Privacy notice

Notice under Articles 13 and 14 of EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003. Last updated: 24 October 2026. If this translation differs from the Italian version, the Italian version prevails.

• Controller
• Data and purposes
• Do you have to provide data?
• Recipients
• Transfers
• Retention
• Security
• Your rights
• Cookies

1. Who the data controller is

The controller is the Associazione Ricreativa Culturale OverMind, which runs the Overmind Expo project.

• Registered office: Strada San Fermo 45, 46040 Piubega (MN), Italy
• Operating office: Viale Ettore Andreis 89/B, 25015 Desenzano del Garda (BS), Italy
• Tax code 90028770205 · VAT IT02755210206
• Email: info@overmindexpo.it · Certified email (PEC): overmind@pec.it · Phone: +39 392 182 5498

We have not appointed a Data Protection Officer (DPO), as our activity does not require one. For any privacy question write to info@overmindexpo.it.

2. What data we process, why and on what legal basis

a) Quote requests. Name, company, role, sector, email, phone, the services you choose, the fair or event and what you write in the description. We use them to prepare the quote, reply and follow up on that request. Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).

b) Client area. If you become a client we give you a username and password. In the area we process login data, project data, the messages and requests you send and the files you upload, to perform the contract (Art. 6(1)(b)). We keep invoices and accounting records to comply with the law (Art. 6(1)(c)).

c) Crew sign-up and Crew area. If you sign up as a professional we process what you enter in the form: name, email, phone, city, date of birth, professional profiles, languages, experience, past events, equipment, work areas, availability, VAT number if any, links, showreel, references, CV, headshot and full-length photo. After sign-up we also process the jobs offered and accepted, hours logged, fees and job documents. We use them to assess the collaboration, offer you jobs and manage them (Art. 6(1)(b)), and keep fees and tax documents to comply with the law (Art. 6(1)(c)).

d) Crew photos shown to clients. We show the photos you upload to clients to present your profile only if you allow it with the dedicated, optional checkbox. Legal basis: consent (Art. 6(1)(a)). You can withdraw it at any time by writing to us; withdrawal does not affect prior use.

e) App and notifications. If you install the app and turn on notifications, your browser gives us a technical delivery address, which we store with your profile. Notifications go through your browser's push service (Google, Apple or Mozilla) with no content: the app downloads the text from our server. Legal basis: your request and the performance of our relationship (Art. 6(1)(b)). You can turn them off at any time in your phone or browser settings.

f) Email, phone and WhatsApp. If you write or call us, we process your contact details and the message to reply (Art. 6(1)(b), or our legitimate interest in replying, Art. 6(1)(f)). WhatsApp buttons and map links open external services only when you tap them.

g) Video calls. For work meetings we may use Jitsi Meet or Google Meet. The link opens outside the website and the chosen service's privacy notice applies.

h) Security and technical data. Like any website, the server logs IP address, date, time and pages requested. To stop abuse we briefly keep the IP address of repeated failed logins, and an encrypted fingerprint (hash), which does not reveal the plain address, of the IP of anyone sending forms or asking for a password reset. For the private areas we keep an access log (date and time, account type, username, outcome and a shortened IP address without its last part), used to spot unauthorised access. Legal basis: legitimate interest in protecting the website and users' data (Art. 6(1)(f)).

We do not use your data for advertising, we do not sell it, and we make no decisions based solely on automated processing, including profiling (Art. 22 GDPR).

3. Do you have to give us your data?

No, but fields marked as required are needed to reply, prepare a quote or assess a Crew sign-up: without them we cannot do so. Optional fields, including photo consent, can be left blank with no consequences.

The website is aimed at companies and professionals. We do not knowingly collect data from children under 14.

4. Who we share data with

Data is processed by authorised and trained Overmind Expo staff. It may also be received by:

• Providers working on our behalf, appointed as processors (Art. 28 GDPR): Aruba S.p.A. (Italy), which hosts the website, email and the private areas' data, and Google (Gmail and Google Drive), which receives quote requests and, when the Drive connection is active, stores files uploaded in the private areas.
• Crew professionals assigned to a job: they receive only the client data needed to do it, such as the contact person's name, place and times.
• Clients a Crew professional works for: they receive only the data needed for the job (name, role and, if allowed, profile photos).
• Advisers such as our accountant, for tax and accounting obligations, and authorities where the law requires it.

5. Transfers outside the European Union

Google, Meta (WhatsApp), 8x8 (Jitsi Meet) and the push services of Google, Apple and Mozilla may process data in the United States. Such transfers rely on the safeguards provided by the GDPR: the European Commission's adequacy decision on the EU-US Data Privacy Framework for certified companies, and standard contractual clauses (Art. 46 GDPR). You can ask for a copy of the safeguards at info@overmindexpo.it.

6. How long we keep data

• Quote requests that do not lead to a contract: up to 24 months, then deleted.
• Client data: for the duration of the relationship. Contracts, invoices and accounting records: 10 years, as required by Italian law (Art. 2220 Civil Code).
• Crew data: as long as you stay signed up. If you ask to be removed we delete it, except fees and tax documents, kept for 10 years.
• Notification delivery addresses: until you turn notifications off or close your profile.
• Security data: the IP of failed logins until the next successful login; the encrypted fingerprint for password resets for one hour, and the one for forms together with the request it belongs to. The private areas' access log keeps the latest 5,000 events; older ones are deleted automatically. Server logs are kept for the period set by the hosting provider.

7. How we protect data

The website uses encrypted connections only (HTTPS). Passwords are stored in an encrypted, unreadable form (bcrypt), the data store cannot be reached from the web, repeated failed logins are blocked and every action in the private areas is protected by a session code. Fonts and videos are hosted on our own server, so opening the website does not disclose your IP address to third-party services.

8. Your rights

At any time you can ask us to:

• confirm whether we process your data and give you a copy (Art. 15);
• correct or complete it (Art. 16);
• delete it (Art. 17), except data we are legally required to keep;
• restrict its use (Art. 18);
• receive it in a machine-readable format to take it elsewhere (Art. 20);
• object to processing based on our legitimate interest (Art. 21);
• withdraw any consent you gave, without affecting prior processing (Art. 7).

Write to info@overmindexpo.it or to overmind@pec.it. We reply within one month. If you believe your data is not handled properly you can lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or your local supervisory authority, or go to court.

9. Cookies

We only use technical cookies, which do not require consent. The full list is in the cookie policy.

10. Changes

If we change how we process data we update this page and the date at the top. If the changes are significant and we have your contact details, we will let you know.

← Back to the website · Versione italiana