<\/p>\n in compliance with Art. 14 of Regulation (EU) 2016\/679 governing the protection of personal data.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/header>\n 1. DATA CONTROLLER AND DATA PROTECTION OFFICER (DPO) 2. TYPE OF DATA COLLECTED AND PROCESSED 3. LEGAL BASIS FOR DATA PROCESSING 4. PURPOSE OF DATA PROCESSING 5. PERSONAL DATA END USERS OR CATEGORIES OF END USERS 6. TRANSFER OF DATA TO A THIRD COUNTRY AND\/OR INTERNATIONAL ORGANISATION 7. DURATION OF STORAGE OR CRITERIA USED TO ESTABLISH THAT DURATION 8. USER RIGHTS AND HOW TO EXERCISE THOSE RIGHTS 9. DATA PROCESSING MODALITIES 10. DATA DISSEMINATIONPrivacy cookie policy<\/h1>\n
\nThe Data Controller \u2013 as defined in Articles. 4 and 24 of Regulation (EU) 2016\/679 – \u00a0is the Opera di Santa Croce, whose registered office is situated in Piazza Santa Croce, 16, Florence (FI), Italy \u2013 VAT Reg. No. 05489970482.
\nThe Controller may be reached at the following e-mail address: privacy@santacroceopera.it.
\nThe Controller has also appointed a Data Protection Officer (DPO) \u2013 the lawyer Avv. Domenico Vispo \u2013 who may be contacted in connection with matters regarding the processing of the user\u2019s personal data at the following e-mail address: dpo@santacroceopera.it.<\/p>\n
\nThe Controller will process the following personal data:
\n– personal and contact details;
\n– data concerning educational qualifications and profession;
\n– data collected passively, in other words via the website (e.g. IP address, position, type of browser and so forth);
\n– cookies and other tracking systems, as illustrated in the cookie notice (see relevant information notice for more in-depth information).<\/p>\n
\nThe communication of personal data is a contractual obligation, or at any rate a necessary prerequisite, for completing the contract for the sale of tickets providing access to the monumental complex, and the prospective purchaser is obliged to supply his or her personal data inasmuch as without it the Controller is unable to process the purchaser\u2019s application. Despatch of the newsletter is enabled only when consent is granted by the user. Data for the website\u2019s security and for the prevention of misuse and spam, as well as data for analysing website traffic (statistics) in aggregate form, is processed on the basis of the Controller\u2019s legitimate interest in protecting both the website and its users.<\/p>\n
\nPersonal data is processed by the Controller in order to enable the user to surf the website and to use the services it provides; for the on-line sale of tickets providing access to the monumental complex of Santa Croce; and, in the event the user grants his or her specific consent, for the despatch of the Controller\u2019s newsletter. In addition to the relevant instrumental and necessary purposes associated with provision of the service, processing of the data collected from the website is required for the following purposes:
\n– Statistics (analysis): the collection of data and information, solely in an aggregate and anonymous fashion, in order to verify the website\u2019s proper functioning. None of this information is linked to the website\u2019s physical user, nor does it permit the user\u2019s identification in any form whatsoever. Prior consent is not required;
\n– Security: the collection of data and information for the purpose of protecting the website\u2019s security (anti-spam filters, firewalls, virus detection) and users\u2019 security, and to prevent or to detect fraud or misuse detrimental to the website. The data is recorded automatically and may also include personal data (IP address) which may be used, in accordance with the relevant law in force at the time, to thwart attempts to damage the website or to harm other users, or in any case for harmful or criminal activities. This data is never used on any account to identify or to profile users, and it is periodically erased. Prior consent is not required.<\/p>\n
\nData collected may be forwarded to end users, as listed in Article 28 of Regulation (EU) 2016\/679, who process the data in their capacity as external professional figures and\/or bodies acting as independent controllers. Specifically, the data may be forwarded: – to the Controller\u2019s staff and collaborators, including external collaborators, and to figures who provide services instrumental to the purposes described above. These figures will act in their capacity as supervisors or appointees tasked with processing. Personal data may also be forwarded to other public or private figures but solely in compliance with a legal measure or regulation requiring such a move.
\nData collected on the website is not generally forwarded to third parties, other than in the following specific instances \u2013 a legitimate request from the judicial authorities and in legally specified cases; – if required for the provision of a specific service requested by the user; – for the performance of website security and optimisation controls.<\/p>\n
\nData collected will not be transferred to third countries outside the European Union. Users should be aware, however, that the use of cloud services may entail the transfer of data onto servers situated abroad (whether in the EU or elsewhere) but always in compliance with the relevant legal measures and in every instance in compliance with maximum security standards.<\/p>\n
\nData collected during the functioning of the website is stored only for as long as is strictly necessary to perform the activities specified. On expiry, the data will be erased or anonymised unless there are further reasons for storing it. Data (IP address) used for website security purposes (thwarting attempts to harm the website) is stored for 30 days. Data used for analytical purposes (statistics) in stored only in aggregate form. Data processed in connection with the sale of tickets providing access to the monumental complex of Santa Croce will be stored for 10 years; and in connection with the despatch of newsletters, it will be stored for the time required to provide the service. The data is not subject to automatic processing.<\/p>\n
\nThe user may exercise his or her rights as laid down in Section III (articles 15-22) of Regulation (EU) 2016\/679 by addressing an e-mail to the Data Controller at privacy@santacroceopera.it, by registered post with reply \u2013 c\/o the address of the organisation\u2019s registered office \u2013 or by submitting a hardcopy request.
\nThe rights which the user enjoys under Regulation (EU) 2016\/679 are the following:
\n– access;
\n– rectification;
\n– erasure;
\n– withdrawal of consent;
\n– restriction of processing;
\n– opposition to processing;
\n– portability.
\nThe above rights are guaranteed at no expense to the user and require no particular formalities for their exercise, which is essentially free of charge.
\nWithout impairment or prejudice to the user\u2019s right to undertake legal action, he or she may also submit a complaint to the supervisory authority (ombudsman) as stipulated both in Regulation (EU) 2016\/679 and in the Italian Privacy Code as modified by Decree Law 101\/2018.<\/p>\n
\nPersonal data granted will be recorded, processed, managed and stored in hardcopy format and\/or with the assistance of electronic instruments, and in every circumstance in such a way as to ensure its security and confidentiality. Processing will be performed by expressly authorised in-house staff and can be peformed at any time.<\/p>\n
\nPersonal data collected will never be disseminated under any circumstances whatsoever to third parties not authorised by the Data Controller and may be shown only on demand to the legal, financial and ombudsman authorities and to any other figures with whom we are legally bound to share that data for the achievement of the aforesaid purposes.<\/p>\n<\/div>\n<\/section>\n<\/div>\n