INFORMATION – Art.13 EU Regulation 2016/679
Cittadellarte and Fondazione Pistoletto, joint data controllers,
are committed to protecting and safeguarding the privacy of users of their sites
www.cittadellarte.it, www.terzoparadiso.org, www.journal.cittadellarte.it, www.store.cittadellarte.it
(hereinafter “the site”).
This information establishes the joint controllers’ commitment to being transparent towards the User regarding the data they collect, how they use it and how they share it.
The purpose of this document is to provide the interested party with the necessary information so that he can express, where necessary, explicit and informed consent to the processing carried out. We hope to explain this in a clear and understandable way, but we will provide contact details below if you have any questions.
In general, any information or personal data that will be provided to the joint owners via the site, or that will be collected in any other way as part of the use of the services offered by Cittadellarte Fondazione Pistoletto (the “services”), will be treated according to the principles, internationally recognized, of lawfulness, correctness, transparency, purpose and storage limitation, data minimization, accuracy, integrity and confidentiality.
This information was published in this version on 2 August 2018; occasionally we may need to change it, also due to changes in applicable legislation. To stay updated, we invite the interested party to regularly visit this section to become aware of the most recent and updated version of the information.
By using our services, you consent to our use of your data in accordance with this Privacy Policy.
A note: children under 16 can only subscribe to our site or our newsletter by involving a parent or guardian.
If the interested party does not agree with this Privacy Policy, it is necessary to stop using our services.
INDEX
1. Joint data controllers
2. The data being processed
2.a. Name, contact details and other personal data
2.b. Data provided voluntarily by the interested party
2.c. Third party data provided by the interested party
2.d. Browsing data
3. Legal basis and mandatory or optional nature of the processing
4. Purpose of the processing
5. Recipients of personal data
6. Transfers of personal data
7. Treatment methods
8. Storage of personal data
9. Social Media
10. Rights of the interested party
11. Changes
12. Definitions
1. Data Controller and Data Protection Officer.
Joint data controllers, pursuant to art. 26 of EU Regulation 2016/679, in relation to all data provided by users and in relation to the purposes described below are:
Pistoletto Onlus Foundation with headquarters in Via serralunga n. 27, 13900 Biella;
Cittadellarte S.r.l. with headquarters in Via serralunga n. 27, 13900 Biella.
The essential content of the joint ownership contract signed between Fondazione Pistoletto and Cittadellarte, containing the respective responsibilities regarding compliance with the obligations deriving from current legislation, and in particular regarding the exercise of the rights of the interested party, is available upon request of the interested party , by sending an email to the address: news@cittadellarte.it.
2. The data being processed.
The personal data processed through the Site are as follows:
to. Name, contact details and other personal data
In the “Register” section of the site, you will be asked to enter information such as username, email address, newspaper, city, telephone.
In the “Login” section, username and password. In the “Subscribe to the newsletter” section, name, surname and email.
In the “Register” section of the website www.store.cittadellarte.it, in addition to your name, surname and email, you will be asked to enter other contact details such as city, address, postal code, province, telephone number, as well as billing data (if of a company); on the latter site it is possible to purchase goods via bank transfer, Paypall platform or by paying on delivery: we inform you that in case of purchase via Paypall no bank data will be acquired (in the case of payment by bank transfer you will be in possession of the bank details of the ordering party). Furthermore, every time the interested party communicates with the joint owners through the contacts found on the Site, they may collect further information that the interested party decides to provide.
b. Third party data provided by the interested party
As already mentioned above, in some parts of the Site, it is permitted to insert text messages, visible to the joint owners, which may contain (voluntarily or otherwise) personal data of other people.
With respect to these hypotheses, the interested party must consider himself the independent data controller, assuming all the resulting legal obligations and responsibilities towards the “interested third parties”.
d. Browsing data
The computer systems and software procedures used to operate the Site acquire by default some personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified interested parties, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category includes IP addresses, the domain names of the computers used by users who connect to the Site, the addresses in URI (Uniform Resource Identifier) notation, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the IT environment of the interested party. These data are used for the sole purpose of obtaining anonymous statistical information on the use of the Site, to check its correct functioning, to provide the User with targeted advertising (for a complete explanation on these forms of use, please refer to the information on cookies ), and to identify anomalies and/or abuse. To collect information, in aggregate form, on the number of users and how they visit the site, Cittadellarte Fondazione Pistoletto uses
– of the Google Analytics service, whose cookie policy can be viewed at https://support.google.com/analytics/answer/6004245
– of Google AdWords, whose Privacy policy is available at the following address: https://policies.google.com/technologies/ads?hl=it&gl=it
3. Legal basis and mandatory or optional nature of the processing
The legal bases used by the joint controllers to process personal data, according to the purposes indicated in Article 4 below, are the following:
• Provision of the service/pre-contractual negotiations (to participate in services such as visits, stays, courses, coworking): processing for this purpose is necessary where a contract is desired or has been concluded between the interested party and the joint controllers and for its execution ( i.e. to be able to provide the contractually agreed services). The provision of personal data for this purpose is not mandatory, but without it it will not be possible to provide any Service.
