FaceOrFactory
Ljubljana, 7 September 2020

1. Preliminary provisions

FaceOrFactory applies special care to the security of your personal data. All personal data provided are treated confidentially and are only used for the purpose for which they were obtained or provided. We manage your data with the greatest care, complying with the effective legislation and the highest standards of the latter. To protect your personal data as effectively as possible, we take care of the security of your personal data with, among others, appropriate organizational measures, operating procedures, advanced technological solutions, and the help of external experts. We use a proper degree of protection and reasonable physical, electronic and administrative measures with which we protect the data from inadvertent or illegal destruction, loss, alteration, unauthorized disclosure of personal data, or from unauthorized access to personal data transmitted, stored or otherwise processed.

This Privacy Policy describes how FaceOrFactory processes your personal data which you transmit directly or indirectly or which is obtained through our website, and your rights with regard to the processing of personal data. This Privacy Policy was last changed on 07 September 2020. We may change this Privacy Policy and publish it on our website together with the former versions.

This Privacy Policy, in compliance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “General Data Protection Regulation GDPR”), includes the following:

• Contact information regarding the personal data controller,
• Purposes, bases and means of processing different types of personal data,
• Period of storage of individual types of personal data,
• Individual rights relating to personal data processing,
• The right to lodge a complaint regarding personal data processing,
• Period of validity of the Privacy Policy.

2. Essential information about the controller - Zavod Kersnikova

Name of the organisation: FaceOrFactory
Head office: Kersnikova 4, 1000 Ljubljana
E-mail: faceorfactory@gmail.com
Website: https://www.faceorfactory.ooo
Founders: Anja Blaj, Aljaž Rudolf, Eva Smrekar
Date of founding: 4 September 2020
Directors: Aljaž Rudolf, Eva Smrekar

3. Personal data we process

What are personal data?

Personal data includes any information relating to an identified or identifiable natural person, such as: first name and last name, home address, location (a phone may broadcast its location), online identifier (IP address), e-mail, phone number etc.

What is personal data processing and when can personal data be processed?

Personal data processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction

Personal data may be processed only if this is provided by law or when a proper legal basis is provided. At FaceOrFactory we process personal data of individuals who used our services, and personal data of visitors of our social networks.

For different purposes, we process the following identity information on the individual: first name, last name, address, temporary address, electronic address, date of birth, EMŠO, tax number, mobile phone number, number of identity document, optical facial capture, and a DNA sample.

As a user of FaceOrFactory website, you may at any time decide to contact us through a form on the website and decide which free interactive tools you will use on our website. Users cannot be identified when using free interactive tools. You can also send us an electronic message to the email addresses provided on our website. In that case, you decide at your own will which personal data you wish to disclose.

Each time you visit websites operated by FaceOrFactory, a web server log file is automatically stored on the web server (e.g. IP number - a number that identifies an individual computer or another type of device on the web; browser version, the subpage visited, time and duration of the visit, page from which the file was requested, date and time of the request, time spent on the website, amount of data transferred, access status - whether the file was downloaded or not found, etc.).

Within the scope of these purposes, the websites use cookies, the nature of which is presented in more detail in our website’s Cookie Policy. This data is processed for the purpose of monitoring website traffic statistics to improve the functioning of the websites and to ensure the security of information systems.

FaceOrFactory contacts individuals and the general public via the digital social network Instagram, which is why it is important that individuals also become acquainted with the rules of these networks, i.e. their privacy policies and privacy settings.

When you access your Instagram account or the online services of FaceOrFactory via digital social networks, or when you connect to the service via a digital social network, your personal information may also include user identification and/or username associated with a particular digital social network, as well as any information or content that you allow the digital social network to share with us, such as a photo, email address or friends list, and any information you have publicly posted in connection with a particular social network.

You can obtain detailed information on the scope and purposes of the processing of personal data by digital content providers directly from the providers of these services, the operators of these social networks or directly within these digital social networks. FaceOrFactory assumes no responsibility for the protection of your personal data within the aforementioned social networks, online services and all websites relating to them.

In the context of scientific research, in addition to the above, we may process further personal data for each study. The type and extent of personal data may vary in these cases; additional information will be published along with a particular study.

4. For what purposes do we process your personal data?

FaceOrFactory is a family, a company and a laboratory of faces, masks and new identities. By creating new people using the DNA material and 3D scans of an individual donor, who is offered a place in the corporation along with a specific share of its assets in return, the project modulates various heteronyms, their biographies, professions and specific functions in modern corporate capitalism. Thus, it gradually develops the face as a complex territory of genetic, legal, cosmetic, and political power relations.

