Privacy Notice on the processing of personal data – Attending events, openings and ceremonies
This Privacy Notice concerns the processing of personal data required for attending events such as openings, ceremonies, conferences, etc. (hereinafter “the event” or “the events”), held at the premises of the Fondazione MAXXI (hereinafter also “MAXXI”) or at other venues, and is provided in accordance with Articles 13 and 14 of EU Regulation No 2016/679 (“GDPR”).
The MAXXI processes the personal data collected fairly, lawfully and transparently, respecting the interests and rights of data subjects, to the extent necessary for the purposes set out below. The processing is governed by EU Regulation No 2016/679, the so-called Privacy Code, other relevant legislation, and the Regulations on the management and protection of personal data, available here.
Data Controller
The data controller is the Fondazione MAXXI, with its registered office in Rome, Via Guido Reni, 4/A – 00196, tax code 10587971002 (email: privacy@fondazionemaxxi.it – telephone: +3906324861).
Personal data subject to processing
The personal data processed by the MAXXI consists of personal details and contact details (e.g. email address) provided for participation in events, as well as images, videos and audio recordings collected during the course of those events.
Purposes and legal basis for the processing of personal data
The purposes of processing personal data collected for participation in events organised by the Fondazione MAXXI, and the respective legal bases, are as follows:
a) event registration: personal data is processed for the organisation of the event. The provision and processing of such data is necessary for the management of the event (Article 6(1)(b) of the GDPR); failure to provide such data will mean that the service cannot be provided;
b) participation in events: personal data (e.g. images, videos, audio) collected during the course of events may be used, reproduced, disseminated and published via the MAXXI’s institutional channels, including its website and social media, in digital or multimedia form, to promote the MAXXI’s activities (Article 6(1)(f) of the GDPR);
c) newsletters and direct marketing: subject to consent, personal data may be processed for the purpose of sending commercial, promotional and advertising communications regarding the Museum’s events and initiatives (direct marketing), as well as to carry out market surveys or research (Article 6(1)(a) of the GDPR);
d) legal requirements: to establish, exercise or defend a legal claim in court in order to pursue a legitimate interest of the MAXXI. In this case, the processing is also based on Article 6(1)(c) of the GDPR.
Methods of processing
For the purposes set out above, the Data Controller will use automated means of contact (for example, email, apps, text messages, etc.) and/or traditional methods (for example, telephone calls with an operator and post). The Data Controller may process personal data in order to identify and offer communications and initiatives best suited to the needs of data subjects.
Data retention period
The data collected will be retained in the Data Controller’s digital and historical archives for the time necessary to fulfil legal or contractual obligations, or to comply with orders from the Authority, or to assert or defend a right in court. With regard to the purpose set out in point (c), the data will be retained for 24 months from the date on which the Foundation obtained the most recent consent for that purpose.
Disclosure of data to third parties
The personal data collected may be disclosed to third parties and partners for the purposes set out in this Policy (e.g. consultants, professionals, users, providers of digital creative and advertising content services), or to comply with legal obligations. The personal data processed will not be transferred abroad, unless expressly stated otherwise.
Data Subjects’ Rights, Reports and Complaints
Data subjects may exercise the rights set out in Articles 15 et seq. of EU Regulation No. 2016/679 (access, portability, rectification, restriction, erasure, objection) in accordance with the procedures laid down in the Fondazione MAXXI’s Video Surveillance Regulation, subject to the exceptions and limitations provided for by current legislation.
In any event, data subjects may lodge complaints with the Data Protection Authority by following the instructions available on the website www.garanteprivacy.it
For any queries regarding the processing of their personal data, the Data Protection Officer (DPO) may be contacted at the following address: privacy@fondazionemaxxi.it
newsletter
subscribe to our newsletter and keep up to date with what’s going on at MAXXI
myMAXXI card
for those interested in exploring the present