Privacy notice on the processing of personal data for the management of the Milan Urban Food Policy Pact

Notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (hereinafter, the “Regulation”), the following information is provided on the processing carried out in the context of the management of the Milan Urban Food Policy Pact (MUFPP) international network. This notice applies both to data collected directly from the data subject and to data obtained from the cities, bodies and organisations with which the MUFPP Secretariat maintains institutional and project relations, including those located outside the European Economic Area.

1) Data controller
The data controller is the Municipality of Milan (Comune di Milano), with registered office at Piazza della Scala 2, 20121 Milan, Education Directorate, Food Policy Area, Milan Urban Food Policy Pact Unit, located at Via Sile 8, 20139 Milan.

E-mail: ED.foodpolicy@comune.milano.it
Certified e-mail (PEC): foodpolicy@postacert.comune.milano.it

2) Data Protection Officer (DPO)
The Municipality of Milan has appointed a Data Protection Officer (DPO), who can be contacted at the following e-mail address: dpo@comune.milano.it.

3) Purposes
Personal data are processed to enable the management and development of the Milan Urban Food Policy Pact international network and cooperation among cities in the design and implementation of sustainable urban food policies, through institutional relations, knowledge exchange, training, events, governance bodies, the collection of good practices and funded projects. In particular, the processing is carried out for the following activities:
• management of cities’ membership of the MUFPP and updating of institutional representatives and technical focal points;
• maintenance and updating of the network’s global contact database;
• sending of institutional communications, invitations, operational updates, documentation and project opportunities;
• organisation of bilateral and multilateral exchanges, mentorship activities, meetings, webinars and training programmes; fellowship and exchange programmes among the network’s cities;
• management of nominations, voting and the composition of the Steering Committee;
• organisation of Global Forums and Regional Forums, missions, institutional visits and other network events;
• collection and management of practices submitted to the Milan Pact Awards and publication of the results; submitted practices are assessed by a jury that also includes representatives of international institutions and organisations, which is given access only to the content of the practices, without the contact details of the focal points;
• development and management of funded projects, partnerships, working groups, monitoring, reporting and dissemination of results;
• organisation of travel and accommodation services related to the MUFPP’s institutional activities;
• production, storage and use of photographs, audiovisual footage, recordings and communication materials relating to the network’s activities.

Data are used solely to the extent necessary to carry out the activities listed above. Cities and partners are requested not to transmit personal data of citizens, beneficiaries or other third parties.

4) Legal basis
The processing of common personal data is carried out pursuant to Article 6(1)(e) and Article 6(3) of Regulation (EU) 2016/679 and Article 2-ter of Legislative Decree No. 196/2003, as it is necessary for the performance of a task carried out in the public interest and for the exercise of the institutional functions of the Municipality of Milan. The processing is carried out, in particular, in implementation of:
       •   Legislative Decree No. 267 of 18 August 2000;
       •   City Council Resolution No. 25/2015, setting out the Guidelines of the Milan Food Policy and approving the Milan Urban Food Policy Pact;
        • City Executive Board Resolution No. 1041/2016, establishing the MUFPP Secretariat;
        • organisational acts of the Municipality of Milan, agreements, partnership agreements, grant agreements and project documents assigning to the Food Policy Area the management of the network and its related activities.

Dietary, health or accessibility requirements voluntarily communicated by the data subject are processed on the basis of explicit consent, pursuant to Article 9(2)(a) of the Regulation. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal. Withdrawal of consent or failure to provide such information may prevent the Municipality from arranging the specific support or service requested.

Photographic and audiovisual documentation produced in the context of public and institutional events is processed as part of the Municipality’s task carried out in the public interest. For individual portraits, interviews, testimonials or promotional uses beyond institutional documentation, specific consent is obtained pursuant to Article 6(1)(a) of the Regulation.

