Privacy Policy
Notice Regarding the Processing of Personal Data, under Articles 13 and 14 of EU Regulation 2016/679 and the Privacy Code (Legislative Decree 196/2003), as amended by Legislative Decree 101/2018.
Introduction
At Fondazione Potenza Tamini (from now on referred to as “Fondazione”), your data’s privacy and security are paramount. We collect and process your data with utmost care and attention, adopting specific technical and structural measures to ensure the security of the processing. This policy informs you about the purposes and methods of processing your data under Article 13 of the European Data Protection Regulation No. 679/2016 (from now on “EU Regulation” or “GDPR”) and the Privacy Code D. Lgs. 196/2003, as amended by D. Lgs. 101/2018 (from now on “Legislation”).
2. Data Controller
Fondazione Potenza Tamini is the data controller who processes personal data. If you have questions or requests about this processing, contact us at the following addresses.
| Corporate Name: Fondazione Potenza Tamini Registered Office Address: Dorsoduro 1450, 30123 Venice Contact Information: info@fondazionepotenzatamini.it |
3. Types of Data Processed
Browsing Data
Such data necessary for using web services are also processed to:
–obtain statistical information on service use (most visited pages, number of visitors by time slot or daily, geographical areas of origin, etc.);
– check the proper functioning of the services offered.
Data Provided by the User Voluntary sending of messages to contact addresses, private messages sent by users/visitors to social media profiles/pages (where this possibility is provided), as well as the possible compilation and forwarding of forms on our website, involve the acquisition of the sender’s contact data as well as all personal data included in the communications.
Photographs or Images of Events The data processed by the Fondazione may sometimes consist of photographic images and video recordings collected during exhibitions, conferences, museum contexts, events, and manifestations for institutional purposes, public relations, and commercial communications. These data may be processed in printed and audiovisual form through any means of dissemination, such as the Internet or social networks.
Minors’ Data We specify that during visits by families, school groups, and students to our headquarters or for the performance of educational activities, even organised by their respective institutions, in our equipped classrooms, it may be necessary to process the data of minors for accounting and reporting purposes, including fiscal.
The processing of minors’ data is lawful only with the express consent of those who exercise parental authority. In the case of visits and educational activities organised by schools or educational institutes, agreements will be made with the data controller to collect consent to data processing from parents or those entitled.
4. Purpose and Legal Basis of Processing
The table below indicates the purposes and legal bases that make the processing of the collected data lawful.
| Purpose | Legal Basis of Processing | |
| A | Contractual purposes, i.e., pursuing instrumental and complementary purposes to the request for registration to activities organized by the Fondazione (e.g., exhibitions, events, guided tours, workshops, educational activities). | Pre-contractual and contractual negotiations, (Art. 6(1)(b) GDPR). Legitimate interest (Art. 6(1)(f) GDPR). |
| B | Marketing activities, subscription to the newsletter, sending commercial communications to the data subject, including from third parties, satisfaction surveys, market research, and statistical analyses. | Consent of the data subject (Art. 6(1)(a) GDPR). |
| C | Management of payment activities. | Execution of the contract (Art. 6(1)(b) GDPR). |
| D | Profiling activities, analysis, including automated, through cookies, of your preferences and interests (e.g., use of content and services, functionalities used, connection times, traffic data, etc.) and offering personalised services, content, initiatives, and offers, including from third parties. | Consent of the data subject (Art. 6(1)(a) GDPR). |
| E | Compliance with obligations under laws, regulations, European legislation, or provisions issued by Authorities and Supervisory and Control Bodies. | Compliance with legal obligations (Art. 6(1)(c) GDPR). |
| F | Data of Minors. | Explicit consent from those exercising parental authority (Art. 6(1)(a) GDPR). |
5. Mandatory or Optional Provision of Data
The provision of data referred to in the above table is compulsory except for data collected for marketing and profiling purposes as per letters B, D, and F, whose provision is optional.
Recipients of Data
Your data will also be transmitted to third parties used by the Fondazione. These entities have been appropriately selected and provide adequate guarantees of compliance with data processing regulations. These entities have been appointed data processors under Art. 28 of the Regulation. They must carry out their activities according to the instructions given by the Fondazione and under its control.
Third parties used by the Fondazione for the correct execution of contracts and related administrative management include
financial operators, internet providers, social platforms, IT service providers, legal consultants, labour consultants, and tax consultants. Commercial partners of the Data Controller:
financial operators, social platforms, IT service providers, and marketing companies.
