<\/p>\n
The EU Regulation 2016\/679 \u201cGeneral Data Protection Regulation\u201d (GDPR) establishes the right to the protection of natural persons with regard to the processing of personal data.<\/p>\n
Personal data means any information relating to an identified or identifiable natural person (\u201cdata subject\u201d); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.<\/p>\n
Pursuant to this Regulation, the processing of your personal data shall be carried out in compliance with the principles set out in Article 5 of the GDPR, namely lawfulness, fairness and transparency.<\/p>\n
Personal data will be:
\n\u2022 collected for specified, explicit and legitimate purposes (see section 2);
\n\u2022 adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
\n\u2022 kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;
\n\u2022 processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.<\/p>\n
Furthermore, all reasonable steps shall be taken to ensure that personal data that are inaccurate are rectified or erased without delay. 1.1 DATA PROTECTION OFFICER (DPO)<\/strong> a) Performance of a contract and management of orders<\/strong>, in particular to:<\/p>\n \u2022 execute the service contract and enable event organizers to issue entry tickets; b) Administrative and accounting purposes<\/strong>, including the possible electronic transmission of invoices. \u2022 Article 6(1)(b)<\/strong> of the GDPR, for purposes under points 2(a) and 2(b), as processing is necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract; \u2022 identification data (name, surname, date of birth, nationality, gender, fiscal code, VAT number); Your data will be processed using both paper-based and electronic tools. Your personal data will be retained only for as long as necessary to ensure proper service delivery and to comply with legal and contractual obligations.<\/p>\n For marketing purposes, in the absence of specific legal provisions defining retention periods, FME will retain data for a period deemed appropriate based on the data subject\u2019s expressed interest. In any case, FME will verify, at least every five years, the continued interest of the data subject and will take appropriate steps to avoid indefinite storage.<\/p>\n Once these periods have expired, your data will be deleted and rights such as access, rectification, deletion or portability can no longer be exercised. Providing your data for the purposes described under points 2(a) and 2(b) is optional, but failure to do so will prevent the provision of services or fulfilment of contractual obligations.<\/p>\n Providing your data for the purposes described under points 2(c) and 2(d) is optional; refusal will not affect any contractual relationship. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.<\/p>\n Each communication related to purposes under points 2(e), 2(f) and 2(g) will always include an option to object to the processing (opt-out) free of charge. Your personal data may be shared with:<\/p>\n \u2022 companies and\/or professionals providing marketing consultancy services on behalf of the Controller (upon your consent);<\/p>\n \u2022 third parties acting as Data Processors<\/strong> under Article 28 of the Regulation, such as IT or logistics service providers, ticketing systems, call centres, security or reception services, accounting and management providers, event organisers, and suppliers of purchased or booked goods or services. An updated list of Data Processors is available upon request.<\/p>\n \u2022 public authorities or entities entitled to access data by virtue of legal or administrative provisions.<\/p>\n Personal data will not be disseminated. In the event of a breach of the above by a minor, the service provider cannot be held responsible for any direct or indirect damages arising therefrom. \u2022 obtain confirmation as to whether personal data concerning you are being processed and, if so, access such data; For purposes under points 2(c) and 2(d), you may withdraw consent at any time without affecting the lawfulness of prior processing.<\/p>\n Requests should be addressed to the Data Controller at the contact details provided in Section 1.
\n________________________________________
\nPURPOSE OF THIS NOTICE
\n<\/strong>
\nPursuant to EU Regulation 2016\/679 (hereinafter, the \u201cRegulation\u201d), this page describes the processing of personal data of users who use the online ticketing service provided on behalf of the Museo Egizio through the website www.museitorino.it.
\nThe following information is provided to you, as a Data Subject, regarding the processing of your personal data.
