Notice regarding the Processing of Personal Data on Techstars Core
Introduction
Techstar S.r.l. (hereinafter the “Data Controller”) recognises the importance of protecting personal data. To this end, it wishes to inform you about how we collect, process, and store your data in connection with your use of the Techstar Core platform and its services. Our aim is to ensure you are aware of your rights and how to easily exercise them, in line with the principles of lawfulness, fairness, and transparency in data processing.
This information is provided pursuant to Article 13 of European Regulation No. 2016/679 concerning the protection of individuals with regard to the processing of personal data and the free movement of such data (the “Regulation”), as well as in accordance with Italian Legislative Decree No. 196/03 and subsequent amendments (the “Personal Data Protection Code”), the provisions of the Italian Data Protection Authority, and the Guidelines of the European Committee of Data Protection Authorities (hereinafter collectively referred to as the “Applicable Regulations”).
This Policy is provided solely for the use of the Techstar Core platform and does not apply to any other websites or platforms that may be accessed or viewed via external links.
Involved Parties
- Data subject: you, as a natural person, who provide us with the personal data that is processed.
- Data controller: Techstar S.r.l., with its registered office at Via Cotonificio 84, 33037 Pasian di Prato (UD), Italy, tax code and VAT number IT03035830300, email: contact@techstar.it, represented by its legal representative pro tempore.
The Data Controller has appointed a Data Protection Officer (DPO), who can be contacted to request explanations regarding this Policy or to exercise the rights provided for by data protection legislation, as described below. To contact the DPO, please use the email address dpo@techstar.it or send a letter by post to DPO c/o Techstar S.r.l. – via Cotonificio, 84 – 33037 Pasian di Prato (UD).
For any information regarding this Policy, please write to the following email address: privacy@techstar.it.
1) Who is this privacy notice for?
This Policy applies to any individual who provides their personal data to access and use one or more services on the Techstar Core platform, hereinafter generally referred to as the “Data Subject”.
2) What personal data are processed?
a) Definition of personal data
“Personal Data” means any information relating to an identified or identifiable natural person, such as their name, telephone number, email address, location data, an online identifier (e.g., IP address), or any characteristic features of their physical, physiological, mental, economic, cultural, or social identity.
b) Data processed by Techstar Core
- Data provided by the Data Subject (data relating to the account profile): This refers to the identifying and contact details (such as username, first name, surname, and email address) that the Data Subject provides in order to access Techstar Core. The Data Controller will process the data in accordance with the Applicable Legislation, assuming that they relate to the user in question.
- Data relating to the data subject’s use of the Techstar Core platform (user-generated content/information about the devices used) may include: the date and time of logging in to and out of Techstar Core; the avatar’s position within Techstar Core; the type of hardware and software used (PC, tablet, mobile phone, immersive headset, browser, operating system); the user’s preferences and settings; and data collected from the user’s interactions within Techstar Core (movements, interactions with objects, subjects, documents, and images/videos/audio). As described above, without the provision of specific consent, this data will be used solely in an anonymous and aggregated form, for statistical analysis.
- Other Data collected while using the Techstar Core platform (user-generated content): such as information relating to interactions with objects, subjects, documents, and images/videos/audio; the avatar’s “reactions” (features available in the menu for indicating reactions); and all information relating to the user’s level of attention and “sentiment”, which the platform can derive independently; comments, suggestions, and requests gathered through interactions via all available contact systems (email exchanges, chats, chatbots, etc.); images and video streams of connected users (including when their own camera is activated); and shapes and images used to customise their avatar.
The Techstar Core platform offers various features, some of which process Personal Data, while others do not. On the Techstars Core platform, profiling will only be possible if specific consent is given.
In general, except for features where Personal Data is entered (such as an email address), data will always be processed in an anonymous and aggregated form for statistical analysis. This includes, for example, obtaining quantitative data on the number of visits, time spent on the platform, and the duration and extent of interaction with individual objects, topics, etc. For features where specific consent for profiling is required, the Data Subject will always have the right to decide whether to provide and/or withdraw consent to the processing of their Personal Data for that purpose.