• Legitimate prevailing interest of the joint controllers: the processing is necessary to: – carry out checks and assessments on the results and progress of the contractual relationship, as well as on the risks connected to it (such as: truthfulness of the data provided, solvency even during the relationship and correct use of the services); – improve the efficiency of products and services offered by the joint owners: to this end they will be able to send questionnaires regarding the level of satisfaction and market surveys, make telephone calls or chat sessions; such questionnaires/market surveys will generally be designed to minimize the use of personal data.
• Legal obligations: processing for this purpose is necessary so that the joint controllers can fulfill any legal obligations. The personal data provided to the joint controllers will be processed in accordance with the applicable legislation, which may involve their conservation and communication to the relevant authorities.
• Promotional communications to those who have already participated in our activities: the processing for this purpose is based on the legitimate interest of the joint owners in transmitting promotional communications regarding services similar to those already purchased by Users. The interested party may, at any time and free of charge, stop receiving these communications by writing to news@cittadellarte.it without prejudice to the lawfulness of the processing during the period of validity of the same consent.
• Marketing: the processing for this purpose is based exclusively on the consent of the interested party, which can be freely revoked at any time; minors under 16 can only give consent by involving a parent or guardian. The interested party may, at any time and free of charge, stop receiving these communications by writing to news@cittadellarte.it without prejudice to the lawfulness of the processing during the period of validity of the same consent. In the event of revocation, the joint owners will not proceed with any further communication.
4. Purpose of the processing
The joint controllers will process the personal data provided by Users only in the ways established in this Privacy Policy and in compliance with current legislative provisions. The personal data collected through the Site will be used for the following purposes:
to. Provision of the service/fulfillment of pre-contractual/contractual obligations: for purposes relating to the conclusion and/or execution of the obligations arising from the contract.
b. Legitimate prevailing interest of the joint owners: for checks and evaluations on the results and progress of the relationship, to draw up statistics, in anonymous form, on the services rendered and on access to the site and commercial information and on participation in events, seminars and any other initiative aimed at promoting the services of the joint owners; to prevent or detect any abuse in the use of the Site or any fraudulent activity; to improve the quality of services rendered, by sending questionnaires/feedback on participation in events.
c. Legal obligations to which the joint data controllers are subject: for compliance with the law and/or provisions of public bodies, which require the joint controllers to collect and/or further process certain types of personal data.
d. Sending promotional offers to its Users: to send, via e-mail, SMS, telephone, banner, instant messaging, operator, via paper mail and through the official social pages of Cittadellarte Fondazione Pistoletto (Facebook, Twitter, Instagram), communications of marketing, promotions and personalized content, provide targeted advertising, regarding services similar to those that the User has already purchased.
And. Marketing: to send, to anyone who has previously given their consent, marketing communications, newsletters, promotions and advertising, via e-mail, SMS, telephone, banner, instant messaging, operator, via paper mail and through the official social pages of Cittadellarte Fondazione Pistoletto (Facebook, Twitter, Instagram), relating to further products and services of the joint owners and third parties.
5. Recipients of personal data
The personal data of the interested party may be sent to the subjects indicated below (“Recipients”):
• Subjects who typically act as data controllers, i.e.: natural persons, companies or professional firms that provide assistance and consultancy to the joint controllers in commercial, accounting, administrative, legal, tax, financial, debt collection, postal matters advertising material or contractual communications, companies organizing training events, providers of services for web meetings and training web seminars; a complete list of all those responsible can be requested by contacting the email address: news@cittadellarte.it.
• Providers of email services (platforms for sending emails);
• Persons delegated to carry out technical maintenance activities (including maintenance of network equipment and electronic communications networks);
• Persons authorized by the joint controllers to process personal data necessary to carry out activities strictly related to the provision of products/services; a legal obligation of confidentiality applies to such persons;
• Competent subjects, bodies or authorities to whom it is mandatory to communicate personal data to fulfill legal obligations, prevent abuse or fraud.
6. Transfers of personal data
For purposes related to the execution of the contract, some data may be communicated to recipients located outside the EU Economic Area.
The joint controllers ensure that the processing of personal data by these recipients takes place in compliance with the applicable legislation. Indeed, transfers are carried out through adequate guarantees, such as adequacy decisions, Standard Contractual Clauses approved by the European Commission or other guarantees considered adequate. More information is available by writing to the following address: news@cittadellarte.it.
7. Treatment methods
The processing of personal data is carried out by means of the following operations: collection, recording, organisation, conservation, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of data.
Personal data is subjected to both paper and electronic and/or automated processing.
The data will be processed in such a way as to guarantee continuous security and confidentiality.
In compliance with European regulations and national data protection laws, the joint controllers have put in place specific procedures aimed at preventing unauthorized access to the data, their improper or illicit use, as well as preventing destruction or loss, even accidental. of the data themselves.
