controllers, independent controllers and processors (see the “rights of the data subject” section of this notice).

For the purposes specified in point 4g, with your consent, we may transfer the data for marketing and promotional purposes to one or more Sponsors of the event, the list of which is available on the website of the Event.

7) Transfer of data outside the EU

The data may be processed by IT service providers, in their capacity as Data Processors. Should they operate outside the European Union, the processing will take place in one of the ways permitted by the law in force, such as, for example, the consent of the data subject, the adoption of Standard Clauses approved by the European Commission, the selection of parties adhering to international programmes for the free circulation of data or operating in countries considered safe by the European Commission. Further information is available by contacting IA Spiegata Semplice Srl at the contacts given below.

8) Duration of the processing

The personal data processed by IASS for purposes 4a, 4b and 4c will be kept for the time strictly necessary to achieve those same purposes. In any case, since these are processing operations carried out for the provision of services, IASS will keep the personal data for the period of time provided for and permitted by Italian law to protect its own interests (Art. 2946 of the Civil Code and following), that is 10 years.

The personal data processed for purposes 4d, 4e and 4i will be kept for up to 48 months from the last interaction between the Data Subject and IASS. Further information on the data retention period and on the criteria used to determine it may be requested by sending a written request to IASS. In the case of data processed for the publication of audio-visual editorial products, the duration of the processing is up to 5 years from the publication of the product.

The data needed by the App for geolocation (purpose 4i), if it is activated, will be available only and exclusively for the duration of the session. At closing they will be deleted.

We also process the data necessary for IT security purposes (e.g. records of log-ins, failed logs and log-outs, when accessing reserved areas on the websites managed by IASS and the AI WEEK app) for 2 years from collection. The log records relating to the reading of online privacy notices and to the online actions by which the data subject’s consent is communicated to IASS are kept for 10 years from collection.

In the event of a dispute between you and us or our third-party suppliers, we process the data for the time necessary to exercise the protection of our rights or those of the third-party suppliers, that is until the issue and full execution of a final judgment between the parties or of a settlement.

Once the above maximum duration has ended, the personal data are permanently destroyed or made completely anonymous. IASS and the respective data processors appointed by it apply rules that prevent the indefinite retention of data and therefore limit the retention time in compliance with the principle of data minimisation, carrying out a periodic yearly check on the data processed and on the possibility of deleting them if no longer necessary for the intended purposes.

9) Rights of the data subject

You are informed that the Data Subject has the right to:

• ask the Controller for confirmation as to whether or not personal data concerning them are being processed and, if so, to obtain access to the personal data and to the following information: a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if recipients in third countries or international organisations; d) where possible, the envisaged retention period of the personal data or, if not possible, the criteria used to determine that period; e) the existence of the right of the data subject to ask each Joint Controller for rectification or erasure of personal data or restriction of processing of personal data concerning them or to object to their processing; f) the right to lodge a complaint with a supervisory authority; g) where the data are not collected from the data subject, any available information as to their source; h) the existence of automated decision-making, including profiling and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject;
• where personal data are transferred to a third country or to an international organisation, the data subject has the right to be informed of the existence of appropriate safeguards relating to the transfer;
• request and obtain, without undue delay, the rectification of inaccurate data; taking into account the purposes of the processing, the completion of incomplete personal data, including by means of providing a supplementary statement;
• request the erasure of data if a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; b) the data subject withdraws the consent on which the processing is based and there is no other legal ground for the processing; c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or objects to processing for direct marketing purposes (including profiling related to such direct marketing); d) the personal data have been unlawfully processed; e) the personal data have to be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject; f) the personal data have been collected in relation to the offer of information society services;
• request the restriction of processing concerning the data subject, where one of the following applies: a) the data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of such personal data; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; d) the data subject has objected to processing carried out for direct marketing purposes, pending the verification whether the legitimate grounds of the controller override those of the data subject;
• obtain from the Controller, upon request, the communication of the third-party recipients to whom the personal data have been transmitted;
• withdraw at any time the consent to the processing, where previously given, for one or more specific purposes of their personal data, it being understood that this will not affect the lawfulness of the processing based on the consent given before the withdrawal;
• receive in a structured, commonly used and machine-readable format the personal data concerning them that they have provided to the Joint Controller and, where technically feasible, to have such data transmitted directly to another controller without hindrance from the Joint Controller to whom they were provided, where the following (cumulative) condition applies: a) the processing is based on the consent of the data subject for one or more specific purposes, or on a contract to which the data subject is a party and for whose performance the processing is necessary; and b) the processing is carried out by automated means (software) (overall, the so-called right to “portability”). The exercise of the so-called right to portability is without prejudice to the right to erasure provided above;
• the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them;
• the data subject may also, at any time, lodge a complaint with the Supervisory Authority competent under the GDPR (that of their place of residence or domicile).