A specific and updated list of these entities is available at the Fondazione’s headquarters. The data subject can consult it upon request.
It is understood that your data will not be communicated to third parties for their promotional purposes and will not be disclosed in any way.
Your data may also be transmitted to the Police and Judicial and Administrative Authorities by the law for the detection and prosecution of crimes, the prevention and protection against threats to public security, as well as to allow the Fondazione to exercise or protect its rights or those of third parties before the competent authorities, and for other reasons related to the protection of the rights and freedoms of others.
7. Transfer of Data Outside the EU
Please note that some of the third parties mentioned in section 6 may be located in non-EU countries but offer an adequate level of data protection as established by specific decisions of the European Commission. The transfer of your data to third parties residing or located in non-EU countries that do not provide an adequate level of protection will be carried out only with your consent or after the conclusion of specific agreements between the Fondazione and these entities containing appropriate safeguards and guarantees for the security of your data so-called “standard contractual clauses”, also approved by the European Commission, or when the transfer is necessary for the conclusion and execution of a contract between you and the Fondazione or for the management of your requests.
8. Data Retention
We inform you that your data will be retained for a limited period, varying according to the type of processing activity, in compliance with the Fondazione’s Data Retention Policy and its specific purposes.
For example, and not exhaustively:
Data of users registered for the newsletter service will be retained and processed until the request for deletion;
Data of users processed about connected activities will be retained and processed for a period not exceeding that necessary to achieve the purposes and for a reasonable time in compliance with the data retention policy;
Data processed for profiling and analysis purposes, including automated, will be processed for a period not exceeding that necessary to achieve the purposes and by legal regulations and individual provisions of the Data Protection Authority;
Data collected for using services offered by the Fondazione, such as sending commercial communications, will be retained until the service is terminated or the User cancels the service subscription.
At the end of these periods, the Fondazione will permanently delete or, in any case, anonymise your data irreversibly.
9. Your Rights as a Data Subject
We inform you that you have the following rights regarding your data subject to this notice:
Right of Access and Rectification (Articles 15 and 16 of the EU Regulation): You have the right to access your data and to request that they be corrected, modified, or supplemented. If you wish, we will provide you with a copy of your data in our possession.
Right to data erasure (Art. 17 of the EU Regulation): in the cases provided by the current regulations, you can request the deletion of your data. Upon receipt and analysis of your request, we will ensure that the processing ceases and your data is deleted where found legitimate.
Right to restriction of processing (Art. 18 of the EU Regulation): you have the right to request the restriction of the processing of your data in cases of unlawful processing or contestation of the accuracy of personal data by the data subject.
Right to data portability (Art. 20 of the EU Regulation): you have the right to request to obtain your data from the Data Controller to transmit them to another Controller in the cases provided by the mentioned article.
Right to object (Art. 21 of the EU Regulation): you have the right to object at any time to the processing of your data carried out based on the Data Controller’s legitimate interest, explaining the reasons that justify your request; before accepting it, the Controller must evaluate the reasons for your request.
Right to complain (Art. 77 of the EU Regulation): you have the right to complain to the competent Data Protection Authority if you believe that there has been, or is ongoing, a violation of your rights concerning the processing of your data.
Right to withdraw consent (Art. 13 of the EU Regulation): To process personal data solely based on your consent, you have the right to withdraw the consent given at any time by contacting the Data Controller.
At any time, you can exercise your rights concerning the specific processing of personal data carried out by the Foundation as the Data Controller at the contact addresses indicated in point 2 of this information notice.
10. Organizational and Technical Security Measure
The Foundation adopts adequate organisational and technical security measures to safeguard the confidentiality, integrity, completeness, and availability of the data subject’s personal data.
Technical, logistical, and organisational precautions are implemented to prevent damage, accidental loss, alteration, misuse, and unauthorised access to the data processed.
The Controller regularly tests, verifies, and evaluates the effectiveness of the implemented measures to ensure continuous improvement in processing security.
In particular, to protect the personal data of the data subject, the Site uses an encryption system that ensures protection through an encryption system for information both on the access page and other sections where it is possible to provide, view, or modify one’s personal data.
The Foundation cannot be held responsible for untrue information sent directly by the user (e.g., the accuracy of the email address, credit card details, or postal address) and information about the user provided by a third party, even fraudulently.
This information notice is updated as of June 27, 2024.