5) Categories of data subjects and source of the data
The processing mainly concerns:
  • mayors, deputy mayors and other institutional representatives of cities that are signatories of, or interested in joining, the MUFPP;
  • managers, officers and technical focal points of signatory cities;
  • candidates for and members of the Steering Committee;
  • delegates, speakers, trainers and participants in Forums, events, missions, institutional visits and training activities;
  • focal points of international organisations, city networks, universities, public bodies, foundations and project partners;
  • focal points of cities applying for or taking part in the Milan Pact Awards;
  • staff and collaborators involved in the network’s activities;
  • persons appearing in photographs or audiovisual recordings of events.

Data are obtained:
  • directly from the data subject, through forms, event registrations, correspondence, applications, organisational requests or other communications;
  • from the city, body or organisation represented by the data subject.

Where data are not collected directly from the data subject, this notice is provided within one month of obtaining the data or, if the Municipality communicates with the data subject earlier, at the latest at the time of the first communication.

6) Types of data processed
The processing may concern the following categories of common personal data:
  • first name and surname, date and place of birth, and nationality;
  • e-mail addresses and telephone numbers, mainly institutional;
  • organisation, city and country, professional title, position and role;
  • data relating to network membership, participation in activities, applications and governance bodies;
  • data relating to Forums, events, missions, visits, training, the Milan Pact Awards, projects and partnerships;
  • photographs, images, voice and audiovisual recordings;
  • identity or travel documents, passport details and information required to manage visas and bookings;
  • itineraries, flights, accommodation and other travel-related organisational information.

Dietary requirements, health-related information or accessibility needs are also processed, solely where the data subject voluntarily provides them in order to receive a specific service. Such information is used only to arrange the support requested and is accessible only to the staff for whom it is strictly necessary.
Images and audiovisual recordings are not subject to facial recognition systems or to any other processing aimed at biometric identification. The processing does not ordinarily involve data relating to criminal convictions or offences.

7) Processing methods
Processing is carried out in compliance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality. It is performed using digital tools and, where necessary, paper records, with organisational and technical measures appropriate to the nature of the data processed. Data are managed through:
  • files and documents stored in network folders with role-based access;
  • e-mail and certified e-mail (PEC);
  • Microsoft 365 tools, such as Outlook, Teams and SharePoint;
  • the MUFPP website and institutional channels; the MUFPP institutional social media pages on Facebook, LinkedIn, X and YouTube, whose operators process users’ data in accordance with their own privacy notices;
 • digital archives of events, photographs and audiovisual content;
 • event registration and project management platforms located within the European Economic Area.

Access is restricted to authorised persons according to their respective duties. Contact data are periodically checked for accuracy and kept up to date. Temporary lists and working copies are deleted when no longer needed.

8) Nature of the provision of data
The provision of identification, institutional contact and role data required to manage membership, relations with the network and participation in institutional activities is necessary. Failure to provide such data makes it impossible to manage the relationship with the MUFPP, send communications or complete registration for the specific activity.

The provision of travel data is necessary only where the Municipality arranges the related services. Failure to provide such data makes it impossible to make the booking or provide the service requested.
The provision of dietary, health or accessibility requirements and consent to optional uses of images or audiovisual content are voluntary. Refusal does not affect network membership or participation in activities, but may prevent the arrangement of the specific support requested or the use of the material for the optional purpose.

9) Categories of recipients and data processors
Data are processed by the employees and collaborators of the Milan Urban Food Policy Pact Unit, who are formally authorised and instructed, and by the staff of other municipal departments involved in institutional, administrative, project and organisational activities. To the extent necessary for their respective functions, data are disclosed to data processors pursuant to Article 28 of the Regulation for the travel services contracted by the Municipality, as well as to providers of IT, logistics, organisational and audiovisual services established within the European Economic Area and designated as data processors when acting on behalf of the Municipality.

An up-to-date list of data processors may be requested from the data controller.

Host cities, partners or organisers that independently determine the purposes and means of their own processing act as independent data controllers, collect the data they need directly from data subjects and provide their own privacy notice.

