Vai al contenuto

2.1 User privacy policy - Activities

202211_MUSEesterno

PERSONAL DATA PROCESSING PRIVACY POLICY

pursuant to Articles 13 of Regulation EU 2016/679

Museum Users – Activities

Introduction
Dear user, the “European Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data”, requires the protection of natural persons and other entities in relation to the processing of personal data.

MUSE – MUSEO DELLE SCIENZE, in its capacity as “Data Controller”, wishes to inform you about the purposes and methods underlying the collection and processing of your personal data. More specifically, the following information is provided:

1 Identity and contact details of the Data Controller
The Data Controller is MUSE – MUSEO DELLE SCIENZE located in Corso del Lavoro e della Scienza, 3 – 38122 Trento.
Below are the contact details where the Data Controller may be reached:

2 Identity and contact details of the Data Protection Officer
The Data Protection Officer of MUSE – MUSEO DELLE SCIENZE is QSA S.r.l. – ENGINEERING CONSULTING TRAINING, having its registered office in via alla Marcialonga, 3 – 38030 Ziano di Fiemme (Trento).
Below are the contact details where the Data Protection Officer may be reached:

3 Purposes of processing and legal basis
Personal data may be collected and processed for the following purposes:

(a) Conduct of museum activities.
Your personal data will be processed to (i) carry out preliminary and subsequent activities to the purchase and use of a service provided by Muse, such activities consisting of routine discharge of the related duties as well as organisational tasks pertaining to the service (e.g. managing bookings for museum activities, billing, handling payments), including dealing with any litigation, (ii) send communications strictly related to the performance of the respective contractual obligations, which will also be sent in the form of a newsletter (and/or via the WhatsApp application, in the case of subscription to the instant messaging information service), where the service requires constant updates on the activities related to it, and therefore (iii) ensure the progressive management of the services covered by the contract. Your data may also be used by us in aggregate form for statistical and institutional purposes.
To unsubscribe from the instant messaging information service, simply send a message with the text “stop news” using the WhatsApp chat dedicated to the service.
In some specific cases, health-related data may also be collected and thus processed (e.g. food intolerances and allergies, which are handled for the sole purpose of preparing any refreshment service).

(b) Fulfilment of legal obligations.
Your personal data will be processed for the fulfilment of legal obligations laid down by EU regulations, national laws, or other regulatory sources.
More specifically, MUSE – MUSEO DELLE SCIENZE may process your data for the fulfilment of accounting and tax obligations.

While providing your data for the purposes under (a) and (b) above is optional, failure to do so will prevent you from accessing the services offered by the Museum.

The legal basis that makes processing lawful will, with respect to the purposes described above, be deemed to exist in order to perform the contract to which the Data Subject is a party and take pre-contractual steps at his or her request (Article 6(1)(b) GDPR); comply with legal obligations the Data Controller is required to abide by (Article 6(1)(c) GDPR); and perform a duty of public interest (Article 6(1)(e) and (Article 9(2)(g) GDPR), such interest being identified in the purpose of providing information, establishing a dialogue and inspiring on the subjects of nature, science and sustainable future, which duty MUSE – Museo delle Scienze is required to discharge under Article 2 of Decree of Provincial Board President No. 4 - 62/Leg dated March 2011.

(c) Image collection through video surveillance systems.
With reference to the installation of video surveillance systems located in areas inside and outside the Museum, the purpose of the processing relates to the protection of the Museum’s property and assets in accordance with the Data Controller’s legitimate interest pertaining to the protection of persons and property against possible aggression, theft, robbery, damage, vandalism, fire prevention, work safety, etc.

The legal basis that makes processing lawful will, with respect to the purpose described above, be deemed to exist in order that the legitimate interest of the data controller may be pursued (Article 6(1)(f) GDPR).

