Meta Presence data processing
PERSONAL DATA PROCESSING POLICY
INTRODUCTION
TechStar srl (hereinafter the “Data Controller”) recognises the importance of protecting personal data and, to this end, wishes to inform you about how we collect, process, and store data related to your use of the Meta Presence® platform and its services. Our aim is to make you aware of your rights and how to exercise them easily, in accordance with the principles of lawfulness, fairness, and transparency in data processing.
This information is provided pursuant to Article 13 of European Regulation No. 2016/679 concerning the protection of individuals with regard to the processing of personal data and the free movement of such data (the “Regulation”), as well as in accordance with Italian Legislative Decree No. 196/03 and subsequent amendments (the “Personal Data Protection Code”), the provisions of the Italian Data Protection Authority, and the Guidelines of the European Committee of Data Protection Authorities (hereinafter collectively referred to as the “Applicable Regulations”).
This policy applies solely to the use of the Meta Presence® platform and does not extend to any other websites or platforms accessed via external links.
PARTIES INVOLVED
Data subject: the identified or identifiable individual whose personal data is being processed.
The data controller is TechStar srl, with its registered office at Via Cotonificio 84, 33037 Pasian di Prato (UD), Italy. VAT number IT03035830300.
The Data Controller has appointed a Data Protection Officer (DPO) who can be contacted to request clarification regarding this Privacy Policy or to exercise the rights provided by data protection legislation, as outlined below. To contact the DPO, please use the following email address: dpo@techstar.it .
For any information regarding this Privacy Policy, please email privacy@techstar.it.
1. WHO IS THIS PRIVACY POLICY FOR?
1.1 This Privacy Policy applies to any individual who provides their personal data to access and use one or more services on the Meta Presence® platform, hereinafter referred to as the “Data Subject”.
2. WHAT PERSONAL DATA ARE PROCESSED?
2.1 Definition of personal data
“Personal Data” refers to any information relating to an identified or identifiable natural person, such as their name, telephone number, email address, location data, online identifier (e.g., IP address), or any other characteristic of their physical, physiological, mental, economic, cultural, or social identity.
2.2 Data processed by Meta Presence®:
– Data provided by the Data Subject: This includes identification and contact details (such as name, surname, and email address) provided by the Data Subject to access Meta Presence®. The Data Controller will process this data in accordance with Applicable Law, assuming it relates to the user.
– Data relating to the use of the Meta Presence® platform by the data subject: date and time of access and exit from Meta Presence®; avatar position within Meta Presence®; type of hardware and software device used (PC, tablet, mobile phone, immersive viewer, browser, OS); data collected from the data subject’s interactions within Meta Presence® (movements, interactions with objects, subjects, documents, images/video/audio). As previously described, without specific consent, this data will be used exclusively in an anonymous and aggregated form for statistical analysis.
– Other data collected during the use of the Meta Presence® platform includes information related to interactions with objects, subjects, documents, images/video/audio; avatar reactions (menu functions for indicating reactions) and all information related to the user’s level of attention and “Sentiment”, which can be independently obtained from the platform; comments, suggestions and needs gathered through interactions via all available contact systems (email exchanges, chat, chatbot, etc.); images and video streams of connected users (even when their camera is activated); and forms and images used to personalise their avatar.
The Meta Presence® platform offers various features, some of which process Personal Data, while others do not. Profiling on the Meta Presence® platform will only be possible with specific consent.
In general, except for features where Personal Data is entered (such as an email address), data will always be processed anonymously and in aggregate form for statistical analysis. This includes, for example, obtaining quantitative data on the number of visits, time spent on the platform, and the duration and extent of interaction with individual objects, subjects, etc. For features that require specific consent for profiling, the Data Subject will always have the right to decide whether to provide and/or withdraw consent for the processing of their Personal Data for this purpose.
To be more specific, Meta Presence® has three types of users (also referred to as Data Subjects), which can be broadly identified as: “visitor,” “invitee,” and “registered.” When a “visitor” user accesses Meta Presence® (similar to visiting any website), no Personal Data will be recorded or processed, only anonymous and aggregated data. Even for an “invited” user – for example, someone invited via a link to a meeting on a video conferencing platform – no Personal Data will be recorded or processed beyond the email address to which the access link is sent, unless the Data Subject has given their consent to profiling. For a “registered” user – for example, someone logging into a specific role within a company cloud management software using their credentials – the data processed will be the identifying information required for access (such as username and email address). If consent is given, profiling will also be carried out.