To provide greater clarity, it should be noted that Techstar Core encompasses three types of users (here also referred to as Data Subjects), who can be broadly categorised as follows: “visitor”, “invitee”, and “registered user”. When a “visitor” user accesses Techstar Core (similar to someone accessing or visiting any website), no Personal Data will be recorded or processed; only anonymous and aggregated data will be collected. Even for an “invited” user (for example, someone invited via a link to a meeting on a video conferencing platform), no Personal Data will be recorded or processed other than the email address to which the access link is sent, unless the Data Subject has consented to profiling. For a “registered” user (for example, someone who logs in with credentials to a specific section of management software on a company cloud), the data processed will be the identifying details needed for access (such as username and email address). If consent is given, profiling will also take place.
The Data Controller will process the data in accordance with the Regulations, assuming it relates to the Data Subject or to third parties who have expressly authorised its provision on an appropriate legal basis.
3) How is the data collected?
The Data Controller collects personal data about the Data Subject when they provide it to access the Techstar Core platform. The Data Subject may also provide personal data simply by interacting with individuals and/or objects while using Techstar Core.
4) What are the purposes, legal bases, and whether the processing is mandatory or optional?
a) Purpose
The Data Subject’s Personal Data will be processed for the following purposes:
- To perform a contract to which the Data Subject is a party, including pre-contractual measures and preliminary activities aimed at enabling the user to gain such access (such as, for example, the possibility – also through the Data Controller – of contacting the user to arrange a direct demonstration to show the Data Subject how Techstar Core works); to respond to queries or complaints from the Data Subject; to provide assistance; to communicate with the Data Subject; etc.
- For statistical analysis of aggregated and anonymous data, meaning there is no way to identify the user.
- Where it is necessary to establish, exercise, or defend a right in court, or whenever courts are performing their judicial functions.
- For user profiling, provided that the relevant consent is given.
- For communication to third-party entities or companies so that they can carry out activities to promote and sell similar products and services, or for statistical surveys and market research, provided that the relevant consent has been given.
b) Legal bases
The legal basis for processing Personal Data for the purposes set out in point 1) is the contract entered into with the Data Subject, including the pre-contractual phase and direct contact to respond of this paragraphto their requests and/or to provide the agreed services. The purpose referred to in point 2) of this paragraph does not involve the processing of Personal Data, while the purpose referred to in point 3) is based on the Data Controller’s legitimate interest in legal protection. The legal basis for processing Personal Data for the purposes outlined in points 4) and 5) of this paragraph is consent.
Please note that, for services and products similar to those in which you have expressed interest, commercial communications may be sent based on legitimate interest, to the extent permitted by law.
c) Mandatory and optional provision of data
Providing Personal Data for the purposes outlined in point 1) of this paragraph is necessary to fulfil the Data Subject’s request to access Techstar Core and use its services, as well as to handle any further requests related to those services. Therefore, failing to provide such Data could make it impossible to respond to the Data Subject’s request, to fulfil and implement the requested services, or to meet the contractual obligations undertaken. As a result, the Data Subject would not be able to access Techstar Core and/or properly use its services.
5) How is the data processed? Is there any transfer outside the EU?
a) Methods
Data is primarily processed electronically and online using tools designed to ensure its security, availability, integrity, and confidentiality. Data is processed using cloud systems with servers located within the European Union.
b) Transfers to third countries
The data subject’s personal data will not be transferred to countries outside the European Economic Area (EEA), to countries that have not been deemed “adequate” according to the criteria of the competent authorities, or without the appropriate safeguards established by the Regulation (for example, the Standard Contractual Clauses, or clauses that do not guarantee adequate levels of security in data processing).
6) Who are the recipients of the processed data?
a) In general
The personal data of users who request information material (answers to questions, quotes, etc.) is used solely to provide the requested service or provision. It is only disclosed to third parties when necessary to fulfil requests, when disclosure is required by law, or in the event of legal proceedings.
b) Categories of recipients of personal data
The Data Controller will only disclose users’ personal data to the extent permitted by law and in accordance with the provisions set out below.