(d) Preparation of multimedia educational and promotional material.
In connection with the use of the services offered by the Museum, your personal data may be collected and processed in photographic, audio and video format to provide documentary evidence of the activities or events staged by the Museum, and to prepare publications, videos and multimedia material to be used as a promotional and dissemination tool.
With respect to the purposes under (c) and (d) above, the provision of data is optional and failure to do so will not prevent you in any way from using the services offered by the Museum.
The legal basis warranting processing lies in the performance of a duty of public interest (Article 6(1)(e) GDPR), such interest being the purpose of informing, establishing a dialogue and inspiring on issues of nature, science and sustainable future, which duty MUSE is required to discharge under Article 2 of Decree of Provincial Board President 4 – 62/Leg, as well as in the CONSENT given by the data subject (Article 6(1)(a) GDPR).
SUCH CONSENT IS GIVEN:

  • voluntarily by the data subject concerned to participate in an event or activity, during which a photographic or video recording service is arranged. These events will be clearly identified with appropriate information;
  • In all other cases: by filling in the appropriate application form and/or the audio/video filming waiver form.

4 Processing methods
In relation to the aforesaid purposes, your personal data will be processed using manual, electronic and/or computer telecommunications tools, in strict accordance with the aforesaid purposes and, in any event, in such a way as to guarantee the security and confidentiality of your data in compliance with the aforesaid Regulation.
No automated decision-making processes will be used, including profiling.

5 Third parties to whom the data may be disclosed.
MUSE – MUSEO DELLE SCIENZE may disclose your personal data to the following entities:

  • Entities engaging in broadcasting, mailing, transporting and delivering communications;
  • Firms and companies in the context of professional assistance and consultancy relations;
  • Public authorities, if conditions are met;
  • Credit institutions or banks for the payment of fees due;
  • Insurance and legal institutions;
  • Technicians to maintain and manage the IT infrastructure system and the video surveillance system;
  • Contractors involved in the management of services offered by the Museum;
  • In special cases, processing may include the exchange of photos and videos with other institutions, bodies or services twinned as part of special agreements entered into or joint projects.

The entities mentioned above operate, in some cases, entirely on their own as separate Data Controllers; in other cases, they act as Data Processors and are, as such, specifically appointed by the Data Controller in accordance with Article 28 GDPR.
You may request a list of the Data Processors using the contact details of the Data Controller provided under 1 above.

Data will not be disseminated, with the exception of data collected and processed in photographic, audio and video format, for the purpose of documenting activities or events organised by the Museum, which may – in accordance with Law 150/2000 – be disclosed on the institutional website, as well as through social network channels and other means of communication.

6 Duration of processing and retention period.
Your data will be processed only for the time necessary to pursue the above purposes.

More specifically, below are the main periods of use and retention of your personal data with reference to the different processing purposes:

  • Data processed for the conduct of museum activities: Time limits set out in respect of the mandatory record retention period established by the Provincial Authorities of Trento
  • Data processed for the fulfilment of legal obligations: Retention as per statutory time limits
  • Data processed through video surveillance systems: 72 hours following detection, except in cases of extension as per Privacy Authority Order dated 8 April 2010
  • Preparation of educational and promotional material: Time limits set out in respect of the mandatory record retention period established by the Provincial Authorities of Trento.

7 Transfer of data outside the European Union
Data collected will not be transferred to non-European countries.

8 Rights of the data subject
In your capacity as a data subject, you may exercise the rights set forth in Articles 15 et seq. of the GDPR as shown below:
Rights of access, rectification, amendment and erasure of data, portability, limitation of processing and withdrawal of consent given.
(a) According to Regulation EU 2016/679 you have the right to obtain from the Data Controller access to your data and rectification, amendment or erasure of such data. Within 30 days of submitting your request, you will receive a written reply, including by electronic means.
(b) You also have the right to object to the processing or request limitation of such processing, for legitimate reasons and in the cases as under Articles 18 and 21 of Regulation EU 2016/679.
(c) You may withdraw at any time your consent to the processing of your data given for the purposes stated herein.
(d) Finally, you may exercise your right to data portability, requesting the Data Controller to transmit your data to another data controller.
You may exercise the aforesaid rights by using any of the Data Controller’s contact details provided under 1 above.

Right to lodge a complaint with the Supervisory Authority.
If you believe that your data have been processed unlawfully or in breach of applicable law provisions, you will be entitled to lodge a complaint with the Supervisory Authority.