The data subject may exercise their rights and request an updated list of the external third-party processors by contacting the Controller: IA Spiegata Semplice S.r.l., Claustro M. S. Tubito n.15 – Altamura (BA), VAT number 08717290723, email info@iaspiegatasemplice.it, or by contacting the DPO: dpo@iaspiegatasemplice.it

In any case, the controller will respond to requests relating to the exercise of rights without undue delay and, as a rule, within 30 days of receipt of the request. If the request is particularly complex, numerous or requires further checks, the deadline may be extended, within the limits provided for by the legislation, by informing the data subject within 30 days of receipt of the request, stating the reasons for the delay and the deadline by which the final response will be provided.

10) Updates to the notice

This notice may be subject to updates and/or changes over time, also as a result of changes in the processing carried out, the evolution of the services (site and app), organisational changes or regulatory updates. In the event of significant changes, we will give prominence to them through the site and/or through specific communications in the app (for example through a notice on the home page or a notification), indicating the date of the last update. The updated versions will always be available on our official channels; continued use of the services after the publication of the update implies that the user has taken note of it, it being understood that, where required by the legislation, any processing based on consent will be activated or continued only after collecting new consent.

Privacy Notice – IA Spiegata Semplice Community and AI Play

Privacy Notice (vers. 3.2 of 18/09/2025) pursuant to EU Regulation 2016/679 (GDPR) and Legislative Decree 196/03 (as amended).

This Privacy Notice describes the types of data we may collect and process through the use of the “IA Spiegata Semplice” Community, located at https://www.iaspiegatasemplice.it/, and of AI Play, located at https://www.aiplay.it/, describing the practices of collection, use, retention, protection and disclosure.

1. Data Controller and DPO

“IA Spiegata Semplice” is a web community in which subscribers are provided with free and paid Services, Digital Goods and Products whose main subject is topics related to artificial intelligence, in the form of webinars, articles, interviews, etc. “IA Spiegata Semplice” and AI Play are a business project of IA Spiegata Semplice S.r.l., registered office Claustro M. S. Tubito n.15 – Altamura (BA) – VAT number 08717290723. For more information, send an email to: info@iaspiegatasemplice.it

The Data Protection Officer (DPO) appointed by IA Spiegata Semplice S.r.l. is: Findata Srl, registered office Via Margherite n.39, Pollena T. (NA), in the person of Dr. Cino Wang Platania, who can be reached at the following email address: DPO@iaspiegatasemplice.it

2. Definitions

Data Controller: The natural person, legal person, public administration and any other body, association or organisation which, alone or jointly with others, determines the purposes and means of the processing of personal data and the tools used, including the security aspects of information.

Web Community (hereinafter also “Community”): The set of web spaces made available by the Controller to the User with the related services, digital goods and products that can be used, including all links to other sites, services and products.

Data Processor: The person, company, body, association or organisation to which the controller entrusts, even externally, because of their particular experience or ability, tasks of managing and controlling the processing of data.

End-User or Data Subject or User: These terms refer to anyone who browses the Community managed by the Controller, is a customer, or potential customer, of the Community, uses an APP managed by the Controller, subscribes to one of the services offered by the Controller or takes part in online and live events organised by the Controller. In the case of minors, the provisions of Art. 2-quinquies of Legislative Decree 196/03 (as amended by Legislative Decree 101/18) apply.

Websites: The sites or web pages managed by the Controller.

