The Italian-language version of this Privacy Policy is available at the following link: privacy-policy-italian.
Welcome to the website www.theagency.it (“Website”) of THE AGENCY S.r.l. (“The Agency” or the “Company”).
Through this Privacy Policy, The Agency provides users with information concerning the processing of personal data collected automatically or voluntarily provided when accessing and browsing the Website, as well as when using the functionalities made available therein.
Browsing the Website is free and does not require any registration. However, the Website may include interactive functionalities allowing users to select one or more models or talents of interest, add them to their favourites and submit a request to The Agency through the “Send Message and Request Models” function, by filling in the relevant fields.
The Website may contain hyperlinks to third-party websites, pages, platforms or online services. By clicking on such links, users may access content which is exclusively controlled by such third parties, falls outside the control of The Agency and is not subject to the provisions of this Privacy Policy. The Agency therefore invites users to pay attention and carefully read the privacy notices provided by such third parties, over which The Agency has no control and for which The Agency may not be held liable.
The Data Controller is THE AGENCY S.r.l., VAT no. 12684540961, with registered office at Via Tortona no. 21, 20144 Milan (MI), Italy, certified e-mail address edgesrl@futurapec.it.
The Data Protection Officer appointed by The Agency may be contacted at the following e-mail address: privacy@lanzolegal.it (“DPO”).
Personal data means any information relating to the user and attributable to them.
Specifically, the processing may concern the following categories of personal data.
Browsing data
The IT systems and software procedures used to operate the Website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.
This category of data includes, by way of example, IP addresses, domain names of the devices used by users, URI/URL addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server response, as well as other parameters relating to the user’s operating system and IT environment.
Such data, which are necessary for the use of web services, are also processed in order to obtain statistical information on the use of the Website, check its proper functioning and ascertain any liability in the event of alleged cybercrimes against the Website or third parties.
Data voluntarily provided by the user
The Agency also processes personal data voluntarily provided by users through the functionalities available on the Website or by sending communications to the contact addresses published on the Website.
With reference to the main sections and functionalities of the Website, the data processed may include:
- •Requests submitted through the “Send Message and Request Models” function: company name, name and surname of the contact person, where provided, e-mail address, telephone number, where provided, content of the message, model(s) or talent(s) selected or requested by the user, as well as any further personal data included in the message or in the available fields;
- •Requests sent to the contact addresses published on the Website: name, surname, e-mail address, company, where applicable, role, content of the communication and any further personal data voluntarily transmitted by the user;
- •“Your Favourites” functionality or similar model/talent selection functionalities: information relating to the models or talents selected, saved or requested by the user through the Website, where technically associated with the request sent to The Agency.
If the user includes personal data relating to third parties in the message, the user represents that they are entitled to communicate such data to The Agency.
The data indicated above are hereinafter collectively referred to as “Personal Data”.
Personal Data are processed for the following purposes.
a) Browsing the Website
Personal Data are processed to enable browsing of the Website, ensure the use of online services, obtain statistical information on the use of the Website, check its proper functioning and ascertain any liability in the event of alleged cybercrimes.
The legal basis for the processing is The Agency’s legitimate interest pursuant to Article 6(1)(f) GDPR.
The provision of browsing data is necessary to enable browsing of the Website.
b) Management of requests submitted through the “Send Message and Request Models” function
Personal Data are processed to receive, review, manage and reply to requests submitted by users through the “Send Message and Request Models” function, including requests for information, availability, booking, casting, collaboration, quotation, commercial contact or other requests relating to one or more models or talents represented, managed or promoted by The Agency.
The legal basis for the processing is the performance of pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR.
The provision of data marked as necessary is required in order to enable The Agency to receive and manage the request. Failure to provide such data will make it impossible to proceed with the request.
c) Management of communications sent to the contact addresses published on the Website
Personal Data are processed to receive, manage and reply to requests voluntarily sent by users to the e-mail addresses or other contact details published on the Website.
The legal basis for the processing is the performance of pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR, where the communication concerns a pre-contractual or contractual request.
Where the communication does not fall within a strictly pre-contractual or contractual context, the legal basis for the processing is The Agency’s legitimate interest in receiving, managing and replying to communications and requests sent by users, pursuant to Article 6(1)(f) GDPR.
The provision of data is necessary to enable The Agency to manage the communication and provide a reply.
d) Management of commercial, booking, casting and collaboration requests
Personal Data may be processed to assess and manage commercial, booking, casting, collaboration, production, shooting, fashion show, advertising campaign, event, editorial project or other requests connected with The Agency’s business activity.
The legal basis for the processing is the performance of pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR, or, where the request is submitted by parties other than the data subject or in the context of B2B relationships, The Agency’s legitimate interest in managing its commercial relationships, pursuant to Article 6(1)(f) GDPR.
