Privacy Policy
Dear User,
pursuant to Article 13 of Regulation (EU) 2016/679 on the processing of personal data (hereinafter, the “GDPR”), we inform you that the Personal Data you provide to the ‘Igor Mitoraj’ Museum Foundation (hereinafter, also the “Foundation” or the “Data Controller“), when consulting the website www.museomitoraj.it (hereinafter, the “Site“) will be processed in compliance with current legislation on the protection of personal data, meaning the GDPR, Legislative Decree no. 196/2003, as amended by Legislative Decree no. 101/2018 (hereinafter, the “Privacy Code“), as well as the resolutions issued from time to time by the Authority for the protection of personal data (hereinafter, the “Guarantor for the protection of personal data“), and, in any case, in compliance with the principle of confidentiality that inspires the Foundation’s activities.
1. CATEGORIES OF PERSONAL DATA PROCESSED
The Data Controller will process browsing data such as, by way of example, information relating to the device used to browse the Site, IP address, cookies, etc. This information is collected in order to allow the Data Controller to diagnose and manage the Site, as well as to determine how users have reached the Website.
The voluntary sending of e-mails to our e-mail addresses does not require further information or requests for consent.
The Site uses third-party technical cookies. Cookies operate in order to analyze the effectiveness of the Site and make it easier and more intuitive over time. For more information, a specific cookie policy is available.
2. PURPOSES AND LEGAL BASES OF THE PROCESSING
The personal data made available to the Data Controller through the Website may be used for the following purposes:
a. fulfilments related to the use of the Site, such as, by way of example, activation by registration, and the subsequent management and maintenance of technical security;
b. fulfilments related to the legal obligations to which the Foundation is subject, including administrative and/or accounting obligations.
The processing of your data for the purposes referred to in letter b) does not require your consent, as it is necessary for the fulfilment of legal obligations to which the Foundation is subject, pursuant to art. 6 (1) (c) GDPR. The processing for the above purposes does not require your consent, as it is necessary for the pursuit of the legitimate interests pursued by the Foundation, pursuant to art. 6 (1) (f) GDPR.
3. METHODS OF DATA PROCESSING
The processing of personal data is carried out in compliance with appropriate security measures in paper, electronic and/or telematic form, with logics strictly related to the above purposes and, in any case, in such a way as to guarantee the security and confidentiality of the data.
4. PROVISION OF DATA AND CONSEQUENCES OF REFUSAL
The provision of personal data for the pursuit of the purposes referred to in letter b) of Article 2 above is necessary for the fulfilment of legal obligations. Any refusal and/or provision of inaccurate and/or incomplete information could have the possible consequences of the Foundation’s inability to comply with all the obligations imposed by current legislation to which it is subject.
The provision of personal data for the above purposes is necessary for the pursuit of the legitimate interests of the Foundation indicated above. Any refusal and/or provision of inaccurate and/or incomplete information could have the possible consequences of making it impossible for the Foundation to fulfil the obligations related to the use of the Site.
5. RECIPIENTS OR CATEGORIES OF RECIPIENTS
The following subjects may become aware of your personal data:
• subjects who provide the Foundation with services instrumental to the purposes referred to in Article 2 above (such as, by way of example, subjects, bodies and/or companies that manage and/or participate in the management and/or maintenance of the Site) who, as the case may be, will operate as Data Processors pursuant to Article 28 of the GDPR duly appointed by the Data Controller or as independent data controllers;
• employees and collaborators of the Foundation, who will act as persons authorized to process personal data duly appointed by the Data Controller;
• any other person to whom the data must be provided on the basis of an express provision of law.
In any case, the data will not be disseminated.
6. TRANSFER OF DATA TO THIRD COUNTRIES
The data may be communicated and/or transferred abroad, in accordance with current regulations, even to countries outside the European Union. In all such cases, the transfer takes place on the basis of an adequacy decision of the Commission (Article 45 of the GDPR) or in accordance with standard data protection clauses or other appropriate safeguards pursuant to Articles 46 or 49 of the GDPR.
7. DURATION OF PROCESSING AND STORAGE PERIOD
Your personal data will be processed only for the time necessary to achieve the purposes for which they are processed. The data will be stored according to the following criteria:
• data processed for purposes related to the fulfilment of legal obligations referred to in letter b) of Article 2 “Purposes and legal bases of processing” of this policy, will be kept for a period of 10 years, unless the need arises for further storage, to allow the Foundation to defend its rights;
• the data processed for the pursuit of the legitimate interests of the Data Controller referred to in Article 2 “Purposes and legal bases of the processing” of this policy, will be kept for a maximum period of time equal to the limitation period of the rights enforceable against the Data Controller, as the case may be.
8. RIGHTS OF DATA SUBJECTS
In relation to their personal data, each data subject may exercise the following rights at any time, within the limits and under the conditions set out in Articles 7 and 15-22 of the GDPR.
In order to exercise these rights, please contact the Data Controller at the e-mail address privacy@museomitoraj.it such request will be adequately responded to without delay and, in any case, within one month of receipt of the request.
In particular, each data subject has the right to:
• obtain confirmation as to whether or not personal data concerning him or her are being processed;
• if processing is taking place, obtain access to your personal data and information relating to the processing and request a copy of the personal data;
• obtain the rectification of inaccurate personal data and the completion of incomplete personal data;
• obtain, if one of the conditions set out in Article 17 of the GDPR is met, the erasure of personal data concerning him/her;
• obtain, in the cases provided for in Article 18 of the GDPR, the restriction of processing;
• receive the personal data concerning him/her in a structured, commonly used and machine-readable format and request their transmission to another data controller, if technically feasible;
• object at any time to the processing of personal data carried out in pursuit of a legitimate interest of the Data Controller;
• revoke any consent you may have given at any time;
• lodge a complaint with the Data Protection Authority, if you believe that your rights under the GDPR have been violated, in the manner indicated on the Website of the Data Protection Authority accessible at www.garanteprivacy.it.
9. DATA CONTROLLER AND DATA PROCESSORS
The Data Controller is Fondazione Museo ‘Igor Mitoraj’, in the person of its pro tempore legal representative, with registered office in Via Oberdan 35 – 55045 Pietrasanta (LU) (Italy).The updated list of Data Processors is available at the Data Controller’s headquarters and can be requested by sending an e-mail to the address privacy@museomitoraj.it.
Last updated: November 2023
