This Privacy Notice is provided by Antonio Riva Milano S.r.l., in its capacity as Data Controller, pursuant to Regulation (EU) 2016/679 (“GDPR”), to users submitting photographic content through the InARM form.

Please read this document carefully before completing the form and uploading any photographic content.

1. Data Controller

The Data Controller is Antonio Riva Milano S.r.l., with registered office at Corso Venezia 44, 20121 Milan, Italy, email: customerservice@antonioriva.com (hereinafter the “Controller”).

The Controller has not appointed a Data Protection Officer (DPO) pursuant to Article 37 GDPR, as the relevant legal requirements do not apply. For any matters relating to the processing of personal data, users may contact the Controller at the email address indicated above.

2. Data Processor

Personal data directly provided by the data subject are collected through the Formful platform, used by the Controller for form management and the collection of applications within the scope of the InARM initiative.

3. Categories of Personal Data Processed

Through the InARM form, the following categories of personal data may be collected and processed:
- identification data of the bride/groom (first name, last name);
- contact details (email address);
- photographic images and multimedia content;
- metadata associated with uploaded files (such as date, location of the shoot, technical settings, where available);
- photographic credits (professional photographer / photography studio name);
- declarations regarding ownership of rights or possession of the necessary authorisations;
- information relating to the wedding event;
- any additional information voluntarily provided by the user.

Uploaded images may contain personal data relating to third parties (e.g. partner, family members, guests, photographer). The user uploading the images is solely responsible for the lawfulness of the disclosure of such data and declares that all necessary authorisations have been obtained from the individuals depicted. Please refer to Section 12 (User Declarations) for the applicable conditions.

4. Purposes of the Processing

Personal data and submitted content are processed for the following purposes:
a) receipt and management of the application: receipt, technical verification, moderation, and evaluation of content submitted through the InARM form;
b) selection and possible publication of the content on the Controller’s official channels;
c) communication with the user: updates regarding the status of the application and operational communications;
d) management of data subject rights;
e) handling requests relating to the exercise of data subject rights;
f) legal protection and dispute management.

5. Legal Basis for Processing

The processing of personal data is based on:
- the explicit consent of the data subject, provided through dedicated checkboxes, for the publication and use of the images;
- the performance of pre-contractual measures requested by the data subject (submission of the application);
- the Controller’s legitimate interest in managing, promoting, and protecting its editorial and brand communication activities.

6. Processing Methods

Data are processed using electronic tools and, where necessary, also by manual means, in compliance with the principles of lawfulness, fairness, transparency, data minimisation, and storage limitation.

The Controller adopts appropriate technical and organisational measures to ensure the security of personal data.

7. Content Publication Channels

If selected, the content may be published through the following official channels of the Controller:
- official website;
- social media platforms (including Instagram, Facebook, Pinterest, and equivalent platforms);
- newsletters;
- digital campaigns and advertising;
- editorial materials and lookbooks;
- online and offline promotional materials;
- press and corporate communications.

8. Data Recipients and Data Processors

Personal data may be disclosed or made accessible to the following categories of recipients acting as data processors pursuant to Article 28 GDPR or as authorised persons under the authority of the Controller:
- authorised internal personnel of the Controller (creative team, marketing department, customer service, legal department), within the scope of their duties;
- Formful (or equivalent form/CRM management platforms), acting as data processor pursuant to Article 28 GDPR, for the collection and technical storage of applications;
- IT and hosting service providers, for the management of the IT infrastructure;
- email marketing and newsletter providers, for the delivery of operational and promotional communications (where the user has provided the relevant consent);
- digital, creative, and media agencies engaged in the production of editorial and promotional materials;
- social media and advertising platforms (such as Meta, Google, and similar providers), limited to the data necessary for the publication of content on the respective channels, where the user has provided consent.

9. Transfer of Data to Third Countries

The use of third-party digital platforms and services may involve the transfer of personal data to countries outside the EEA.

Such transfers are carried out in compliance with Articles 44 et seq. GDPR through appropriate safeguards, including Standard Contractual Clauses or other adequacy mechanisms.

Users have the right to request information from the Controller regarding the safeguards adopted for transfers outside the EEA by contacting customerservice@antonioriva.com.

10. Data Retention Period

Personal data will be retained:
- for up to 24 months from collection for purposes related to the evaluation and management of the application;
- until withdrawal of consent regarding the use of published content;
- for the period necessary to comply with legal obligations or protect the Controller’s rights.

Content already published or incorporated into editorial or promotional materials may not be immediately removed from all channels, including for technical reasons or due to prior dissemination.

11. Withdrawal of Consent

The data subject may withdraw consent for the use of the images at any time by sending a request to customerservice@antonioriva.com.

Withdrawal of consent:

does not affect the lawfulness of processing carried out prior to the withdrawal;
results in the interruption of any new use of the content;
entails, where technically feasible, the removal of the content from the Controller’s channels within a reasonable timeframe.

12. User Declarations Regarding Uploaded Content

By uploading images through the InARM form, the user represents and warrants the following:
- Ownership of rights: that they own the rights to use the uploaded images or have obtained all necessary authorisations and licences from the photographer/photography studio that created the works, including the right to grant the Controller the licence referred to in the specific disclaimer.
- Photographer’s authorisation: that they have obtained explicit written authorisation from the professional photographer or photography studio for the use of the images by Antonio Riva Milano S.r.l. for promotional and commercial purposes, under the terms specified in the disclaimer.
- Consent of identifiable third parties: that they have obtained the explicit consent of all identifiable third parties depicted in the images (e.g. partner, family members, guests) for the publication of their images on the brand channels listed in Section 5.
- Absence of conflicting third-party rights: that the uploaded content does not infringe any third-party rights, including copyright, image rights, personality rights, or any other intellectual or industrial property rights.
- Documentary evidence: that they are able to provide, upon request by the Controller, appropriate documentation proving ownership of rights and/or the authorisations obtained. The Controller reserves the right to request such documentation prior to publication.

13. Third Parties Depicted

The user assumes full responsibility towards any third parties depicted in the uploaded images. The Controller shall not be liable for any violation of image rights or privacy rights of third parties arising from insufficient or missing authorisations provided by the user.

The Controller reserves the right to reject, refrain from publishing, or remove any content deemed not compliant with the declarations made by the user or subject to disputes raised by third parties.

14. Data Subject Rights

The data subject may exercise at any time the rights provided under Articles 15–22 GDPR, including:
- right of access;
- right to rectification;
- right to erasure;
- right to restriction of processing;
- right to object;
- right to data portability;
- right to lodge a complaint with the competent Data Protection Authority.

To exercise their rights, the data subject may submit a written request to the Controller at: customerservice@antonioriva.com. The Controller will respond within 30 days from receipt of the request (such period may be extended by an additional 60 days where necessary, subject to reasoned notice pursuant to Article 12(3) GDPR).

15. Nature of the Provision of Data

The provision of personal data for purposes A, C, and D (application submission, communications, and management of rights) is necessary in order to participate in the InARM initiative and submit an application. Failure to provide such data will make it impossible to evaluate the application.

The provision of data for purpose B (promotional publication) is optional and subject to the user’s free choice. Refusal to provide consent for such purpose will not prevent participation in the initiative but will make it impossible to select and publish the images on the brand’s channels.

Data processed for purpose E (legal protection) are processed on the basis of the Controller’s legitimate interest, regardless of the user’s consent.

16. Automated Decision-Making

The processing does not involve automated decision-making processes or profiling activities.

17. Updates

This Privacy Notice may be updated at any time. Any amendments will be published on the Controller’s website.

Last updated: 25/05/2026