Personal Data: We consider personal any information that is voluntarily sent and that personally identifies someone, including contact information, such as name, email address, company name, address, telephone number and other information about you or your business. Personal Information may also include information about any transaction, whether free or paid, information that is available on the Internet, such as from Facebook, LinkedIn, Twitter and Google, or publicly available information. When the end user registers or logs in through one of their social channels, depending on the configuration of their social accounts some data are shared with one of the Controller’s websites. In addition, we consider credit or debit card numbers, personal financial account information, passport numbers or other identity document numbers to be particularly important personal data.

ChatBot and Chat: A chatbot or chatterbot is software designed to simulate a conversation with a human being. The main purpose of this software is to simulate human behaviour and it is used for various purposes such as online guidance, answering the FAQs of users who access a site, etc.; the Controller may offer within its web spaces the possibility for data subjects to interact with a chatbot in order to provide the services requested by the Data Subject, improve the user experience by disseminating information (description of services, products, promotions, etc.) and acquire contact information. Such interaction may also take place in the traditional way by putting the Data Subject in contact with an operator appointed by the Controller.

Special Data: Also known as “sensitive” data, we consider special data to be racial or ethnic origin, religious and philosophical beliefs, political opinions, trade union membership, information relating to health, sexual orientation and sex life, as well as biometric and genetic data.

Browsing Information: This refers to the information on your computer and to visits to this Community (and other web pages managed by the Controller), such as the IP address, geographical location, browser type, referral source, length of the visit and pages viewed.

Consent: This refers to the free expression of will of the data subject by which they expressly accept a specific processing of their personal data, of which they have been previously informed by the Data Controller.

3. Data processed, purposes and legal bases of the processing

Data generated by access to the site: The IT systems and software procedures used to operate the Community acquire, in the course of their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. These data (such as, for example, domain names, IP addresses, operating system used, type of device and browser used for the connection) are not accompanied by any additional personal information and are used to:

• I) obtain anonymous statistical information on the use of the platform;
• II) manage needs for controlling the way it is used;
• III) ascertain liability in the event of hypothetical computer crimes.

The legal basis that legitimises the processing of such data is the need to make the contracted functionalities usable and therefore the provision of the requested services.

Data voluntarily provided by the user: Personal information, which includes name, postal address, email address, telephone number, personal photo and/or any other identifier to contact the data subject online or offline or any other information that can be attributed directly or indirectly to the data subject and that will be provided by the data subject themselves through the registration procedure, which may take place on paper and directly, through the acquisition of data on the occasion of registration with the Community, or through chat, chatbot, online forms or direct email, are collected and processed for the following purposes: the performance of the contract or of pre-contractual activities to which the data subject is a party.

This purpose allows the data subject to enjoy the services whose provision is envisaged within the Community or to enter into a sales contract between the Controller and the user. This includes administrative purposes, payment management and the fulfilment of legal obligations such as those of an accounting or tax nature, or to comply with requests from the judicial authority;

3.1. Profiling: As regards the processing of personal data for profiling purposes linked to the provision of services, this processing is based on the legitimate interest necessary for providing services and products as close as possible to the customer’s needs, and therefore the consent of the data subject is not required for this processing. In this regard, it is specified that this profiling activity consists in the processing, by automated means, of information relating to the data subjects’ preferences and is exclusively aimed at providing support for the services used through the Community. This profiling activity, in any case, never concerns special data nor can it entail any limitation of freedom or generate discrimination of any kind. Finally, it is not envisaged to subject data subjects to automated decision-making processes, pursuant to Art. 22 of the Regulation, that produce legal effects concerning or significantly affecting the data subject.

3.2. Compliance: In a non-exhaustive way, to fulfil any obligations provided for by the laws in force, by regulations or by Community legislation, or to satisfy requests coming from the authorities. The processing of personal data for this purpose is necessary to fulfil legal obligations to which the Controller is subject. This processing is based, in fact, on Art. 6(1)(c) of the Regulation ([…] processing is necessary for compliance with a legal obligation to which the controller is subject). This processing could entail the retention and communication of personal data to the authorities for accounting, tax or other obligations.

3.3. Communications: To carry out communications to the data subject concerning services, digital goods and products that can be used within the Community by email, SMS, social networks, unless there is an express refusal to receive such communications, which may be expressed at any time. It is specified that the processing of personal data for this purpose is a legitimate processing, being part of the contractual performance.