Only duly authorized personnel can access the data while carrying out their work.
8. Storage of personal data
The personal data processed for the purpose of “Provision of the Service/Contractual Fulfillments” will be kept for the time strictly necessary to pursue the aforementioned purpose.
The personal data processed for “Marketing” purposes will be retained by the joint controllers until the consent given by the interested party is revoked. Once consent is revoked, the use of data for these purposes will cease.
The personal data processed for the purpose of sending promotional offers to customers will be retained by the joint controllers until the interested party objects to the processing by writing to news@cittadellarte.it.
The personal data processed for the purpose of “Compliance with legal obligations” will be kept by the joint controllers for the period required by specific legal obligations or by applicable legislation.
The personal data processed for the purpose of preventing “Abuse/Fraud” will be kept by the joint controllers for the time strictly necessary for the aforementioned purpose.
9. Social Media
The joint owners use social media for the purpose of communicating content relating to their products and services.
https://www.facebook.com/cittadellarte
https://www.instagram.com/cittadellarte/
https://twitter.com/_cittadellarte
Third party sites that can be accessed through this website are not covered by this policy.
To consult the privacy policies of these social media, we invite you to visit the pages:
FACEBOOK: https://www.linkedin.com/legal/privacy-policy?_l=it_IT
INSTAGRAM: https://help.instagram.com/519522125107875
TWITTER: https://twitter.com/it/privacy
10. Rights of the interested party
The interested party has the right to ask the joint controllers, at any time:
Access to your Personal Data, (and/or a copy of such Personal Data), as well as further information on the processing in progress on them;
The rectification or updating of your Personal Data;
The deletion of your personal data from the databases of the joint controllers;
The limitation of the processing of personal data by the joint controllers;
Data portability, i.e. to obtain a copy of your personal data provided to the joint controllers in a structured, commonly used and machine-readable format, or to request its transmission to another controller;
Opposition to the processing of your personal data;
The revocation of your consent for the intended purposes.
The joint controllers will provide the interested party with information relating to one or more of the actions undertaken referred to in the previous list without unjustified delay and, in any case, at the latest within one month of the request itself. This deadline may be extended by two months, taking into account the complexity and number of requests, with consequent information to the interested party of this extension and the reasons for the delay, to be provided within one month of receipt of the request.
The interested party also has the right to lodge a complaint with the competent Supervisory Authority (for Italy, Privacy Guarantor, http://www.garanteprivacy.it), if he believes that the processing of his personal data is contrary to the legislation in force .
The exercise of the rights referred to in this article may be exercised by the interested party at the following email address: news@cittadellarte.it.
11. Changes
This information is in force since 25 May 2018. The joint owners reserve the right to modify or update it also due to any changes in regulations or practices coming from the National Supervisory Authority or from the European Data Protection Committee.
12. Definitions
1) personal data: any information relating to an identified or identifiable natural person (Interested Party); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more elements characteristic of his physical identity, physiological, genetic, psychological, economic, cultural or social;
2) processing: any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organisation, structuring, conservation, l adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or destruction;
3) data controller: the natural or legal person, public authority, service or other body which, individually or together with others, determines the purposes and means of the processing of personal data; joint data controllers: when two or more data controllers jointly determine the purposes and means of the processing, they are joint data controllers;
4) Data controller: the natural or legal person, public authority, service or other body that processes personal data on behalf of the data controller;
5) recipient: the natural or legal person, public authority, service or other body that receives communication of personal data, whether it is a third party or not. However, public authorities which may receive communication of personal data in the framework of a specific inquiry in accordance with Union or Member State law shall not be considered recipients; the processing of such data by said public authorities complies with the applicable data protection rules according to the purposes of the processing;
6) third party: the natural or legal person, public authority, service or other body other than the interested party, the data controller, the data controller and the persons authorized to process personal data under the direct authority of the owner or manager;
7) consent of the interested party: any free, specific, informed and unequivocal expression of will of the interested party, with which he or she expresses his or her assent, through a declaration or unequivocal positive action, that the personal data concerning him or her be processed ;
8) personal data breach: the breach of security which accidentally or unlawfully leads to the destruction, loss, modification, unauthorized disclosure or access to personal data transmitted, stored or otherwise processed;
(9) binding corporate rules: the personal data protection policies applied by a controller or processor established in the territory of a Member State to the transfer or set of transfers of personal data to a controller or Data controller in one or more third countries, within a business group or a group of companies carrying out a common economic activity;
10) supervisory authority: the independent public authority established by a Member State pursuant to Article 51;
11) interested supervisory authority: a Supervisory Authority interested in the processing of personal data because:
the data controller or data processor is established in the territory of the Member State of that Supervisory Authority;
the data subjects residing in the Member State of the Supervisory Authority are or are likely to be substantially affected by the processing;
a complaint has been lodged with this Supervisory Authority.
12) cross-border processing:
a) processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or
(b) processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union, but which substantially affects or is likely to substantially affect data subjects in more than one Member State.
