PRIVACY POLICY UNDER REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT ON DATA PROCESSING (HEREINAFTER, “GDPR”).

DATA CONTROLLER:
Carmelite Museum in Mesagne. – Piazzale San Michele Arcangelo, 3 – 72023 Mesagne (BR) – VAT No. – Tel. XXXX – XXX@XXX
Website to which this privacy policy refers: https://museocarmelitanimesagne.it/ (Site).

PROCESSING OF PERSONAL DATA
In accordance with European Regulation 2016/679 on the protection of personal data, the Carmelite Museum ensures compliance with the discipline on the protection of personal data, which will be used exclusively for carrying out activities in relation to the Customer and will not be disclosed to third parties.

TYPES OF DATA PROCESSED
We will process data such as: – Name, Surname, Phone, Email.

PURPOSE OF PROCESSING AND LEGAL BASIS
The data are acquired from the Data Subject and are freely provided by you. The personal data provided with these forms will be processed, mainly using electronic and telematic means, for the execution of the service requested by you. The provision of data in fields marked with “*” is mandatory, and their non-insertion does not allow the completion of the communication. On the other hand, the release of data in fields not marked with an asterisk, while potentially useful for facilitating relations, is optional, and their non-indication does not prejudice the completion of the communication procedure. The legal basis for processing is identified in consent (Art. 6, para. 1, lett. a) of Regulation (EU) 2016/679), which can be revoked at any time without prejudice to the lawfulness of the processing based on the consent given before the revocation.

DATA PROCESSING METHODS
Personal data are processed with automated tools for the time strictly necessary to achieve the purposes for which they are collected, in compliance with the principles of lawfulness, purpose limitation, and data minimization, pursuant to Art. 5 of the GDPR, and in compliance with the mandatory times prescribed by law. Specific security measures are observed to prevent data loss, unlawful or incorrect use, and unauthorized access.

TYPES OF PROCESSED DATA
Navigation data
The computer systems and software procedures used to operate this site acquire, during their normal operation, some personal data, the transmission of which is implicit in the use of Internet communication protocols. This category of data includes IP addresses or domain names of the computers and terminals used by users, URI/URL (Uniform Resource Identifier/Locator) addresses of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), and other parameters related to the user’s operating system and computer environment. This data, necessary for the use of web services, is also processed for the purpose of obtaining statistical information on the use of services (most visited pages, number of visitors by time or day, geographical areas of origin, etc.) and checking the proper functioning of the services offered. Navigation data does not persist for more than seven days and is deleted immediately after aggregation (except for any needs for investigating crimes by the judicial authorities).

Data communicated by the user
The optional, explicit, and voluntary sending of messages to the contact addresses, as well as the filling out and sending of contact forms on the Carmelite Museum’s website to access services, involve the acquisition of the sender’s identification and contact data, necessary to respond to the service requests, as well as all personal data included in the communications.

DATA SUBJECT RIGHTS
As a data subject within the meaning of Articles 15 to 22 of the Regulation, you have the right to exercise the following rights:

Right of access: You may request confirmation of whether or not your personal data is being processed and, if so, access to such data and specific information about the processing, such as, for example, the purposes, categories of data processed, the existence of other rights as indicated below. You may also request a copy of your data.

Right to rectification: You have the right to request and obtain the rectification of your personal data and/or the integration of incomplete personal data.

Right to erasure: You may obtain the erasure of your data without undue delay if (i) such data are no longer necessary for the purposes for which they were collected, (ii) you have revoked your consent, which constituted the basis for the processing (unless there is another legal basis for such processing), (iii) you object to the processing of your data (as indicated below) and there is no other prevailing legitimate reason for the processing, or if you object to the processing of your data for marketing purposes, (iv) your data are processed unlawfully, (v) your data must be erased due to a legal obligation. Please note that this right does not apply if the processing of data is necessary, among other things, for compliance with a legal obligation and for the establishment, exercise, or defense of a right in court.

Right to restriction: You have the right to obtain the restriction of processing in case of: – dispute of the accuracy of the personal data concerning you within the period necessary for the Data Controller (Company) to verify the accuracy of this data; – unlawful processing and your request for restriction of use instead of deletion; – your need for the data for the establishment, exercise, or defense of a right in court; – your objection to the processing, as indicated below, pending verification of the prevalence of legitimate reasons on the part of the data controller.

Right to data portability: You have the right to receive your personal data concerning you in a structured, commonly used, and machine-readable format and to transmit them to another data controller in the cases where the processing of your data is based on consent, or concerns particular categories of personal data processed based on your consent, or the processing is based on the execution of a contract and such processing is carried out by automated means. You also have the right to obtain direct transmission of data from one data controller to another, where technically feasible. The possibility of obtaining the erasure of data, as indicated above, remains unaffected.

Right to object: You have the right to object at any time to processing based on the legitimate interest of the data controller, unless the data controller demonstrates compelling legitimate grounds for processing that prevail over your interests, rights, and freedoms, or for the establishment, exercise, or defense of a right in court.

The above rights may be exercised with a request addressed without formalities to the Data Controller by letter or email to the addresses indicated above in section 1.

Right to lodge a complaint: Furthermore, you have the right under Art. 77 of the Regulation to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it).