3.4. Marketing: To carry out marketing activities such as: drawing up market studies, research and statistics; sending informational and promotional material relating to the activities, services and products of the Controller and of its commercial Partners (without any communication of personal data owned by the Community to those Partners); sending surveys to improve the service (“customer satisfaction”). Such communications may be made by email or SMS, through paper mail and/or the use of the telephone with an operator and/or through the official pages of the Community on social networks, or also through push notifications via Apps managed by the Controller and installed by the data subject. The legal basis of this processing is the freely given consent of the data subject; if, in any case, the data subject wishes to object to the processing of data for Marketing purposes carried out by the means indicated here, they may do so at any time by contacting the Controller at the contact details given in the “Contacts” section of this notice, without affecting the lawfulness of the processing based on the consent given before the withdrawal.

3.5. Transfer of data to other users of the community: One of the main purposes of the community is to create conditions, both online and offline, in which common interests can be brought together. Where the Controllers find that a user is interested in the proposals of another user (through the viewing of clips, pages, slides or other activities of this kind), the Controllers may communicate the data necessary for further exploration to the users by email or other means of communication. The data that may be communicated are: email, first name and last name, company name and telephone number. The legal basis of this processing is the performance of a contract.

If, in any case, the data subject wishes to object to the processing of data for the purposes of “transfer of data to other users of the community” carried out by the means indicated here, they may do so at any time by contacting the Controller at the contact details given in the “Contacts” section of this notice.

3.6. Statistics: For statistical purposes, without it being possible to trace your identity. It is specified that this processing is not carried out on personal data and can therefore be freely carried out by the Controller.

4. Nature of the provision of data

Apart from what is specified for browsing data and for data collected through the Community, the provision of data:

• with respect to the purposes referred to in points 3.1, 3.2, 3.3 and 3.5 is mandatory and any refusal will make it impossible for the Controller to provide the services that the Data Subject intends to subscribe to.
• with respect to the purposes referred to in point 3.4, adherence is optional and the use of the data for such purposes is partly conditional on the explicit consent of the Data Subject. Any refusal of the processing, of all or part of the data, will make it impossible for the Controller to carry out the processing for the purposes described.

5. Cookies

[See below]

6. Recipients of personal data

Your personal data may be shared, for the purposes referred to in section 3 of this notice, with:

• 6.1. Parties that typically act as processors pursuant to Art. 28 of the Regulation, that is, parties that cooperate with the Controller in pursuing the above purposes, including parties delegated to carry out technical maintenance activities (collectively “Recipients”);
• 6.2. Parties, bodies or authorities to which it is mandatory to communicate your personal data by virtue of legal provisions or orders of the authorities;
• 6.3. Persons authorised by the Controller, pursuant to Art. 29 of the Regulation, to process personal data necessary to carry out activities strictly related to the provision of the services, who have undertaken to maintain confidentiality or are in any case subject to an adequate legal obligation of confidentiality;
• 6.4. Parties involved in the organisation of the site (such as, for example, administrative, sales, marketing and legal staff, system administrators) or external personnel (such as third-party technical service providers, partners, sponsors, postal couriers, hosting providers, IT companies, communication agencies) who have undertaken to maintain confidentiality or are in any case subject to an adequate legal obligation of confidentiality, unless the user has given their express consent to the communication;

The updated list of the parties that may process your personal data as data processors is available by sending a written request to the Controller.

7. Transfer of personal data

The data may be processed by IT service providers, in their capacity as Data Processors. Should they operate outside the European Union, the processing will take place in one of the ways permitted by the law in force, such as, for example, the consent of the data subject or the adoption of Standard Clauses approved by the European Commission. More information is available, on request, from the Controller at the contacts indicated above.

8. Methods of processing and data retention periods

The data collected will be processed by electronic or in any case automated, IT and telematic means, or by manual processing with logic strictly related to the purposes for which the personal data were collected and, in any case, so as to guarantee their security. The data are kept for the time strictly necessary for managing the purposes for which they are collected, in compliance with the rules in force and legal obligations.

