Privacy policy

Dear Participant, Parent or Person Exercising Parental Responsibility,

KISMET S.r.l., acting as Data Controller, provides the following information concerning the processing of the personal data of adult participants and, in the case of participants under the age of 18, the personal data of the minor and of their parent, legal guardian or other person exercising parental responsibility, in connection with participation in the GEF 2027 World Finals – The World Festival of Creativity in Schools.

Personal data will be processed in accordance with Regulation (EU) 2016/679 (“GDPR”), Italian Legislative Decree No. 196 of 30 June 2003, as amended by Italian Legislative Decree No. 101 of 10 August 2018 (“Italian Privacy Code”), and the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

Data controller and contact details

The Data Controller is: 

KISMET S.r.l. Via Roma, 128 18038 Sanremo (IM) – Italy 

E-mail: info@gef.it 

Tel +39 0184 570300

Mrs Sonja Viveka Fager is the internal contact person appointed by KISMET S.r.l. to handle requests from data subjects concerning the processing of personal data.

Categories of personal data processed

Within the limits of what is necessary for registration, selection, organisation and participation in the GEF 2027 World Finals, KISMET S.r.l. may process:

a) identification and personal data relating to the adult or minor participant and, where applicable, their parent or legal guardian, including full name, place and date of birth, nationality and place of residence; 

b) contact details, including postal address, telephone number and e-mail address; 

c) information concerning the participant’s school, association, group or organisation; 

d) information contained in documents required to verify identity, age, parental responsibility and compliance with the participation requirements; 

e) information concerning registration, the artistic discipline, performances, selections, assessments, rankings and results; 

f) photographs, audio recordings and audiovisual footage, within the limits established by the participation conditions and the applicable release form; 

g) administrative, accounting, tax, banking and payment information; 

h) any other personal data voluntarily provided by the data subject and relevant to participation in the event. 

Data subjects are requested not to provide special categories of personal data under Article 9 GDPR, including, for example, health information, unless such information is strictly necessary to protect the participant’s health and safety or to enable appropriate organisational or assistance measures to be taken. 

Where such information is necessary, it will be processed only to the extent required and on the basis of the applicable conditions laid down in Article 9 GDPR and the relevant legislation. 

Purposes and legal bases of the processing

Personal data will be processed for the following purposes: 

1. responding to requests for information and carrying out activities preliminary to registration. The legal basis is the taking of steps at the request of the data subject prior to entering into a contract, pursuant to Article 6(1)(b) GDPR; 

2. managing registration, verifying the participation requirements, organising and enabling participation in the GEF 2027 World Finals, including operational communications, preparation of performances and programmes, selections, assessments, rankings, certificates, awards and prizes. The legal basis is the performance of a contract pursuant to Article 6(1)(b) GDPR; 

3. complying with administrative, accounting, tax and other legal obligations. The legal basis is compliance with a legal obligation to which the Data Controller is subject, pursuant to Article 6(1)(c) GDPR; 

4. organising technical, logistical, accommodation and assistance services connected with participation, where applicable. The legal basis is the performance of a contract pursuant to Article 6(1)(b) GDPR; 

5. preventing misuse, protecting the safety and security of the event, managing complaints, claims or disputes and establishing, exercising or defending the rights of the Data Controller. The legal basis is the legitimate interest of KISMET S.r.l. pursuant to Article 6(1)(f) GDPR; 

6. producing, recording, documenting and promoting the GEF 2027 World Finals through photographs, audio recordings and audiovisual footage, including television broadcasts, live or on-demand streaming, publication on websites, official social media channels, promotional materials and the Festival’s historical archives. Such processing will be carried out within the limits and under the conditions specified in the applicable release form signed by the adult participant or by the minor’s parent or legal guardian and on the legal basis applicable to each specific use, including consent under Article 6(1)(a) GDPR where required. 

Any processing for promotional or commercial purposes other than those directly connected with the GEF 2027 World Finals will be carried out only after obtaining specific consent, where required by the applicable legislation. 

Whether providing personal data is mandatory and the consequences of failure to provide it

Providing the personal data identified as mandatory is necessary to verify the participation requirements and to enable registration and participation in the GEF 2027 World Finals. 

Failure to provide the required information, or the provision of incomplete or inaccurate information, may make it impossible to complete the registration process, verify eligibility or permit participation in the event. 

Consent is not required for processing that is necessary for the performance of a contract, compliance with legal obligations or the pursuit of a legitimate interest of the Data Controller. 

Where processing is based on consent, providing consent is optional. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal. 

The consequences of withholding consent will be specifically indicated in the relevant consent request or release form. 

Processing methods and security measures

Personal data may be collected directly from the data subject or from the participant’s parent or legal guardian, school, association, group or organisation responsible for submitting the registration. 

Any person who provides KISMET S.r.l. with personal data relating to other individuals declares that they are authorised to provide such information and undertakes to inform the individuals concerned about the processing of their personal data. 

Personal data may be processed in paper, electronic and digital form and may be subject to collection, recording, organisation, storage, consultation, use, disclosure, retrieval, comparison, restriction, erasure and destruction. 

In accordance with Article 32 GDPR, KISMET S.r.l. implements technical and organisational measures appropriate to the level of risk in order to protect personal data against loss, destruction, unauthorised access or disclosure, alteration and unlawful use. 

Personal data will be processed only by persons authorised and appropriately instructed by the Data Controller or by external service providers appointed, where required, as Data Processors pursuant to Article 28 GDPR. 