10) Dissemination and publication of data
In order to document and communicate the network’s institutional activities, the following may be published on the websites and institutional channels of the Municipality and the MUFPP, as well as in programmes, reports, publications, information materials and press releases:
   • first name and surname, title, role, organisation, city and country;
   • participation in governance bodies, events, awards, projects and training activities;
   • institutional biographies and relevant professional contributions;
   • results of the Milan Pact Awards and of the Steering Committee election processes, as well as the content of the practices collected in the global food policy database published on the MUFPP website, including the name, role and organisation of the focal points indicated by the cities;
  • photographs and audiovisual footage produced in the context of institutional activities.

Private contact details, identity or travel documents, booking data, dietary requirements, health information and accessibility needs are not published. Individual portraits, interviews, testimonials and optional promotional uses are published only on the basis of specific consent.

11) Data retention
Data are retained according to the following criteria:
   • institutional contact data are retained for the duration of the role and for 5 years after the last meaningful contact; their accuracy and currency are verified at least every two years;
  • records relating to membership, governance, the Steering Committee, the Milan Pact Awards, Forums, projects and institutional activities are retained for 10 years from the closure of the file, or for any longer period required by the Records Retention Plan, by grant agreements or for audit and litigation purposes;
  • records and materials of historical, institutional or archival value may be retained permanently in accordance with the rules applicable to public archives;
  • travel data and documents are retained until the end of the mission and in any case for no longer than 90 days, without prejudice to legal, administrative, accounting, reporting or litigation-related obligations;
  • dietary, health or accessibility requirements are deleted within 30 days of the end of the event or trip, without prejudice to legal, administrative, accounting, reporting or litigation-related obligations;
  • working copies, temporary lists and exchange files are deleted as soon as they are no longer needed.

12) Data obtained from third countries and international transfers
The Municipality of Milan also obtains personal data from data subjects, cities and bodies located in countries outside the European Economic Area. The receipt of such data by the Municipality does not constitute a transfer of personal data from the Municipality to a third country.

Except as provided below for travel services, the Municipality and the processors acting on its behalf do not disclose, make accessible or transfer the personal data covered by this processing to entities established outside the European Economic Area or to international organisations. This exclusion also applies to the network’s international partner organisations, such as FAO and WFP, with which joint projects are carried out.

For activities taking place outside the European Economic Area, any data requested by host cities or other local organisers are provided directly by the data subject to those entities, which act as independent data controllers and provide their own information on the processing.

Where the Municipality, through the travel agency designated as data processor, arranges travel involving carriers, accommodation facilities or other operators established outside the European Economic Area, only the data strictly necessary for booking and providing the service are disclosed to those entities, such as the traveller’s name and travel document details and, only if requested by the data subject, any assistance needs. Such disclosure is occasional, limited to the individual service and carried out pursuant to Article 49(1)(d) and, in certain cases, points (a), (b) and (c) of the Regulation, as it is necessary for the performance of the organised travel service. The countries of destination may not ensure a level of data protection equivalent to that of the European Union.

13) Automated decision-making
The processing does not involve decisions based solely on automated processing, including profiling, within the meaning of Article 22 of the Regulation.

14) Rights of data subjects
In the cases and within the limits laid down in Articles 15 et seq. of the Regulation, data subjects may exercise the rights of access, rectification, completion, erasure, restriction of and objection to processing, as well as the right to data portability where applicable.

Where processing is based on consent, the data subject may withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal. The data subject may also request the updating or removal of their contact data when they no longer hold the role indicated.

Requests may be addressed to the Municipality of Milan, Education Directorate, Food Policy Area, Milan Urban Food Policy Pact Unit, Via Sile 8, 20139 Milan, e-mail: ED.foodpolicy@comune.milano.it, or to the Data Protection Officer of the Municipality of Milan at: dpo@comune.milano.it.

15) Right to lodge a complaint
Data subjects who consider that the processing of their personal data infringes the Regulation have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), pursuant to Article 77 of the Regulation, or to bring proceedings before the competent judicial authority, pursuant to Article 79.

16) Amendments
The data controller updates this notice whenever regulatory, organisational, project-related or technological changes affecting the processing occur. Amendments are made known through the institutional channels of the Municipality of Milan and the MUFPP and, where relevant, by direct communication to data subjects.

Milan, 29/09/2026