Biometric data will be submitted to the process of genetic purification in the laboratory of Biotehna - a platform for artistic research of living systems. Subsequent processing involves PCR (polymerase chain reaction) that amplifies selected gene segments (15), which are later digitized by genetic sequencing.

Digitized data will be available for educational purposes as a part of training machine learning, with the aim of establishing a specific link between the genetic code and facial morphology, and creating an algorithm that will collate all acquired facial sections into random facial combinations.

A Face or a Factory also processes personal data to meet legal obligations.

Personal data of individuals are processed for the following purposes:

• Operation of the cooperative FaceOrFactory
• Informing about the execution of programs and activities, informing about benefits and novelties;
• Design and transmission of publications, artworks, and products with an artistic and market value;
• Informing about current events and sending newsletters or invitations.

Personal data provided by visitors to our websites are processes for the following purposes:

• Compilation of user statistics,
• Promoting security and improving our websites,
• Communicating information and
• Improving our other services.

5. What is the legal basis for personal data processing?

In order to process your personal data, a legal basis must exist, as set out in the General Data Protection Regulation GDPR. Processing is only lawful if at least one of the following conditions is met:

• the individual has consented to the processing of his or her personal data for one or more specific purposes;
• processing is necessary for the implementation of a contract (program) whose contractor (participant) is an individual to whom the data relates to, or for the implementation of measures at the request of such an individual before the conclusion of the contract (registration to the program);
• processing is necessary to fulfil a legal obligation applicable to the controller;
• processing is necessary to protect the vital interests of the individual to whom the data relates to, or of another natural person;
• processing is necessary for the performance of a task in the public interest or for the exercise of public authority conferred on the controller;
• processing is necessary for legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the individual, to whom the data relates to, requiring the protection of personal data, in particular where the individual to whom the data relates to, is a child.

A Face or a Factory uses the following legal bases (depending on the type of personal data concerned): processing for the performance of the contract or obligational relationship (program), processing to fulfil a legal obligation, processing to carry out a legitimate interest, or processing based on your consent.

A – Processing for the performance of a contract or obligational relationship:

In the context of executing contractual or obligational rights and obligations of FaceOrFactory towards individuals (programs).

B – Processing to fulfil a legal obligation:

We must process certain types of personal data on individuals as required by legislation, such as the Protection of Documents and Archives and Archival Institutions Act, and others.

C – Processing to carry out a legitimate interest:

Due to the balance of interests, we may process your personal data for the purpose of protecting our own legitimate interests or those of third parties. In any case, the processing of data shall be carried out in the following cases in order to protect legitimate interests:

• measures for the management and further development of our services and products;
• measures to protect against illegal conduct;
• in the context of legal proceedings.
• This means we process your personal data for purposes such as:
• providing, maintaining and improving our services for the needs of visitors of art events and the interested public,
• developing new services,
• understanding how individuals use our services to ensure and improve the efficiency of our services,
• customizing our services to provide a better user experience,
• notifying users of events, news and other activities of FaceOrFactory,
• detecting, preventing and otherwise attending to fraud, abuse and security or technical problems in our services,
• conducting research that improves our services,
• fulfilling obligations towards our partners such as developers and rightsholders,
• enforcing legal claims, including investigating possible breaches of applicable terms of service.

D – Processing based on consent:

If none of the above legal bases is used for the processing of personal data, we will ask for your consent to process certain personal data. You can withdraw your consent at any time.

6. Limitations on the transmission of personal data

If necessary, we will authorize other companies and individuals to perform certain tasks that contribute to our services. In this case, FaceOrFactory may also provide personal data to carefully selected external processors who will enter into contract with FaceOrFactory for the processing of personal data or an agreement or other binding document with the same nature (hereinafter: “Processing Agreement”). We will provide or make available such data to external processors only to the extent required for a specific purpose. The external controller may not use these data for any other purpose and must meet at least all the standards for the processing of personal data required by the applicable legislation. External processors are contractually bound to respect the confidentiality of your personal information.

On the basis of a reasoned request, FaceOrFactory also provides personal data to the competent state authorities which have a legal basis. FaceOrFactory will, for example, respond to requests from courts, law enforcement and other national authorities, which may also include national authorities from another EU Member State.

