Information pursuant to art. 13 of the European regulation n. 2016/679 (General Data Protection Regulation)
1. Data Controller
The Data Controller is the Fondazione Teatro Comunale Città di Vicenza, in the person of the pro tempore legal representative, (VAT number 03411540242) with registered offices in Vicenza, viale Mazzini 39,www.tcvi.it, hereinafter "the Owner"
The Data Controller intends to provide you with complete information on the purposes and methods of processing your personal data.
2. Methods of processing personal data
Personal data (e.g. personal data, telephone number, email, etc.) are processed on computer media or, in any case, with the aid of computerized or automated instruments in compliance with minimum-security measures and, in any case, in order to guarantee the integrity, security and confidentiality of the data.
3. Purpose of the processing
The Data Controller will process your personal data for the following purposes:
- performance of contractual and pre-contractual activities
- compliance with tax or legal obligations
- sending promotional information relating to cultural activities, commercial or commercial information of the Data Controller.
Your personal data will also be processed exclusively for purposes strictly connected and instrumental to the fulfillment of the obligations inherent to the aforementioned points.
Your consent expressed is the legal basis of the processing pursuant to art. 13, paragraph 1), letter c) of the GDPR.
Personal data (consisting, by way of example, in e.g. personal data, email, landline and mobile number, e-mail address, etc.) are collected directly from you or from third parties, for example, in the event that the Data Controller intends to carry out activities such as sending promotional information relating to cultural activities, commercial or commercial information of the Data Controller by acquiring data from external sources.
The data controller also uses your personal data collected from other data controllers (in the latter case after verification of compliance with the conditions of lawfulness by third parties) or public sources (for example the Chamber of Commerce) in compliance with the regulations of reference.
We also work closely with third parties (including, but not limited to, business partners, technical service sub-providers, associations, municipalities, consortia, organizations, research information providers, public agencies, etc.) and we may receive information about you from these parties.
5. Provision of Personal Data
The provision of your data for the purposes referred to in points 1) and 2) of article 3 does not require any formal consent as it is preparatory and essential to any contractual or pre-contractual relationship.
The provision of your data for the purposes referred to in point 3) of art. 3 is optional and requires your express consent. Failure to give consent will only entail the consequences described below: the impossibility of sending promotional information relating to the cultural and commercial activities of the Data Controller.
In any case, if you have given the express consent to authorize the Owner to pursue the purposes referred to in point 3) of the art. 3, you will, in any case, remain free to revoke it by sending a clear communication to that effect via e-mail to email@example.com. Following the receipt of this opt-out request, the Data Controller will promptly remove and delete data from the databases used for processing and inform, for the same purposes of cancellation, any third parties to whom the data have been communicated. The mere receipt of a cancellation request will automatically be validated as a confirmation of cancellation.
6. Recipients or category of recipients of personal data
The personal data you have provided, for the purposes described above, may be brought to the attention of employees and/or collaborators of the Data Controller and communicated to the following subjects:
- a) Andrea Palladio International Center for Architectural Studies, co-owner of data;
- b) third-party companies that may be appointed by the Data Controller to carry out the obligations assumed by the latter for the implementation of the treatments provided for by the purposes referred to in points 1) and 2) of article 3;
- to all those parties (including public authorities) with access to personal data under legislative or administrative provisions;
- d) third party companies that provide essential support services to the processing and have direct or indirect access to your data;
- e) third party companies appointed by the Data Controller for the processing of data required by the purposes referred to in point 3) of article 3;
All the collaborators or suppliers used by the Data Controller for the processing of your personal data have been appropriately and legally authorized and are responsible for the methods and the purposes of the treatments assigned to them and will act in compliance with and in accordance with this information.
The personal data you have provided, for the purposes described above, may be transferred to commercial partners for the processing of data required by the purposes referred to in point 3) of article 3;
The personal data provided by you and subsequently processed in connection with the management of the service are not subject to disclosure.
For the subjects indicated in points b) d) and e) only the category of recipients is indicated, as they are subject to frequent updates and revisions. Therefore, you may request the updated list of recipients by contacting the Data Controller through the channels indicated in art. 1 of this statement.
7. Data retention times
Your personal data will be stored for the times defined by the relevant legislation, which are specified below pursuant to art. 13, paragraph 2, letter a) GDPR:
- for the purposes indicated in points 1), 2) of article 3 for the time prescribed by the laws in force and in any case for a period of not less than 10 (ten) years
- for the purposes indicated in point 3) of art. 3 for 3 (three) years from the time the consent to treatment is issued;
8. Exercise of rights by the interested party
Pursuant to articles 13, paragraph 2, letters b) and d), 15, 18, 19 and 21 GDPR informs you that you have the right to:
- a. Access your personal data: obtain confirmation or not that data is being processed concerning you and, in this case, access to the following information: the purposes, the categories of data, the recipients, the storage period, the right to lodge a complaint with a supervisory authority, the right to request the rectification or cancellation or limitation of the processing or opposition to the processing itself as well as the existence of an automated decision-making process;
- b. Request for rectification or cancellation of the same or limitation of the treatments that concern you; "limitation" means the marking of the data stored with the aim of limiting its processing in the future;
- c. Opposition to processing: oppose for reasons connected to your particular situation to the processing of data for the execution of a task of public interest or for the pursuit of a legitimate interest of the Data Controller;
- d. Data portability: in the case of automated processing carried out on the basis of consent or in execution of a contract, to receive the data concerning you in a structured format, commonly used and readable by an automatic device; in particular, the data will be provided to you by the Data Controller in .xml format;
- e. Withdrawal of consent for processing for marketing purposes, both direct and indirect, market research and profiling; the exercise of this right does not in any way prejudice the lawfulness of the processing carried out before the revocation;
- f. Propose a complaint pursuant to art. 77 RGPD to the competent supervisory authority based on your habitual residence, place of work or place of violation of your rights; for Italy, the Guarantor for the protection of personal data is competent, and can be contacted via the contact details indicated on the website http://www.garanteprivacy.it.
The aforementioned rights may be exercised by sending a specific request to the Data Controller through the contact channels indicated in art. 1 of this statement.
Requests relating to the exercise of the user's rights will be processed without undue delay and, in any case, within one month of the request; only in cases of particular complexity and according to the number of requests may this period be extended by a further 2 (two) months.
We will inform specifically and separately, as required by the art. 21 GDPR that if your personal data is processed for marketing purposes, you have the right to object at any time and that if you object to the processing, your personal data can no longer be processed for these purposes.
The exercise of your rights is not subject to any form of constraint and is free of charge. The e-mail address for exercising the rights is firstname.lastname@example.org