Information on the Magnificent Architectures Programme - Data Protection

Magnificent Architectures Programme

Information - Data Protection

Pursuant to Reg. (EU) 679/2016 (hereinafter referred to as “GDPR”) and Legislative Decree no. 196 of 30 June 2003, as amended and supplemented, the undersigned Association informs the user of the Subscription Museums APP that it will come into possession of his/her information in relation to the download and use of the application.

1. Object and Mandatory Purposes of Processing

The personal profile data processed by the Subscription Museums APP is provided directly by the data subject; other data is collected through the use of the Subscription.

This information notice is intended for users with valid Subscription Musei Piemonte Valle d'Aosta, Subscription Musei Lombardia Valle d'Aosta and Subscription Musei Formula Extra, who are entitled to register with the Abbonamento Musei APP to participate in the points collection programme.

It should be noted that the data, in general, are processed for everything that is inherent to the pre-contractual, contractual and legal obligations for the purposes of joining the AM 30eLODE programme (with reference to the legal bases set out in GDPR Art. 6 letter b, c); in this case, the provision of certain data is obligatory and therefore any refusal to provide such data may result in the impossibility to participate in the aforementioned points collection programme.

On how to collect points, how to use them, verification of points collected, duration and other detailed information, please refer to the Regulation Magnificent Architecture.

2. Further Purposes and Specific Consents

Further processing purposes, based on the legitimate interest in processing (GDPR Art. 6 lett. f) or on consent (GDPR Art. 6 lett. a) concern:

  • Using the camera: necessary whenever the service of acquiring and recognising a QR Code is activated. This permission is indispensable as, without it, it will be impossible to acquire and process the QR Code.
  • Geolocalisation of the device: must be active at the time of recognition of the QR Code, otherwise points will not be accumulated.
  • Customised communications: sending push notifications to the device, subject to receiving authorisation.
  • Internal statistics: processing of statistics and aggregated information used by Abbonamento Musei.

3. Method of Processing and Security

The data personal data are processed by manual and computerised means, with logic strictly related to the aforementioned purposes. Specific security measures are observed to prevent the loss of data, unlawful or incorrect use and access unauthorised. No personal data from the web service is disseminated.

The information collected is protected by means of encryption and authentication systems and is only accessible to authorised users or those directly concerned.

4. Disclosure of Data and Third Parties

The data collected and processed may be brought to the attention of natural or legal persons as data processors on behalf of the undersigned company and to natural persons identified by the Association itself as authorised to carry out processing operations (e.g. the Association's employees and collaborators); including the System Administrator and the loyalty programme service provider and manager.

The software platforms used to operate the APPs (Apple Store and Google Store) acquire, in the course of their normal operation, certain data referring to the user whose transmission is implicit in the use of Internet communication protocols, smartphones and devices used. Subscription Museums is not involved in such processing and cannot be considered liable for it. We therefore recommend that you also refer to the privacy policies published on the aforementioned platforms.

In addition, Abbonamento Musei may collect anonymous information for the sole purpose of collecting statistical data on the number of users who have downloaded the APP or are users of it.

5. Storage and Transfer of Data

Personal data will be retained, in general, as long as the purpose of the processing lasts, in any case no more than 24 months from the time of harvesting.

The tratttion will take place in Italy and the EU or EEA. Should the need arise to transfer data outside the EEA, safeguards in favour of the data subjects will be carefully assessed and they will receive a specific update of this notice.

6. Rights of the Data Subject

At any time you can:

  • Exercise your rights (access, rectification, erasure, limitation, portability, objection, no automated decision-making processes) when provided against the data controller, pursuant to Articles 15 to 22 GDPR.
  • Complain to the Garante (www.garanteprivacy.it).
  • Where processing is based on consent, revoke such consent given, bearing in mind that revocation of consent does not affect the lawfulness of processing based on consent before revocation.

7. Owner and Data Protection Officer

  • Data controller: Associazione Abbonamento Musei
  • Data Protection Officer (DPO): designated and can be contacted at [email protected]