Without prejudice to disclosures required by law, the following may become aware of the Data Subject’s Personal Data:
- Employees and collaborators of the Data Controller, acting as authorised data processors and instructed to do so by the Data Controller.
- Suppliers of the Data Controller who provide specific technical, IT, and organisational services related to the use or promotion of services that support the Data Controller’s business activities.
These parties will act, as appropriate, as authorised by the Data Controller (such as employees and collaborators), as data processors on behalf of the Data Controller (or other service providers), or as independent data controllers.
Furthermore, the data may be disclosed to police forces or judicial authorities, in accordance with the law and upon their formal request, or where there are reasonable grounds to believe that disclosure of such data is reasonably necessary to:
- Investigare, prevenire o assumere iniziative relative a sospette attività illecite o assistere le autorità statali di controllo e di vigilanza.
- Defend against any claims or accusations from third parties, or protect the security of the platform and the company.
- To exercise or protect the rights, property, or safety of the Data Controller, its affiliates, its customers, its employees, or any other party.
If consent is given, the data may be disclosed to third-party entities or companies for the purpose of promoting and selling similar products and services, or for statistical surveys and market research.
7) How long does the data processing last?
Unless there are Italian or EU legal obligations that mandate specific retention periods, user data will be kept only for as long as necessary to fulfil the purposes for which it was collected.
In any case, all data will be deleted within 30 days of the termination of the contractual relationship between the Data Controller and the company, organisation, or other entity to which the data subject belongs and which uses the Techstar Core platform.
Throughout the contractual relationship, any data subject may still request the erasure of their data, as described on the following page.
8) How can you control the processing of your personal data?
a) Your rights and how to exercise them
The Regulation grants the Data Subject various rights, detailed below, to control their personal data and how it is processed by the Data Controller. If you wish to exercise your rights, simply send a request to the following email address: privacy@Techstar.it.
b) Can you request access to your personal data?
If you wish to access your personal data, you may request a copy of the data in the format provided on the platform, along with information regarding its processing. The right of access may be restricted in cases where this is permitted by law or applicable regulations.
c) Can you request that your personal data be corrected?
If you believe your personal data is inaccurate or incomplete, you may request that it be amended or supplemented accordingly. In some cases, supporting documentation may be required.
d) You can request the deletion of your personal data
If you wish, you may request the deletion of your personal data, within the limits of the law and where it is no longer necessary to retain it for the purposes for which it was collected and processed.
e) Can you object to the processing of your personal data based on legitimate interests?
If you do not consent to the processing of your personal data based on legitimate interests, you can object at any time for reasons related to your particular situation, specifying the processing activity you are referring to and the reasons for your objection. Personal data will no longer be processed unless there are legitimate grounds for doing so, or the processing is necessary for the establishment, exercise, or defence of legal claims.
f) Can you object to the processing of your personal data for profiling purposes?
You have the right to object at any time to the processing of your personal data for profiling purposes.
g) Can you restrict the processing of your personal data?
Under certain conditions, you have the right to restrict the processing of your data if it is not relevant to the continuation of the contractual relationship or required by law.
h) Do you have rights against an automated decision?
Generally speaking, you have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or significantly affects you. However, an automated decision may be made if it’s necessary to sign or perform a contract, if it’s permitted by Italian or European Union law, or if consent has been given. In any event, you have the opportunity to challenge the decision, express your views, and request the intervention of someone who can review the decision.
i) Can you request the portability of some of your personal data?
Where technically feasible, you may request a copy of the personal data you have provided in a structured, commonly used, and machine-readable format. Where technically feasible, you may request that this copy be sent to specified third-party data controllers.
j) Can a complaint be lodged with the Italian Data Protection Authority?
In addition to the rights mentioned above, you can lodge a complaint with the competent supervisory authority (which is usually that of your place of residence); in Italy, you should contact the Italian Data Protection Authority.
