Personal data processing policy
pursuant to Art. 13 and Art. 14, Regulation EU 2016/679.
(GDPR General data protection regulation)
In compliance with standards protecting personal data and processing thereof, with particular reference to Regulation EU 2016/679 (hereafter GDPR), the Fondazione Teatro Regio di Parma, in its capacity as data controller, is providing the following information regarding registration with Teatro Regio di Parma through the website www.teatroregioparma.it:
- Collection method
1.1. through online registration form at teatroregioparma.it
Data entered online by the user, when registering directly. The user is therefore responsible for the reliability, correctness and non-obsolescence of the personal data provided.
1.2. through a paper registration form
The data entered by the user on the paper form prepared and provided by Teatro Regio di Parma, who then directly and promptly enters the information received in their digital registers. The end user is responsible for the reliability and correctness of the personal data entered on the form.
- Nature of personal data
2.1. Data required:
– first and last name
data concerning personal life
– city, province, country
– date of birth
– email address
– interests (opera, music, dance, educational)
2.2. Processing activities shall be limited to strictly relevant personal data used for the purposes set forth in art. 3.
No processing is carried out on special categories of personal data, as defined and construed by regulation 2016/679: “Special categories of personal data are those revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a person’s sex life or sexual orientation”.
- Purpose of processing
3.1 The collection and processing of the personal data listed in paragraph 2 are carried out for the purpose of sending information and promotional offers on the activities and projects of Teatro Regio di Parma using paper or computer-based systems.
- Nature of data provision and consequences of refusal
4.1 The provision of data is optional. However, it is indispensable in order for the user to receive newsletters, information, special offers and promotions.
- 5. Processing method
5.1. Personal data processing is carried out either manually or with the use of computerized systems. Your data will be stored in paper and electronic files, including for the purpose of enabling identification and selection in aggregated form.
5.2. Processing logics are strictly correlated to the above mentioned purposes and processing is carried out in compliance with the provisions of current regulations on personal data protection. Therefore, processing activities shall accord with the principles of lawfulness, fairness, transparency, minimization, accuracy, integrity, confidentiality and limitation of storage, set forth by art. 6 GDPR.
5.3. The personal data provided by the data subject shall be stored for the period needed to carry out the above mentioned purposes and shall be protected by technical and organizational measures designed to guarantee an adequate level of security from risks of various likelihood and seriousness for the rights and freedom of the data subjects. The data controller undertakes to implement all the technical and organizational measures required to prevent alteration, erasure, destruction, unauthorized access or processing without consent or for purposes other than those stated for the collection of personal data.
5.4. Data shall be processed directly by the data controller, as further specified by art. 6, or by third parties, service providers entrusted with such responsibility by the controller.
5.5. The data controller shall not transfer the personal data provided by the data subject to countries outside the European Union: processing shall be carried out exclusively in the European Union.
5.6. Processing activities are not supported by automated decision-making processes, including profiling, that have legal effects on the data subject.
- Duration of processing
6.1. The personal data provided by the data subjects shall be processed by the data controller for the period of time needed for the associated purposes. After processing is completed, the data controller shall send a notice to verify whether the data subject intends to extend processing and update his or her personal data. If a response is not received from the data subject, processing shall be stopped and all the information acquired by the data controller shall be permanently erased.
7.Persons authorized to process your personal data
7.1. The persons in the organization of the data controller who may access your personal data, within the limits of and in accordance with the methods pertaining to their duties and only for the purposes set forth in art. 3, shall be those who have been authorized for processing (External Data Processing Officer), adequately trained and committed to confidentiality.
- Movement and disclosure of data
8.1. Your personal data shall under no circumstances be disclosed to third companies, bodies or professionals except when required for the purposes set forth herein.
- Name and contact details of the data controller
9.1. Fondazione Teatro Regio di Parma, with head offices in Parma, Strada Garibaldi 16/a, PEC firstname.lastname@example.org
- Rights of data subjects
10.1. Current regulations on personal data protection give the data subject the possibility of exercising specific rights in respect of such data.
10.2. The data subject shall have the right to obtain confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, to obtain access to the personal data and to the following information: purpose of processing; categories of personal data involved; recipients or categories of recipients to whom the personal data have been or will be disclosed (in particular recipients in third countries or international organizations); where the personal data are not collected from the data subject, any available information as to their source; the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
10.3. The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
10.4. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data, except where it is necessary for exercising the right of freedom of expression and information; for compliance with a legal obligation that requires processing; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, in so far as the erasure of the data is likely to render impossible or seriously impair the achievement of the objectives of that processing; for the establishment, exercise or defence of legal claims.
10.5. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use; the controller no longer needs the data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; the data subject has objected to processing, pending the verification whether the legitimate grounds of the controller override those of the data subject.
10.6. The data subject shall have the right to receive the personal data concerning him or her, in a structured, commonly used and machine-readable format, and shall have the right to transmit those data to another data controller. If technically possible, the data subject shall have the right to have the personal data transmitted directly from one data controller to the other.
10.7. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data processed to pursue a legitimate interest of the data controller, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
10.8. The data subject has the right to lodge a complaint with the Data Protection Authority in accordance with the procedures set forth by said authority.