The provision of data is necessary to assess and manage the request.
e) Defence of rights
Personal Data may be processed to establish, exercise or defend The Agency’s rights in any venue, including judicial, administrative, arbitration and/or mediation and conciliation proceedings.
The legal basis for the processing is The Agency’s legitimate interest in protecting its rights, pursuant to Article 6(1)(f) GDPR.
The Website may use cookies and other tracking tools, including third-party tools, as described in the relevant Cookie Policy.
For further information on the characteristics of cookies and other tracking tools that may be used on the Website, users are invited to consult the Cookie Policy available on the Website.
Personal Data will be processed by electronic, telematic and, where necessary, manual means, in compliance with the applicable laws and regulations on personal data protection.
The Agency adopts appropriate technical and organisational measures to ensure the security, integrity and confidentiality of Personal Data, as well as to prevent risks of loss, destruction, unauthorised access, disclosure, alteration or unlawful processing.
Personal Data will be processed by persons authorised by The Agency and duly instructed in relation to the purposes and methods of processing.
Personal Data will not be disseminated.
Within the limits strictly relevant to the purposes set out in this Privacy Policy, Personal Data may be communicated to:
- •persons authorised to process Personal Data by The Agency, such as employees, collaborators, consultants and members of the booking, talent management, art department, financial, administrative, technical or commercial teams;
- •persons acting as data processors pursuant to Article 28 GDPR, such as providers of hosting services, Website management and maintenance services, cloud services, IT services, CRM systems, management software, technical platforms, communication services and other technical suppliers;
- •models, talents, their representatives, agents, managers or other persons involved in managing the request, where necessary to follow up on the user’s request;
- •clients, brands, production companies, photographers, stylists, casting directors, agencies, commercial partners or other persons involved in booking, casting, collaboration, production or commercial initiatives, where necessary to manage the request;
- •persons authorised by law, such as public authorities, judicial authorities, supervisory bodies or other public entities, in the cases provided for by applicable law;
- •legal, tax, administrative or other professional advisers, where necessary for organisational, administrative, accounting or tax purposes, or for the protection of The Agency’s rights.
The third parties to whom Personal Data are communicated may act, depending on the circumstances, as data processors, independent data controllers or persons authorised to process Personal Data.
The updated list of data processors may be requested from The Agency by sending a communication to the addresses indicated in Section 1.
The Agency retains Personal Data for the period strictly necessary to achieve the purposes for which they were collected.
In particular:
- •Browsing data: for the time strictly necessary to ensure browsing, functioning and security of the Website, without prejudice to any further retention periods necessary to ascertain liability in the event of alleged cybercrimes;
- •Requests submitted through the “Send Message and Request Models” function: for the time necessary to reply to and manage the request and, in any event, for a maximum period of 12 months from the last communication;
- •Requests sent to the contact addresses published on the Website: for the time necessary to reply to and manage the request and, in any event, for a maximum period of 12 months from the last communication;
- •Data relating to commercial requests, booking, casting, collaborations or negotiations: for the time necessary to manage the request and any related negotiations and, where the relationship is formalised, for the retention periods applicable to contractual, administrative, accounting, tax or legal documentation.
Longer retention periods may apply where necessary to comply with legal obligations or to establish, exercise or defend The Agency’s rights.
Users may exercise, in the cases provided for by the GDPR, the following rights:
- •right of access to their Personal Data, pursuant to Article 15 GDPR;
- •right to rectification of inaccurate Personal Data and completion of incomplete Personal Data, pursuant to Article 16 GDPR;
- •right to erasure of Personal Data, pursuant to Article 17 GDPR;
- •right to restriction of processing, pursuant to Article 18 GDPR;
- •right to data portability, where applicable, pursuant to Article 20 GDPR;
- •right to object to the processing, pursuant to Article 21 GDPR.
Users also have the right to withdraw any consent given at any time, without prejudice to the lawfulness of processing based on consent before its withdrawal, where the processing is based on consent.
All the above rights may be exercised by sending a communication to The Agency at the addresses indicated in Section 1.
If users believe that the processing of their Personal Data infringes the provisions of the GDPR, they have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, as provided for by Article 77 GDPR, without prejudice to any other administrative or judicial remedy.
Personal Data are processed mainly within the European Economic Area.
Any transfers of Personal Data to third countries or international organisations will take place in compliance with the GDPR and, in particular, Articles 44 et seq. GDPR, ensuring the adoption of appropriate safeguards such as, where applicable, adequacy decisions of the European Commission, standard contractual clauses approved by the European Commission or other transfer mechanisms provided for by applicable law.
Personal Data will not be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning the user or similarly significantly affect them.
The Agency reserves the right to amend or update this Privacy Policy. Any changes will be published on the Website.