The personal data processed for the purposes referred to in section 3.1 will be kept for the time strictly necessary to achieve those same purposes. In any case, since these are processing operations carried out for the provision of services, the Controller will keep the personal data for the period of time provided for and permitted by Italian law to protect its own interests (Art. 2946 of the Civil Code and following).

The personal data processed for the purposes referred to in section 3.2 will be kept for the time provided for by the specific obligation or applicable legal provision.

The processing of data for marketing purposes (point 3.4) may take place for up to 24 months from the last interaction between the Data Subject and the Controller.

More information on the data retention period and on the criteria used to determine it may be requested by sending a written request to the Controller.

The Controller’s ability to keep your personal data for the period of time provided for and permitted by Italian law to protect its own interests (Art. 2947 of the Civil Code) remains in any case unaffected.

The Controller and the respective data processors appointed by it apply rules that prevent the indefinite retention of data and therefore limit the retention time in compliance with the principle of data minimisation, carrying out a periodic yearly check on the data processed and on the possibility of deleting them if no longer necessary for the intended purposes.

9. Rights of data subjects

Pursuant to Articles 7 of the Code and 15 and following of the Regulation, the Data Subject has the right to ask the Controller, at any time, for access to their personal data, for their rectification or erasure or to object to their processing, to request the restriction of processing in the cases provided for by Art. 18 of the Regulation, and to obtain in a structured, commonly used and machine-readable format the data concerning them, in the cases provided for by Art. 20 of the Regulation.

Requests must be addressed in writing to the Controller at the contact details given in point 1 of this notice, preferably using the email account chosen at registration for the services offered by the Community.

In any case, you always have the right to lodge a complaint with the competent Supervisory Authority (Garante per la Protezione dei Dati Personali), pursuant to Art. 77 of the Regulation, if you consider that the processing of your personal data is contrary to the legislation in force.

10. Data security details

Personal data are protected by technical, IT, organisational, logistical and procedural security measures against the risks of destruction or loss, including accidental, and of unauthorised access or unauthorised processing. These measures are updated periodically according to technical progress, the nature of the data and the specific characteristics of the processing, are constantly monitored and verified over time. These security measures correspond to the requirements that the Data Controller and the processors appointed by it have identified as adequate. Periodic “Risk Analysis” activities are carried out to verify compliance with the security protocols adopted and, where necessary, new security measures are introduced or updated following organisational changes and technological innovations or changes in the type of data collected. The security measures are constantly monitored and periodically verified.

11. Changes

The Controller reserves the right to modify or simply update its content, in part or completely, also due to changes in the applicable legislation. The Controller therefore invites you to visit this section regularly to become aware of the most recent and updated version of this notice, so as to always be up to date on the data collected and on the use the Controller makes of them.

Cookie policy

Last updated: 6 November 2026.

This section explains which cookies and similar technologies are used on the Attend AI WEEK platform (this website) and on the AI WEEK website www.aiweek.it. Both are managed by Intelligenza Artificiale Spiegata Semplice S.r.l. (“IASS”) as Controller; the processing of personal data is described in the privacy notices above.

What cookies are

Cookies are small text files that websites send to your device and that are stored there to be sent back to the same site (first-party cookies) or to a different site (third-party cookies) on your next visit. They make the user experience more efficient. In this section the word “cookies” also covers similar technologies that work in a comparable way, such as browser local storage, session storage, pixels and tags.

How cookies are classified

In line with Article 122 of the Italian Privacy Code (Legislative Decree 196/2003), Directive 2002/58/EC (ePrivacy), the GDPR and the Italian Data Protection Authority’s Guidelines on cookies and other tracking tools of 10 June 2021, we distinguish:

• Technical cookies: strictly necessary to provide a service explicitly requested by the user (for example, to keep you signed in or to protect a login). They are installed without your consent, but you must be informed about them, as we do here.
• Analytics (statistics) cookies: they measure how the site is used. They are treated like technical cookies only if they are used to produce aggregated statistics about the site, with measures that prevent the identification of the user (such as masking of the IP address) and without being combined with other data; otherwise they require your prior consent.
• Marketing and profiling cookies: used to track users across websites, to build profiles and to show targeted advertising or to measure advertising campaigns. They always require your prior consent.
• Third-party cookies: set by a party other than the site you are visiting (for example by embedded content or scripts). The third party acts as an independent controller and you can read its policy through the links below.