The Data Controller will process the data in accordance with the Regulations, assuming it relates to the Data Subject or to third parties who have expressly authorised its provision on an appropriate legal basis.
3. HOW IS DATA COLLECTED?
3.1 Methods
The Data Controller collects personal data about the Data Subject when it is provided by them to access the Meta Presence® platform.
Personal data may also be provided by the Data Subject through interaction with individuals and/or objects while using Meta Presence®.
4. WHAT ARE THE PURPOSES, LEGAL BASES, AND WHETHER THE PROCESSING IS MANDATORY OR OPTIONAL?
4.1 Purpose
Your personal data will be processed for the following purposes:
a) to fulfil a contract with the Data Subject, including pre-contractual measures and preliminary activities to enable access (such as the Data Processor contacting the user for a demonstration of Meta Presence®); to respond to queries or complaints; to provide assistance; to communicate with the Data Subject; etc.
b) for statistical analysis of aggregated and anonymous data, without the possibility of identifying the user.
c) per la necessità di accertare, esercitare o difendere un diritto in sede giudiziaria o ogniqualvolta le autorità giurisdizionali esercitino le loro funzioni giurisdizionali.
d) for user profiling, provided consent is given.
e) to communicate with third-party entities or companies for the promotion and sale of similar products and services, or for statistical surveys and market research, provided consent is given.
4.2 Legal Basis
The legal basis for processing Personal Data for the purposes outlined in point a) is the contract with the Data Subject, including the pre-contractual phase and direct contact to respond to their requests and/or provide the agreed services. The purpose outlined in point b) does not involve processing Personal Data, whereas the purpose outlined in point c) is based on the Data Controller’s legitimate interest in legal protection. The legal basis for processing Personal Data for the purposes outlined in points d) and e) is consent.
It remains understood that, for services and products similar to those for which interest has been expressed, commercial communications may be sent based on legitimate interest, within the limits permitted by law.
4.3 Mandatory and optional provision of data
Providing Personal Data for the purposes outlined in point a) above is necessary to fulfil the Data Subject’s request to access Meta Presence® and its related services, as well as to process any further requests concerning these services. Failure to provide this data may therefore prevent us from responding to your request, delivering the requested services, or fulfilling our contractual obligations. As a result, you may not be able to access Meta Presence® or use its services properly.
5. HOW IS THE DATA PROCESSED? IS THERE A TRANSFER OUTSIDE THE EU?
5.1 Methods
Data is processed primarily electronically and digitally, using tools designed to ensure its security, availability, integrity, and confidentiality. Data processing is carried out using cloud systems with servers located within the European Union.
5.2 Transfer to third countries
Your personal data will not be transferred to countries outside the European Economic Area (EEA), or to countries that have not been deemed “adequate” by the relevant authorities, or without the appropriate safeguards in place as outlined in the Regulation (such as Standard Contractual Clauses, or clauses that do not ensure adequate levels of data security).
6. WHO ARE THE RECIPIENTS OF THE PROCESSED DATA?
6.1 General Information
The personal data of users who request information (such as answers to questions or quotes) is used solely to provide the requested service. It is only shared with third parties when necessary to fulfil the request, when required by law, or in the event of legal proceedings.
6.2 Who we share your personal data with
The Data Controller only discloses users’ personal data within the limits permitted by law and in accordance with the following.
Without prejudice to any legal obligations, the following may have access to the Data Subject’s Personal Data: (i) employees and collaborators of the Data Controller, who are authorised to process data and have been instructed to do so by the Data Controller; (ii) suppliers of the Data Controller who perform specific technical, IT, and organisational services related to the use or promotion of services instrumental to the Data Controller’s activities.
These parties will act, as appropriate, as authorised by the Data Controller (such as employees and collaborators), as data processors on behalf of the Data Controller (or other service providers), or as independent data controllers.
Furthermore, data may be disclosed to law enforcement or judicial authorities, in accordance with the law and upon their formal request, or where there are reasonable grounds to believe that such disclosure is necessary to (1) investigate, prevent, or take action regarding suspected illegal activity, or to assist state control and supervisory authorities; (2) defend against any claim or accusation by third parties, or to protect the security of the platform and the company; or (3) exercise or protect the rights, property, or security of the Data Controller, its affiliates, customers, employees, or any other party.
If consent is given, the data may be shared with third parties – entities or companies – for the promotion and sale of similar products and services, or for statistical surveys and market research.
