Information pursuant to art. 13 of the Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)


Information pursuant to art. 13 of the Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)


The following information is provided by the Data Controller (as defined hereinafter) pursuant to and for the purposes of Regulation (EU) 2016/679 (also "GDPR"), with reference to the personal data of the users (hereinafter also only "data subject") processed on the Made S.c. a r.l. website (reachable at the following internet address, hereinafter, for the sake of brevity, also referred to only as "MADE").


The terms and definitions referred to in this information, such as, by way of example but not limited to: "Data Subject", "Data Controller", "Data Processor", "Processing", "Personal Data", etc. are referring to the definitions included in art. 4 of the GDPR.


The data and information contained in this information refer exclusively to MADE and do not concern other third parties websites and / or web pages, online services, and / or third-party banners that could be reached via hypertext links that may be present on the MADE’s website.



Provided that the consultation of the MADE’s website involves the processing of personal data of web users, and therefore data relating to Data Subjects, the Data Controller is MADE S.c. a r.l., with registered office in Piazza L. da Vinci n.32, 20133 Milan, VAT number 10643980963, PEC (certified electronic e-mail):



Pursuant to and for the purposes of Articles 24 and 37 of the GDPR, MADE has appointed its Data Protection Officer (hereinafter also referred to as the "DPO") that the Data Subjects can contact, at any time, for questions relating to the processing of their Personal Data and the exercise of their rights at the following e-mail:; or by using a certified electronic e-mail at the following address:



The Personal Data processed by MADE’s website belong to the following types: IP address, personal data such as name and surname, e-mail address, data of the browsing session, (company affiliation of the Data Subject and role held therein if you compile the form in the MADE’s website). These Data are processed by MADE, in its capacity as Data Controller, pursuant to art. 6 of the GDPR, for the following purposes:

3.1 to allow the navigation, consultation and usability of the MADE’s website;

3.2 to manage the registrations of the interested parties made through the forms available on the MADE’s website in order to participate at the events, conferences, congresses, forums, workshops, webinars, etc. organized by MADE;

3.3 to manage the data collected through the form in order to inform the Data Subjects about MADE’s communications, events, projects and newsletters.


The legal basis underlying the purpose referred to in point 3.1 is that referred to in art. 6, paragraph 1, letter f) of the GDPR, i.e. the legitimate interest of the Data Controller.

The legal basis underlying the purpose referred to in point 3.2 is that referred to in art. 6, paragraph 1, letter b), i.e. the execution of a contract of which the Data Subject is a party or the execution of pre-contractual measures adopted at the request of the latter.

The legal basis underlying the purpose referred to in point 3.3 is that referred to in art. 6, paragraph 1, letter a), i.e. the consent of the Data Subject.



4.1 Browsing session data: they are necessarily processed by MADE's IT systems solely in order to allow navigation of MADE’s website itself, the Data Subject is free to provide or not personal data, but failure to provide such data could result in the incorrect display and / or use of the MADE’s website, which cannot in any way be held responsible for any such malfunctions.

4.2 Personal data, e-mail address, company affiliation and role covered therein: the provision of these Personal Data by the Data Subjects is optional or necessary depending on the specific purpose for which the Personal Data is processed. Failure to provide personal data, as requested in the forms made available to MADE will make it impossible to participate in events, conferences, initiatives, workshops, webinars, etc. organized by MADE.


The consent to the processing of Personal Data for the purposes referred to in point 3.3 above is optional, and therefore not mandatory.

However, we inform you that in the absence of your express, free and informed consent, your Personal Data will not be processed for the pursuit of this purpose, and, therefore, to inform the Data Subjects about further communications, events, projects or newsletters by MADE. Your refusal to consent does not affect the usability of the services provided by MADE for the purposes referred to in section 3.2 above.



In accordance with the provisions of art. 5, paragraph 1, let. e) of the GDPR, MADE will process Personal Data for a period of time not exceeding the achievement of the purposes referred to in section 3 above.

Data retention period, which depends on the purposes of the processing described above, will not last beyond 10 years unless otherwise authorized by the applicable law.



The processing of Personal Data carried out by MADE may take place both in an analogic and/or in an electronic form, by using MADE’s IT system; in any case, the processing of Personal Data shall take place in full compliance with the principles set out in art. 5 of the GDPR, with methods aimed at guaranteeing the maximum security and confidentiality of personal data as provided by art. 32 of the GDPR.

Such Personal Data will be processed by subjects who will act as Data Processors pursuant to art. 28 of the GDPR, and/or by natural persons as authorized/appointed, who shall act under the direct authority of the Data Controller and/or respectively the Data Processor, as required by art. 29 of the GDPR.

By way of example -but not limited to-, we indicate below the categories of Data Processors to whom the Personal Data may be disclosed to:

6.1 companies, entities and natural persons who provide services for the management and maintenance of MADE’s IT system, telecommunications networks and software applications used by MADE;

6.2 companies, organizations and natural persons who provide IT services to MADE such as management of newsletter services, management and maintenance of MADE’s website;

6.3 freelancers, professional firms or consultants in the context of the provision of consultancy services;

6.4 competent authorities for the fulfilment of legal obligations and/or provisions of public entities, upon their request.

The list of the Data Processors is available at the registered office of MADE or may be requested by writing an e-mail to:



MADE within the scope identified in section 3 above may transfer the Personal Data of the Data Subjects to an International Organization or to countries belonging to the European Union and/or to third countries outside the EU in order to comply with the processing purposes indicated above. The aforementioned transfer will take place exclusively on the basis and in compliance with the provisions of Chapter V, Articles 44 and following of the GDPR.

For the processing of Personal Data outside the EU, MADE will authorize such processing only when the transfer of the Personal Data takes place on the basis of an adequacy decision of the Commission (Article 45 of the GDPR). In the case of absence of a precise decision of adequacy, the transfer of Personal Data shall only take place if there are adequate guarantees, as required by Article 46 of the GDPR.



MADE does not adopt automated decision-making processes, nor does it use profiling techniques, meaning any form of automated processing of Personal Data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular, to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.



The Data Subject has the right to obtain from MADE, the access to the Personal Data and the right of rectification or cancellation of the latter, or, if the case, the restriction of the processing or the portability of the Personal Data concerning them or to oppose to the processing, as set forth in the GDPR.

Furthermore, where the processing of Personal Data is based on the consent of the Data Subject, the latter has the right to revoke said consent at any time, without prejudice to the processing of Personal Data carried out by MADE up to the time of revocation.

The rights of the Data Subjects are fully regulated by art. 15 and following of the GDPR. 

Any instances of the Data Subjects to exercise those rights can be directed to the MADE’s Data Protection Officer as identified above.



Data Subjects who believe that the processing of their Personal Data carried out through MADE’s website is in violation of the provisions of the GDPR have the right to lodge a complaint with the Supervisory Authority, as specified by art. 77 of the GDPR, or to take the appropriate judicial actions pursuant to art. 79 of the GDPR.

Version 1.0, June 12th, 2020