Privacy Notice on the Processing of Photographs and Video Recordings


pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”), Articles 10 of the Italian Civil Code and Articles 96 and 97 of Italian Law no. 633 of 22 April 1941

 


1. Data Controllers
DUCATI MOTOR HOLDING S.p.a. and DIAMANT S.r.l. are Joint Data Controllers, by virtue of the arrangement entered into pursuant to Article 26 of Regulation (EU) 2016/679. The information provided in this notice and any consents given by the user when providing their data apply to both Data Controllers. Each Data Controller has appointed a Data Protection Officer (DPO).
DUCATI MOTOR HOLDING S.p.a.
Via Cavalieri Ducati 3 – 40132 Bologna
The Data Controller and the DPO can be contacted at privacy@ducati.com.


DIAMANT SRL
Viale del Lavoro 8 – 37060 Zona Industriale Bonferraro (VR)

Per informazioni.
The Data Controller can be contacted through the Privacy Service at privacy@diamantdmt.com.
The DPO can be contacted at dpo@diamantdmt.com


2. Categories of personal data processed

  • photographs and audio-visual recordings depicting the data subject individually or as part of a group, taken during the Test Bike event (including any footage captured using drones or on-board cameras);
  • identification and contact details (first name, surname, date and place of birth, address, e-mail address, telephone number);
  • any voice data contained in the audiovisual recordings.

 

The processing of the special categories of personal data referred to in Article 9 GDPR is neither required nor envisaged. Where information falling within these categories may be inferred indirectly from the images (for example, visible indications of a physical condition), such processing will be purely incidental and the images will not be used in any way to obtain such information.

 

3. Purpose, legal basis and nature of the provision of personal data

 

Purposes of the processing Legal basis  Provision of data
a) Taking, publishing and disseminating photographs and audiovisual recordings made during the Test Bike event for the purposes of providing information about, documenting and promoting the activities of the Data Controller (print media, websites, social media pages and profiles, promotional materials and catalogues). Compliance with legal obligations and the accountability principle pursuant to Article 6(1)(c) and Article 5(2) GDPR. Required. Without these data, consent cannot be validly obtained and managed.
b) Collecting and managing the identification and contact details (first name, surname, date and place of birth and contact details) required to document the consent given, manage any subsequent withdrawal and respond to the exercise of the data subject’s rights. Adempimento di obblighi di legge e principio di responsabilizzazione – art. 6, par. 1, lett. c) e art. 5, par. 2 GDPR. Necessario. In mancanza non è possibile raccogliere e gestire validamente il consenso.
c) Establishing, exercising or defending a right of the Data Controller in judicial or out-of-court proceedings. Legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR. No additional data are required beyond those already obtained.

 

 

The images will be used solely for informational, documentary and, where applicable, promotional purposes, with due respect for the dignity, propriety and reputation of the data subject. The images will under no circumstances be used in contexts that could prejudice the honour, reputation or dignity of the person depicted (Article 10 of the Italian Civil Code and Article 97(2) of Italian Law no. 633/1941). Authorisation to use the images is granted free of charge. No compensation, indemnity or royalties will be payable to the data subject for the publication and dissemination of the images within the limits set out above.


4. Processing methods
The processing is carried out using both non-electronic and electronic means by persons authorised and instructed pursuant to Article 29 GDPR and Article 2-quaterdecies of Italian Legislative Decree no. 196/2003, using methods strictly related to the stated purposes and with the adoption of appropriate technical and organisational measures pursuant to Article 32 GDPR to ensure the security, integrity and confidentiality of the data. The photographs and video recordings are stored in the Data Controller’s electronic archives, with role-based access restricted to authorised personnel. No automated decision-making, including profiling, is carried out within the meaning of Article 22 GDPR.


5. Recipients and categories of recipients
Personal data may be disclosed or made accessible to:

  • photographers, videographers and communications and marketing agencies engaged to produce and edit the recordings, appointed as processors pursuant to Article 28 GDPR;
  • providers of IT services, website hosting services and digital archive management services, which are also appointed as processors pursuant to Article 28 GDPR;
  • printers and printing companies producing printed promotional materials;
  • consultants and professionals assisting the Data Controller, as well as the competent authorities where required by law.

 

Publishing the images on the Data Controller’s website and related social media pages (including, by way of example, Facebook, Instagram, YouTube and LinkedIn) entails their dissemination to an indefinite number of recipients. Social media platform operators act as independent data controllers in relation to the processing activities they carry out, in accordance with their respective privacy policies, which should be consulted for further information.


6. Transfer of data to third countries
Publishing images on social media platforms and using cloud services may involve transfers of data to third countries, particularly the United States. In such cases, the data are transferred to providers certified under the European Commission adequacy decision of 10 July 2023 pursuant to Article 45 GDPR or, where no such certification applies, on the basis of the standard contractual clauses approved by the European Commission pursuant to Article 46(2)(c) GDPR, supplemented by additional measures where necessary. The data subject may obtain a copy of the safeguards applied by contacting the Data Controller using the contact details provided in point 1.


7. Retention period

  • Photographs and video recordings: 5 (five) years from the date on which consent is given, unless consent is withdrawn earlier. Once this period has expired or consent has been withdrawn, the Data Controller will cease any further use, publication and dissemination of the images and will delete them from its archives, without prejudice to their retention for the purpose of establishing, exercising or defending legal claims within the applicable limitation periods.
  • Consent declarations and release forms: for the entire period during which the images are used and subsequently for the time required to document compliance with legal obligations (accountability), but in any event no longer than the applicable limitation periods.

 

Given the nature of the internet and social media, images that have already been disseminated may have been indexed, shared or duplicated by third parties. In such cases, after receiving the withdrawal request, the Data Controller will take all reasonable steps to inform the recipients of the erasure request pursuant to Article 17(2) GDPR, but cannot guarantee the complete removal of copies made by third parties outside its control.


8. Rights of the data subject
The data subject may exercise their rights of access, rectification, erasure, restriction of processing, data portability and objection at any time pursuant to Articles 15 to 22 GDPR by writing to the Data Controller using the contact details provided in point 1. The Data Controller will respond without undue delay and in any event within one month of receiving the request, pursuant to Article 12 GDPR. Withdrawal of consent: consent may be withdrawn at any time, as easily as it was given, by sending written notice to the e-mail address indicated above. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn and will result in the cessation of any further use and dissemination of the images from the date on which the request is received (Article 7(3) GDPR). The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it – Piazza Venezia no. 11, 00187 Rome) pursuant to Article 77 GDPR or to bring proceedings before the competent court pursuant to Article 79 GDPR.


9. Updates to this notice
This notice, updated in September 2026, is published on the Data Controller’s website (www.ducati-cycling.com) and may be revised and updated. Any revisions or updates will be notified by publishing the updated version on the same website.