\n________________________________________
\n1. DATA CONTROLLER
\n<\/strong>
\nThe Data Controller is:
\nFondazione Museo delle Antichit\u00e0 Egizie di Torino<\/strong>
\n(hereinafter, \u201cFME\u201d or \u201cthe Organizer\u201d)
\nRegistered office: Via Accademia delle Scienze 6, IT-10123 Turin, Italy
\nEmail: privacy@museoegizio.it<\/p>\n
\nThe Data Protection Officer (DPO) can be contacted at:
\nFondazione Museo delle Antichit\u00e0 Egizie di Torino,
\nVia Accademia delle Scienze 6, IT-10123 Turin (TO), Italy
\nEmail: dpo@museoegizio.it
\n________________________________________
\n2. PURPOSES OF DATA PROCESSING
\n<\/strong>
\nYour personal data will be processed for the following purposes:<\/p>\n
\n\u2022 manage bookings of goods and services and ensure delivery of purchased items;
\n\u2022 comply with all contractual and legal obligations, particularly those of fiscal and public safety nature.<\/p>\n
\nc) Subscription to the newsletter service<\/strong>, limited to the use of your email and\/or postal address.
\nd) Marketing purposes<\/strong>, limited to the use of your email and\/or postal address.
\ne) Fundraising activities<\/strong> carried out by FME for the enhancement, promotion, management and development of the Museo Egizio, its cultural assets and activities.
\nf) Visitor satisfaction surveys<\/strong>, to assess service quality and improve museum offerings.
\ng) Information and promotional communications<\/strong> concerning products or services similar to those already purchased.
\n________________________________________
\n3. LEGAL BASIS FOR PROCESSING
\n<\/strong>
\nThe processing of your personal data is based on:<\/p>\n
\n\u2022 Article 6(1)(a)<\/strong> of the GDPR, for purposes under points 2(c) and 2(d), based on your explicit consent;
\n\u2022 Article 6(1)(f)<\/strong> of the GDPR, for purposes under points 2(e), 2(f) and 2(g), as the processing is necessary for the legitimate interests pursued by the Controller in line with its institutional aims.
\n________________________________________
\n4. CATEGORIES OF PERSONAL DATA PROCESSED
\n<\/strong>
\nTo achieve the above purposes, the following personal data may be processed:<\/p>\n
\n\u2022 contact details (email address, phone number, postal address);
\n\u2022 payment information (credit card details).
\n________________________________________
\n5. METHODS OF PROCESSING<\/strong><\/p>\n
\nProcessing will be carried out exclusively by the Controller and\/or by persons duly authorised by it.
\n________________________________________
\n6. DATA RETENTION PERIOD<\/strong><\/p>\n
\n________________________________________
\n7. NATURE OF DATA PROVISION<\/strong><\/p>\n
\n________________________________________
\n8. CATEGORIES OF RECIPIENTS<\/strong><\/p>\n
\n________________________________________
\n9. MINORS UNDER 14 YEARS OF AGE
\n<\/strong>
\nThe online ticketing service is not intended for users under 14 years of age.
\nUsers under 14 are requested not to provide personal data without prior authorisation from a parent or legal guardian.
\nIf it comes to light that data has been provided by a person under 14, it will be immediately deleted, and access to the service may be restricted.<\/p>\n
\n________________________________________
\n10. RIGHTS OF THE DATA SUBJECT
\n<\/strong>
\nAs a Data Subject, you may exercise your rights under Articles 15\u201322 of the GDPR, including the right to:<\/p>\n
\n\u2022 obtain information about the purposes of processing, categories of data concerned, recipients, and storage periods;
\n\u2022 request rectification or erasure of data;
\n\u2022 request restriction of processing;
\n\u2022 object to processing at any time;
\n\u2022 exercise the right to data portability.<\/p>\n
\n________________________________________
\n11. RIGHT TO LODGE A COMPLAINT
\n<\/strong>
\nIf you believe that your personal data have been processed in violation of the Regulation, you have the right to lodge a complaint with the competent Supervisory Authority, pursuant to Article 77 of the GDPR, or to seek judicial remedy pursuant to Article 79.<\/p>\n