1. Data controller
The data controller is the Osservatorio Metropolitano di Milano, with registered office in Milan, via Biondi 1, Italian tax code 97709170159, which can be contacted at info@osservatorio.milano.it and at the certified e-mail address osservatorio.milano@pec.it.
2. Data subjects and categories of data processed
This notice is addressed to persons submitting entries, to the authors and co-authors of the submitted articles and, where different, to representatives of news outlets. Data may be provided directly by the data subject or, where an entry is submitted by a news outlet or a third party, by the person submitting it.
The following categories of data are processed: identification and contact data; data relating to professional activity; materials and documentation submitted with the entry; for the winner and any recipients of special mentions, the personal, tax and banking data required to pay the award, as well as photographs and images relating to the award ceremony.
Technical and security data connected with use of the online form are also processed, such as IP address, date and time of connection, user-agent, device and browser information, and technical signals and tokens generated by the anti-spam protection service.
3. Purposes and legal bases
- Administration of the Award. Receipt and examination of entries, verification of requirements, work of the Jury, communications with entrants and organisation of the award ceremony. Legal basis: Article 6(1)(b) GDPR.
- Payment of the award. Fulfilment of the related administrative, tax and accounting obligations. Legal basis: Article 6(1)(c) GDPR.
- Communication and documentation of the Award. Publication and dissemination of the name, photograph, news outlet and a short biography of the winner and any recipients of special mentions, as well as the elements referred to in Article 10 of the Rules. Legal basis: Article 6(1)(f) GDPR.
- Security of the online form. Prevention of abuse, spam and automated submissions. Legal basis: Article 6(1)(f) GDPR.
- Defence of the controller’s rights. Handling of any disputes. Legal basis: Article 6(1)(f) GDPR.
The provision of the data required by the Rules and by the declaration of entry is necessary in order to take part in the Award. Failure to provide such data makes it impossible to process the entry.
4. Processing methods
Data are processed by electronic and paper-based means, according to procedures strictly related to the purposes indicated above and with appropriate security measures. No decisions based solely on automated processing that produce legal or similarly significant effects are taken, and no profiling is carried out. The online form uses an automated security check designed to prevent spam and abusive submissions.
5. Recipients of the data
Data may be disclosed to members of the Jury; providers of hosting, e-mail, IT maintenance and anti-spam protection services; administrative and tax advisers; banks for payment of the award; and competent authorities in cases provided for by law. Data relating to the winner and any recipients of special mentions may be disseminated within the limits set out in point 3.
6. Transfer of data abroad
Data are processed mainly within the European Union. The use of certain technical service providers, including Cloudflare Turnstile, may entail the processing or transfer of data to third countries. Such transfers take place on the basis of the safeguards provided for by Articles 44 et seq. of the GDPR.
7. Retention periods
Data relating to unsuccessful entries are kept for the time needed to complete the edition of the Award and document the related activities, and in any event for no longer than 24 months from announcement of the winner, without prejudice to legal obligations or defence needs.
The winner’s data and the data of any recipients of special mentions required for administrative, tax and accounting purposes are retained for the periods laid down by law, normally ten years. Materials documenting and communicating the Award may be kept in the organisation’s historical archive.
8. Rights of data subjects
Data subjects may exercise the rights provided for by Articles 15–22 of the GDPR: access, rectification, erasure, restriction of processing, portability and objection to processing based on legitimate interest. Requests may be addressed to the controller using the contact details indicated in point 1.
Data subjects may also lodge a complaint with the Italian Data Protection Authority or with the supervisory authority of their Member State of residence.
Last updated: 20 July 2026.