For more information you can read the Italian Data Protection Authority’s guidelines at https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876

A) Attend AI WEEK platform (this website)

A.1 Technical cookies (first party, no consent required)

When you browse the platform without signing in, no cookie is set. The following technical cookies are set only when you request a sign-in or sign in (for example to view your tickets or, for staff, to use the admin area).

A.2 Third-party content on the platform

Some pages include content provided by third parties. When you open those pages, your browser connects to the third party, which may read or set cookies and similar technologies. The third party acts as an independent controller.

Hotels page (hotel booking map provided by Hotelmap):

The Hotels page loads the Hotelmap widget (hotelmap.com), which in turn loads the following third-party services:

The Hotels page also loads fonts from Google Fonts (fonts.googleapis.com), map data from Mapbox (api.mapbox.com) and images from external content delivery networks. These requests do not store cookies on your device, but they transmit your IP address to those providers.

Session pages with a video recording (YouTube):

Where a session page includes the recording of the session (“Rewatch the Session”), the video is provided by YouTube (Google Ireland Ltd / Google LLC). When the page with the video is opened, YouTube may set cookies such as the following on its own domain:

Other pages of the platform (including the forms on the Press and Volunteers pages) do not set cookies or use third-party tracking tools. Links to our social profiles (Facebook, Instagram, LinkedIn, X, YouTube) are ordinary links: those networks set cookies only if you decide to visit them.

B) Website www.aiweek.it

The website www.aiweek.it is managed by IASS as Controller. The cookies below are those detected on its pages; the names, providers and durations refer to the cookies set on the domain aiweek.it.

B.1 Analytics (statistics) cookies

B.2 Marketing and profiling cookies

In addition, the website loads the following third-party services, which may set cookies or use similar technologies on their own domains for statistics, advertising measurement and profiling: LinkedIn Insight Tag (LinkedIn), Microsoft Clarity and Microsoft Advertising UET (Microsoft), the X (Twitter) advertising pixel, Outbrain, Google Ads / DoubleClick, MediaGo and AppLovin. Their cookies are subject to the same consent rules as the marketing and profiling cookies above.

B.3 Functional technologies (local storage)

Consent and how to manage cookies

Technical cookies do not require your consent. Analytics cookies that are not strictly anonymised, and all marketing and profiling cookies, may be used only with your prior, free and informed consent, which you can refuse or withdraw at any time without consequences for your access to the content of the sites.

You can also control and delete cookies at any time through your browser settings (Chrome, Firefox, Safari, Edge and others each have a section about cookies and site data). Blocking all cookies may prevent you from signing in to the platform. In addition, you can use the tools provided by the third parties themselves:

• Google (Analytics, Ads, YouTube): cookie information at https://policies.google.com/technologies/cookies and the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout
• Meta (Facebook and Instagram): https://www.facebook.com/policies/cookies/
• LinkedIn: https://www.linkedin.com/legal/cookie-policy
• Microsoft (Clarity and Advertising): https://www.microsoft.com/privacy/privacystatement
• X (Twitter): https://help.x.com/en/rules-and-policies/x-cookies
• Hotjar: https://www.hotjar.com/legal/policies/privacy/ (opt-out at https://www.hotjar.com/legal/compliance/opt-out)
• Shopify: https://www.shopify.com/legal/cookies
• Klaviyo: https://www.klaviyo.com/legal/privacy-notice
• ActiveCampaign: https://www.activecampaign.com/legal/privacy-policy
• Outbrain: https://www.outbrain.com/privacy/
• Mapbox: https://www.mapbox.com/legal/privacy

For the other providers listed in this section (Hotelmap, Homeland, AppLovin, MediaGo, Triple Whale, Quick Chat, WordPress), please refer to the privacy information published on their respective websites.

For any request relating to your data, including the exercise of the rights described in the privacy notices above, you can write to info@aiweek.it or to the Data Protection Officer at dpo@iaspiegatasemplice.it. This cookie policy may be updated when the tools used on the sites change; the date of the last update is shown at the top of this section.