Privacy Notice
This notice describes how personal data is processed when users visit the Rome AI Festival website at https://raif.it.com/ (the “Site”), use its features, complete forms, request information, submit films and/or purchase tickets.
1. Data controller
The data controller is:
VIA AI Group S.R.L.
Corso Vittorio Emanuele II 83, 10128 Turin (TO), Italy
VAT / Tax Code: 13483300011
Email: info@romeaifestival.org
2. Personal data processed
Depending on the services used, the following data may be processed:
- Film-submission data: first and last name, email address, telephone number where supplied, country of residence, professional role, company or studio name where supplied, and billing data where applicable;
- Ticket-purchase data: first and last name, email address and optional telephone number;
- Film data: title, movie file and/or viewing link, category, synopsis, technical information including duration, AI tools and production year, poster and images, performers, credits and any other material uploaded with the submission;
- Submission-tracker security data: short-lived verification-code records, session identifiers, request timestamps and pseudonymised request identifiers used to authenticate submitters and prevent abuse;
- Payment data: where an entry or event fee applies, payment is handled independently by third-party providers, which give VIA confirmation and a transaction reference without supplying full card details;
- Information included in contact-form requests or voluntarily communicated by email;
- Browsing and technical data, including IP address, device identifiers, browser, operating system, technical logs and other data required to operate the Site.
The Site may link to third-party pages or services such as LinkedIn, Facebook, Instagram, X and YouTube. Following those links may result in processing by the respective operators under their own privacy notices.
Ticket purchases and film submissions may also take place through third-party platforms such as Eventbrite and FilmFreeway, which normally act as independent data controllers within their own platforms as described in their policies.
3. Purposes and legal bases
3.1 Film submissions and ticket purchases
Data is processed to manage event participation and film applications. Legal basis: steps taken at the data subject's request before entering into a contract and management of the Festival selection procedure (Article 6(1)(b) GDPR). External platforms used by the user may transfer data to VIA only as necessary for participation. The submission process includes evaluation and judging, status communications, screening selected films, and publishing selected titles, credits and images in Festival programmes and communications.
3.2 Operating and securing the Site
Data is processed to operate the Site, authenticate submitters who request access to their submission history, maintain security, prevent unlawful use and ensure continuity. Legal basis: performance of the submission service (Article 6(1)(b) GDPR) and VIA's legitimate interests (Article 6(1)(f) GDPR).
3.3 Information, support and commercial enquiries
Data submitted through forms or email is processed to answer requests, provide service information, arrange meetings or contact the user. Legal basis: pre-contractual measures (Article 6(1)(b) GDPR).
3.4 Newsletters and marketing
With the data subject's specific consent, first name, last name and email may be used by VIA for commercial communications, newsletters, events, promotional initiatives and service updates. Legal basis: consent (Article 6(1)(a) GDPR).
3.5 Similar-service communications
Where Article 130(4) of Italian Legislative Decree 196/2003 applies, VIA may send communications concerning services similar to those already requested, while preserving the right to object at any time. Legal basis: legitimate interests (Article 6(1)(f) GDPR).
3.6 Sharing data with Festival partners
With the data subject's specific and freely given consent, email, name, professional role, country and film title/category may be disclosed to Festival sponsors and commercial partners, such as AI-tool companies, media businesses and production companies, so they may contact the user for their own marketing and commercial purposes. Legal basis: consent (Article 6(1)(a) GDPR). An updated list of actual recipients or recipient categories for each edition is available on request from info@romeaifestival.org. Each recipient acts as an independent controller and will provide its own privacy notice at first contact. VIA does not disclose data to third parties for their own purposes without specific consent.
3.7 Legal claims
Data may be processed where necessary to establish, exercise or defend VIA's rights in or out of court. Legal basis: legitimate interests (Article 6(1)(f) GDPR).
3.8 Accounting and legal obligations
Data may be processed where necessary to comply with accounting and other legal obligations. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).
4. Collection and processing
Personal data is collected and processed in accordance with the GDPR principles of lawfulness, fairness, transparency, minimisation and integrity. VIA implements technical and organisational measures appropriate to the risk under Article 32 GDPR.
4.1 Required and optional information
Data required for browsing, ticket purchasing, event participation and film submission must be provided for those services. Information requested in contact forms is necessary for VIA to respond.
Consent to marketing and consent to partner data sharing are optional. Refusing either consent does not prevent a film submission or ticket purchase.
4.2 Sources
Personal data is collected:
- directly from the user through registration, use of services or communication with VIA;
- automatically through use of the Site, including logs, cookies and technical monitoring systems;
- from third-party platforms such as Eventbrite and FilmFreeway, which normally act as independent controllers under their own policies.
4.3 Recipients
Within the purposes described above, data may be disclosed to:
- IT, cloud, hosting and cybersecurity providers;
- communications and customer-support providers;
- payment providers;
- ticketing and submission-management platforms;
- legal, tax and professional advisers and auditors;
- public authorities where required by law.
Depending on the circumstances, these parties act as processors under Article 28 GDPR or as independent controllers. A list of processors is available from VIA on request.
4.4 Automated decision-making
The Site does not use solely automated decision-making or profiling within Article 22 GDPR, except where expressly described in the Cookie Policy.
5. International data transfers
Personal data may be transferred outside the European Economic Area. Transfers take place under Articles 44 and following of the GDPR and, where applicable, rely on one or more of the following safeguards:
- European Commission adequacy decisions;
- organisations certified under the EU-US Data Privacy Framework;
- European Commission Standard Contractual Clauses;
- a transfer impact assessment where required;
- supplementary technical, organisational and contractual measures intended to ensure protection essentially equivalent to that provided in the European Union.
A copy of the safeguards used for a transfer may be requested using the contact details in this notice.
6. Retention
Personal data is kept only for as long as necessary for the purposes for which it was collected, in accordance with the storage-limitation principle in Article 5(1)(e) GDPR. In particular:
- submission-tracker verification codes expire after 10 minutes; related security records are deleted after no more than 24 hours, while the authentication session expires after 2 hours;
- information and commercial-contact requests: up to 24 months after the request is handled;
- marketing and partner-sharing data: until consent is withdrawn and in any event no longer than 24 months;
- event registrations, submissions and Festival participation records: consistently with applicable limitation periods, and no longer than 10 years;
- data required to establish or defend a right: for the duration of the dispute and applicable limitation periods;
- officially selected films' titles, credits, images and trailers may remain in the public archive and Festival promotional materials indefinitely as part of the Festival's historical record, subject to removal requests where compatible with documentary obligations and the Festival's historical interest.
At the end of the relevant retention period, personal data is deleted, anonymised or made irreversibly non-identifiable.
Data is stored on servers in the European Economic Area, without prejudice to transfers made under applicable law and the safeguards described in Section 5.
7. Data-subject rights
Subject to the conditions and limits in Articles 15–22 GDPR, data subjects may exercise:
- the right of access to personal data and processing information;
- the right to correct inaccurate data and complete incomplete data;
- the right to erasure under Article 17 GDPR;
- the right to restrict processing under Article 18 GDPR;
- the right to data portability under Article 20 GDPR in a structured, commonly used and machine-readable format;
- the right to object under Article 21 GDPR;
- the right to withdraw consent at any time, without affecting processing lawfully carried out before withdrawal;
- the right not to be subject to a decision based solely on automated processing, including profiling, in the circumstances covered by Article 22 GDPR;
- the right to lodge a complaint with the Italian Data Protection Authority under Article 77 GDPR.
These rights may be limited where applicable law requires retention or other processing, including anti-money-laundering and other legal obligations. To exercise any right, contact info@romeaifestival.org.