Recipients and disclosure of personal data

Personal data may be disclosed, to the extent strictly necessary for the purposes described in this Privacy Notice, to: 

a) employees and collaborators authorised by KISMET S.r.l.; 

b) members of the event’s organisational, administrative, technical and artistic teams; 

c) members of selection panels and juries; 

d) providers of IT, management, hosting, storage, technical support and communication services; e) administrative, accounting, tax, insurance and legal advisers; 

f) theatres, host venues, technical suppliers and other parties involved in organising and conducting the GEF 2027 World Finals; 

g) travel agencies, accommodation providers, carriers and other providers of services connected with participation, where necessary and provided for in the participation conditions; 

h) television broadcasters, streaming platforms, photographers, video producers, press offices and media organisations, within the limits established by the participation conditions and the applicable release form; 

i) banks, payment institutions and other parties responsible for processing financial transactions; 

j) insurance companies and persons responsible for managing any claims or accidents; 

k) public authorities, inspection bodies, judicial authorities or other parties where disclosure is required by law or necessary for the establishment, exercise or defence of legal claims. 

Depending on the circumstances, external parties will process the data as independent Data Controllers or as Data Processors appointed by KISMET S.r.l. pursuant to Article 28 GDPR. 

Except for the publication or dissemination expressly covered by the participation conditions and the applicable release form in relation to photographs, audio recordings, audiovisual footage, participants’ names, performances, rankings and results, personal data will not be publicly disseminated. 

Transfers of personal data outside the european economic area

Where the use of IT providers, digital platforms, communication services, streaming services, hosting services or storage services requires personal data to be transferred outside the European Economic Area, such transfers will be carried out in accordance with Articles 44-49 GDPR. 

Transfers may be based on an adequacy decision adopted by the European Commission or on other safeguards permitted under the GDPR, including, where applicable, Standard Contractual Clauses approved by the European Commission. 

The data subject may request information about any transfers and the safeguards applied by writing to info@gef.it.

Data retention periods

Personal data will be retained only for the time necessary to fulfil the purposes for which they were collected and in accordance with the retention periods required by law. In particular: 

a) personal data relating to requests for information that do not result in registration will be retained for the time necessary to respond to the request and, as a general rule, for no longer than 12 months after the request has been concluded, unless further retention is necessary to manage a complaint or protect a legal right; 

b) personal data relating to registration and participation will be retained for the duration of the relationship and subsequently for the period necessary to complete the organisational activities and protect the rights of the Data Controller; 

c) administrative, accounting and tax documentation will be retained for ten years following the conclusion of the relationship or for any different period required by the applicable legislation; 

d) personal data required to manage complaints, claims or disputes may be retained until the expiry of the applicable limitation periods and, in the event of proceedings, until their final conclusion; 

e) photographs, audio recordings and audiovisual footage intended for the documentation, promotion and historical archives of the Festival may be retained for the period specified in the applicable release form, taking account of the artistic, cultural, informational, documentary and historical nature of the event. 

At the end of the applicable retention periods, personal data will be erased, anonymised or retained for a longer period only where required or permitted by law.

Automated decision-making

Personal data will not be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning the data subject or similarly significantly affect them. 

Artistic assessments and decisions concerning admission, rankings and the awarding of prizes will be made by the competent selection panels and juries in accordance with the Competition Rules. 

Rights of the data subject

In the circumstances and within the limits established by the applicable legislation, the data subject may exercise the rights provided for in Articles 15-22 GDPR and, in particular, may: 

a) obtain confirmation as to whether personal data concerning them are being processed and obtain access to such data; 

b) obtain the rectification of inaccurate personal data and the completion of incomplete personal data; 

c) obtain the erasure of personal data where the conditions laid down in Article 17 GDPR are met; 

d) obtain restriction of processing where the conditions laid down in Article 18 GDPR are met; 

e) receive, in the circumstances provided for in Article 20 GDPR, the personal data provided to the Data Controller in a structured, commonly used and machine-readable format and, where technically feasible, have those data transmitted directly to another controller; 

f) object, on grounds relating to their particular situation, to processing based on the legitimate interests of the Data Controller pursuant to Article 21 GDPR; 

g) object at any time to processing for direct-marketing purposes; 

h) withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before its withdrawal; 

i) lodge a complaint with the Italian Data Protection Authority – Garante per la protezione dei dati personali – through the procedures indicated at www.garanteprivacy.it, without prejudice to the right to seek a judicial remedy before the competent courts. 

Rights relating to the personal data of a minor may be exercised by the parent, legal guardian or other person exercising parental responsibility, without prejudice to the minor’s right to receive information appropriate to their age and level of understanding. 

How to exercise data protection rights

Requests concerning the exercise of data protection rights may be submitted: 

a) by e-mail to info@gef.it; 

b) by written communication addressed to KISMET S.r.l., Via Roma, 128 – 18038 Sanremo (IM), Italy. 

The Data Controller will respond without undue delay and, in any event, within one month of receiving the request. 

That period may be extended by a further two months in the circumstances provided for in Article 12 GDPR, taking account of the complexity and number of requests. The data subject will be informed of any extension within one month of receipt of the request. 

Before responding to a request, KISMET S.r.l. may request information strictly necessary to verify the identity of the applicant and, where the request concerns a minor, the applicant’s authority to exercise the rights of the minor. 

Updates to this privacy notice

This Privacy Notice may be updated if changes occur in the processing activities, the services used or the applicable legislation. The updated version will be made available through the official GEF communication channels. 

Last updated: August 2026