6.3 Processing of avatars created using third-party services
Avatars created using external services (such as ReadyPlayerMe) can be used within Meta Presence®, even if they are embedded in the platform, even if only through a frame. Avatar data will be processed directly by these third-party companies, acting as independent data controllers. For more information on how they process data for this purpose, please refer to their privacy policies.
7. HOW LONG DO WE KEEP YOUR DATA?
7.1 General Information
Personal data is used solely to provide the requested service and is only shared with third parties when necessary for service fulfilment (e.g., with service providers), when legally required, or in the event of legal proceedings.
7.2 Categories of recipients of your personal data
TechStar only discloses users’ personal data to the extent permitted by law and in accordance with the following. Without prejudice to any communications required by law, the following may become aware of the Data Subject’s Personal Data: (i) TechStar employees and collaborators, acting as authorised data processors and instructed by the Data Controller; (ii) TechStar suppliers who perform specific technical, IT, and organisational services related to the use of the service or other services instrumental to the activity provided.
These parties will act, as appropriate, either as authorised by the Data Controller (such as employees and collaborators), as data processors on behalf of the Data Controller, or as independent data controllers. In the latter case, these entities, acting as independent data controllers for their own purposes, will issue their own privacy policy, which you should consult.
Furthermore, the Data may be disclosed to law enforcement or judicial authorities, in accordance with the law and upon their formal request, or where there are reasonable grounds to believe that such disclosure is necessary to (1) investigate, prevent, or take action regarding suspected illegal activity, or to assist state control and supervisory authorities; (2) defend against any claim or accusation by third parties, or to protect the security of the Site and the company; or (3) exercise or protect the rights, property, or safety of TechStar, its affiliates, customers, employees, or any other party. Your data will not be disclosed in any way.
7.3 Processing of avatars created using third-party services
Within Meta Presence®, avatars created using external services (such as readyplayer.me) can be used, even if they are embedded in the displayed page through framing. Avatar data will be processed directly by these third-party companies, acting as independent data controllers. Please refer to their privacy policies for more information on how they process data for this purpose.
8. HOW CAN YOU CONTROL THE PROCESSING OF YOUR PERSONAL DATA?
8.1 Your rights and how to exercise them
The Regulation grants the Data Subject various rights, detailed below, to control their personal data and how it is processed by the Data Controller. To exercise your rights, simply send a request to the following address: privacy@techstar.it .
8.2 Can you request access to your personal data?
If you wish to access your personal data, you may request a copy of the data in the format provided on the platform, along with information regarding its processing. The right of access may be restricted in cases where this is permitted by law or applicable regulations.
8.3 Can I request a correction to my personal data?
If you believe your personal data is inaccurate or incomplete, you may request that it be amended or supplemented accordingly. In some cases, supporting documentation may be required.
8.4 Can I request the deletion of my personal data?
If you wish, you may request the deletion of your personal data, within the limits of the law and where it is no longer necessary to retain it for the purposes for which it was collected and processed.
8.5 Can you object to the processing of your personal data based on legitimate interests?
If you do not agree with the processing of your personal data based on legitimate interests, you can object at any time for reasons related to your particular situation, specifying the processing activity concerned and the reasons for your objection. Personal data will no longer be processed unless there are compelling legitimate grounds for doing so, or the processing is necessary for the establishment, exercise, or defence of legal claims.
8.6 Can I object to the processing of my personal data for profiling purposes?
You have the right to object at any time to the processing of your personal data for profiling purposes.
8.7 Can you restrict the processing of your personal data?
Under certain conditions, you have the right to restrict the processing of your data if it is not relevant to the continuation of the contractual relationship or required by law.
8.8 Do you have any rights regarding automated decisions?
Generally, you have the right not to be subject to a decision based solely on automated processing, including profiling, that has a legal effect or significantly affects you. However, an automated decision may be made if it is necessary for entering into or performing a contract, if it is authorised by Italian or European Union law, or if consent has been given. In any case, you have the opportunity to challenge the decision, express your views, and request a review by a person who can reconsider it.
8.9 Can I request the portability of some of my personal data?
Where technically feasible, you may request a copy of the personal data you have provided in a structured, commonly used, and machine-readable format. Where technically feasible, you may request that this copy be sent to specified third-party data controllers.
8.10 Can a complaint be lodged with the Data Protection Authority?
In addition to the rights mentioned above, you can also lodge a complaint with the relevant supervisory authority (usually the one in your place of residence). In Italy, you should contact the Italian Data Protection Authority.
