We hereby inform you that Italian Legislative Decree no. 196 of 30 June 2003 (“Personal Data Protection Code”, hereinafter the “Code”), as subsequently amended and supplemented, provides for the protection of natural persons and other subjects with regard to the processing of personal data.

Pursuant to Articles 13 and 14 of the Regulation (EU) 2016/679 (GDPR), information that allows the data subject to read the identification data of the controller and the purposes of the use and methods of processing. The aim is to ensure the utmost transparency with regard to the processing of personal data in relation to the services provided by Trace.

The Data Controller is the company Cariplo Factory, with registered office in Milan, Via Daniele Manin no. 23 – postcode 20121, tax/VAT no. 09440060961, represented by its legal representative, Mr Carlo Mango, in the capacity of Council member of Cariplo Factory S.r.l. In order to provide the service in question, personal data will be disclosed to Intesa Sanpaolo Innovation Center S.p.A., as a partner of the CE LAB Initiative, with registered office in Turin Corso Inghilterra 3, 10138, registered in the Companies Register of Turin, tax code 02014200246, a company which is part of the “Intesa Sanpaolo” VAT Group, VAT no. 119915000015, which will act as autonomous Data Controller.

Data may be processed by individuals qualified as External Data Processors which operate under the direct authority of the Data Controller (employees and or variously qualified co-workers).



The data provided and processed by Cariplo Factory S.r.l. and Intesa Sanpaolo Innovation Center S.p.A. concern common, personal and sensitive data. The data will be processed in compliance with the obligations of fairness, lawfulness and transparency in accordance with the applicable legislation, by protecting their confidentiality and the rights of the data subjects. Provision of the requested data is compulsory, in accordance with the applicable legislation in force, and failure to provide such data might prevent access to the service requested.



The data provided will be processed for the following purposes:

  1. Subscription to Trace, the initiative promoted by Cariplo Factory and Intesa Sanpaolo Innovation Center, aimed at mapping Circular Economy projects in Italy and launching open innovation initiatives;
  2. Subscription to and participation in activities/initiatives reserved for Trace participants;
  3. Use and management of content (documents, information, images, etc.), for purposes relating to the Trace programme, which users voluntarily decide to upload to in order to participate in the programme.



The processing will be carried out at the premises of Cariplo Factory S.r.l. and Intesa Sanpalo Innovation Center S.p.A., namely at the BASE building, former Ansaldo area, in Milan, Via Bergognone no. 34. However, please note that data may also be processed and stored at Fondazione Cariplo, in Milan, via Manin 23 – 20121.



The processing is carried out automatically and/or manually and/or with electronic means, and therefore also by means of paper or magnetic media, anyway automated.

Personal data will be stored both in a paper archive and in the company’s electronic database for the purposes indicated in compliance with Article 32 of the GDPR, regarding security measures, by specially appointed individuals and in compliance with Article 29 of the GDPR.

Please note that, in accordance with the principles of lawfulness, purpose limitation and data minimisation, pursuant to Article 5 of the GDPR, personal data will be stored for the period of time strictly necessary to achieve the purposes for which they are collected and processed.



We inform you that the data collected will never be disseminated and will not be disclosed without the express consent of the data subject, except for necessary disclosure that may involve transfer of data to qualified individuals such as external managers operating under the direct authority of the Data Controllers, employees and or variously qualified co-workers, consultants or other persons. Moreover, the data will be disclosed, regardless of consent, for the fulfilment of legal obligations, including, but not limited to, tax obligations and safety-at-work legislation.

In addition, in order to pursue the purposes set out under numbers 1 to 3, it might be necessary to disclose your Personal Data to promoters and investors of the initiative.

The third parties to whom the personal data may be disclosed will process the data as autonomous Data Controllers, Joint Data Controllers or Data Processors.



At any time, the data subject may exercise, pursuant to Articles 15 to 22 of the GDPR, the right to:

  1. a) request confirmation of the existence of its personal data;

(b) to obtain information about the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipient to whom the personal data have been or will be disclosed, the storage period (data subject’s right of access);

(c) obtain rectification and erasure of data (right of rectification);

(d) obtain restrictions of processing;

  1. e) obtain the portability of data, i.e. receive them from a data controller, in a structured, commonly used and machine-readable format, and transmit them to another data controller without limitation (right to obtain notification from the data controller regarding rectification or erasure of personal data or restriction of processing);
  2. f) object to the processing at any time (right to object);
  3. g) withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal (right of withdrawal)
  4. h) request erasure of its data to the extent not contrasting with the Controller’s legal obligations (right to be forgotten);

(i) to lodge a complaint with a supervisory authority.

Finally, please note that the data subject has the right to lodge a complaint with the Italian Data Protection Authority, with registered office in Rome, via di Montecitorio no. 121 (tel. no. 0039 06696771), by following the procedures and instructions published on the Authority’s website

Please note that the exercise of the data subject’s rights referred to in the aforementioned Articles, such as the right to erasure or object, meets the limits imposed by the applicable legislation (Articles 56 and 57 of Prime Ministerial Decree of 22 February 2016, and Article 7 of Prime Ministerial Decree of 24 October 2014) with regard to personal data storage obligations.

You can exercise your rights by sending a written application to:

  • Cariplo Factory S.r.l. by post to the address Via Daniele Manin no. 23 – 20121 Milan, or to the e-mail address
  • Intesa Sanpaolo Innovation Center S.p.A. through Intesa Sanpaolo S.p.A. Tutela Aziendale – Privacy, Piazza San Carlo, no. 156 – 10121 Turin, or to the e-mail address