7. Period of storage of personal data

The data is kept for a maximum period necessary to achieve the purpose for which they were collected or further processed, or until the expiry of the statute of limitations for the fulfilment of obligations or the legally prescribed retention period. A Face or a Factory undertakes to properly store data for a period of at least 10 years, unless consent is withdrawn.

At the end of the storage period, the data shall be deleted, destroyed, blocked or anonymized, unless otherwise provided by law for each type of data.

8. Individual rights in relation to the processing of personal data

We guarantee the exercise of your rights in relation to the processing of your personal data without undue delay. We will decide on your request within one month of receiving your request. In case of a more complex request or a large number of requests, the deadline can be extended by a maximum of two additional months. If we extend the deadline, we will notify you of any such extension within one month of receiving the request, together with the reasons for the extension.

You can send requests regarding the exercise of your rights to our e-mail faceorfactory@gmail.com.

When you submit your request by electronic means, we will provide you with the information by electronic means whenever possible, unless you request otherwise.

When there is reasonable doubt as to the identity of an individual who makes a request in relation to any of his or her rights, we may request the provision of additional information necessary to confirm the identity of the individual to whom the data relates to.

If the requests of an individual are manifestly unfounded or excessive, in particular in case of repetitive requests, we may:

• charge a reasonable fee, taking into account the administrative costs of providing the information or communication or implementing the required action, or
• refuse to act on the request.

We grant you the following rights in relation to the processing of your personal data:

I. the right of access to data

II. the right to rectification

III. the right to erasure (»right to be forgotten«)

IV. the right to restriction of processing

V. the right to data portability

VI. the right to object

I. the right of access to data

You always have the right to be notified whether or not personal data concerning you is being processed, and, where that is the case, the right to access to the personal data and the following information:

1. the purposes of the processing,
2. the types of personal data processed,
3. the recipients or recipient categories to whom the personal data have been or will be disclosed,
4. the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period,
5. the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing,
6. the right to lodge a complaint with a supervisory authority,
7. where the personal data are not collected from the data subject, any available information as to their source.

II. the right to rectification

You have the right to obtain from us, without undue delay, the rectification of inaccurate personal data concerning you, and taking into account the purposes of the processing, the right to have incomplete personal data completed, including by means of providing a supplementary statement.

III. the right to erasure (»right to be forgotten«)

You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the following grounds applies:

1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed,
2. if you withdraw consent on which the processing is based, and where there is no other legal ground for the processing,
3. if you object to the processing and there are no overriding legitimate grounds for the processing,
4. the personal data have been unlawfully processed,
5. the personal data have to be erased for compliance with a legal obligation in accordance with EU or Slovenian law.

IV. the right to restriction of processing

You have the right to obtain from us the restriction of processing where one of the following applies:

1. When you contest the accuracy of data, for a period enabling us to verify the accuracy of the personal data,
2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead,
3. we no longer need the personal data for the purposes of the processing, but you require the data for the establishment, exercise or defence of legal claims,
4. If you have lodged an objection regarding the processing based on legitimate grounds of the company, pending the verification whether our legitimate grounds override yours.

Where processing has been restricted under the previous paragraph, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

We are obliged to inform you before the restriction on the processing of your personal data is lifted.

V. the right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the original controller, when processing is based on your consent and when processing is carried out by automated means.

You have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

VI. right to object

When we process your data based on legitimate interests for the purposes of marketing, you may, at any time, object to such processing.

In that case, we stop processing your personal data, unless we demonstrate compelling grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

9. The right to lodge a complaint regarding the processing of personal data

You may lodge possible complaints regarding the processing of your personal data via our email address: faceorfactory@gmail.com.

If we do not decide on your request within the legal deadline or if we reject your request, you have the option of lodging a complaint with the Information Commissioner.

You also have the right to lodge a complaint directly with the Information Commissioner if you believe that the processing of your personal data violates Slovenian or EU regulations in the field of personal data protection.

If you have exercised your right of access to data and after receiving the decision you believe that the personal data you received is not the personal data you requested or that you have not received all the requested personal data, you can file a reasoned complaint with the company within 15 days, before filing a complaint with the Information Commissioner. We are obliged to decide on your complaint as a new request within eight business days.

10. Final provisions

Anything not specified in this Privacy Statement shall be governed by the applicable law.

11. Authorized representative for personal data protection

Authorized representative for personal data protection: Mag. Bojan Rajer bojan.rajer@pduc.si