Privacy Notice on the processing of personal data – Video surveillance system
This Privacy Notice concerns the processing of personal data carried out through the use of the video surveillance system in operation at the premises of the Fondazione MAXXI (hereinafter also referred to as ‘MAXXI’), and is provided in accordance with Articles 13 and 14 of EU Regulation No 2016/679 (“GDPR”), Article 3.1 of the Decision of the Italian Data Protection Authority of 8 April 2010, and Guidelines 3/2019 on the processing of personal data through video devices, adopted on 29 January 2020 by the European Data Protection Board (“EDPB”).
MAXXI processes your personal data fairly, lawfully and transparently, respecting your interests and rights, to the extent necessary for the purposes set out below. The processing is governed by European Regulation No. 2016/679 and by the MAXXI Video Surveillance Regulation (also referred to as the “Internal Regulation”), available here.
Data Controller
The data controller is the Fondazione MAXXI , with its registered office in Rome, Via Guido Reni, 4/A – 00196, tax code 10587971002 (email: privacy@fondazionemaxxi.it – telephone: +3906324861).
Personal data subject to processing
The personal data processed by the MAXXI consists of images captured by the video surveillance system that depict an identified or identifiable natural person (data subject).
Purposes and legal basis for the processing of personal data
The purposes of processing personal data collected via the video surveillance system and the respective legal bases are as follows:
a) safeguarding the safety of users and the MAXXI’s staff: the personal data collected is processed to fulfil a legitimate interest of the data controller (Article 6(1)(f) of the GDPR);
b) safeguarding the integrity of the collection, assets and company property: the personal data collected is processed to fulfil a legitimate interest of the data controller (Article 6(1)(f) of the GDPR);
c) legal requirements: the personal data collected is, in any event, necessary for the purposes of preventing, investigating and prosecuting criminal offences, public safety, and for the exercise of the data controller’s or third parties’ right of defence in any court of law. In this case, the processing is also based on Article 6(1)(c) of the GDPR.
The processing is necessary for the purposes of public interest pursued by the Data Controller. If the data is not provided, the Data Controller will not be able to grant access to the areas belonging to the Fondazione MAXXI.
Methods of processing
All CCTV cameras in use at the Fondazione MAXXI’s premises serve the same purpose and are managed by a single Data Controller.
The cameras are positioned within the MAXXI’s premises, at access points, and along the perimeter of these areas, to limit the field of view to the monitored area.
The images captured by the CCTV system will not be subject to profiling.
The CCTV system operates 24 hours a day, 7 days a week, 365 days a year.
Areas under CCTV surveillance are indicated by specific signs at their entrances.
The specific procedures for processing and accessing the images are governed by the MAXXI’s CCTV Regulation.
Data retention period
The images captured by the cameras are recorded and retained for 96 hours (4 days). Thereafter, the images are automatically deleted by being overwritten. Retention for longer periods is governed by the Internal Regulation.
The data subject may at any time request the erasure of data concerning them under the conditions set out in Article 17 of the GDPR and the Internal Regulation.
Disclosure of data to third parties
The personal data collected may be disclosed to third parties for the purposes set out in this Notice or to comply with legal obligations. The personal data processed will not be transferred abroad.
Data Subjects’ Rights, Reports and Complaints
Data subjects may exercise the rights recognised under Articles 15 et seq. of EU Regulation No. 2016/679 (access, portability, rectification, restriction, erasure, objection) in accordance with the procedures set out in the MAXXI’s Video Surveillance Regulation, subject to the exceptions and limitations provided for by current legislation.
Data subjects may lodge complaints with the Data Protection Authority by following the instructions available on the website www.garanteprivacy.it
For any queries regarding the processing of their personal data, the Data Protection Officer (DPO) may be contacted at the following address: privacy@fondazionemaxxi.it
Last updated 10 July 2026
newsletter
subscribe to our newsletter and keep up to date with what’s going on at MAXXI
myMAXXI card
for those interested in exploring the present