Privacy Policy – Institutional contacts
Privacy policy notice in accordance with articles 13 and 14 of the GDPR (EU) 2016/679
WHAT IS THIS INFORMATION FOR?
This page describes the methods used to process your personal data.It is a privacy policy notice supplied in accordance with art. 13 of the GDPR (EU) 2016/679 (hereafter referred to as the "GDPR"). In the case of purchases intended as gifts, the privacy notice is also supplied in accordance with art. 14 of the GDPR.
1. WHO ARE THE JOINT DATA CONTROLLERS? HOW CAN I CONTACT THEM?
When two or more Data Controllers jointly determine the purposes and means of the processing, they are defined as Joint Controllers in accordance with art. 26 of the GDPR. For the purposes of this privacy notice, the following companies are the Joint Controllers:
FONDAZIONE LA TRIENNALE DI MILANO, with registered office in Viale Alemagna 6, 20121, Milan (MI) – Italy, represented by the President and legal representative pro tempore, Tel. +39 02 72434205, e-mail privacy@triennale.org.
TRIENNALE DI MILANO SERVIZI SRL SINGLE MEMBER PRIVATE LIMITED COMPANY with registered office in Viale Alemagna 6, 20121, Milan (MI) Italy, represented by their legal representative pro tempore, Tel. 02 72434216, e-mail privacy@triennale.org.
FONDAZIONE CRT TEATRO DELL’ARTE with registered office in Viale Alemagna 6, 20121, Milan (MI) Italy, represented by their legal representative pro tempore, Tel. 02 72434216, e-mail privacy@triennale.org.
In accordance with Art.26 par.1 of the GDPR, the parties have signed an appropriate joint controller agreement aimed at regulating their respective responsibilities as regards compliance with the obligations of the GDPR.
The essential content of the joint controllers agreement is available on the Privacy Policy – Joint Controllers agreement page or by written request sent by email to: privacy@triennale.org. The joint controllers have identified the following email address as the contact point for interested parties: privacy@triennale.org; however, the parties may also exercise their rights with regard to each individual data controller.
2. HAS THE DATA PROTECTION OFFICER BEEN DESIGNATED? WHAT ARE THE CONTACT DETAILS FOR THE DATA PROTECTION OFFICER?
FONDAZIONE LA TRIENNALE DI MILANO has appointed its own Data Protection Officer (DPO) in accordance with art. 37 – 39 of the GDPR; the name and other details of the DPO may be obtained from the office indicated above. To contact the DPO you can send an email to the address: dpo.triennale@dpoprofessionalservice.it or write a letter addressed to the DPO at the registered office of the Data Controller as indicated above.
3.TYPE OF DATA THAT MAY BE PROCESSED
Personal data: any information regarding an identified or identifiable natural person ("the interested party"); a natural person is considered identifiable if he or she can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (GDPR recitals 26, 27 and 30).
4. PURPOSES OF THE PROCESSING, LAWFUL BASIS, PERIOD OF DATA STORAGE, NATURE OF PROVISION OF DATA
PURPOSES A) Institutional communications, invitations to events and communication activities in general, including through the website, the use of mailing lists and any other communication tools that may be used. This activity is aimed at keeping you informed and up-to-date with the Triennale Group news, in view of your role and your activities, and at reinforcing our relationship with you.You can choose not to receive these communications at any time. Lawful basis: The processing is necessary in order to pursue the legitimate interest of the Data Controller in sending you these communications to reinforce our relationship with you, taking into account the reasonable expectations you may have as a result of your relationship with the joint controllers based on your role/activity. Art. 6, par. 1 lett. f) and recital 47 of the GDPR. Data storage period: Until objection. You may also request the definitive erasure of your data at any time. Nature of provision of data: Providing your data is necessary in order to send the communications indicated above. As an interested party, you have the right to object at any time to the processing of your data for the purposes indicated, and you will then no longer receive these communications. If you object to receiving these communications by email, including at a later date, it will not affect your contractual relationship nor the other purposes in any way.
PURPOSES B) Purposes of the processing: SOFTSPAM: The activity of sending commercial/promotional information and newsletters by email to the email address you provided during the purchasing process, concerning the same type of product and/or a similar service to the product/service that was purchased – art. 130, par. 4 of Legislative Decree 196/03/ legitimate interest (art. 6 lett. f) GDPR), unless you did not give your consent. Lawful basis: The processing is necessary in order to pursue the legitimate interest of the data controller to send promotional and commercial communications by email to the email address you provided during the purchasing process, regarding the same type of product and/or a similar service to the product/service that was purchased ("soft spam"), on condition that this is not overridden by the interests or rights and fundamental liberties of the interested party which require the protection of their personal data, taking into account the reasonable expectations that the interested party may have, based on their relationship with the data controller. Art. 6, par. 1 lett. f) and recital 47 of the GDPR. Data storage period: Until objection. Nature of provision of data:
It is necessary for you to provide your data during the purchasing process and also subsequently in order for us to send you so-called "soft spam" communications. As an interested party, you have the right to object at any time to the processing of your data for the purposes indicated, in which case you will no longer receive these communications. If you object to receiving these communications by email, including at a later date, it will not affect your contract or the other purposes in any way.
PURPOSES C) Purposes of the processing: direct marketing activities for sending publicity material and commercial and promotional communications through subscription to the newsletter. In order to collate and, if necessary, improve the results of automated communications, the joint controllers use report systems. From these reports, the joint controllers will know, for example: the number of people who read the communication and who open it; the number of individual “clickers” and "clicks”; the devices and operating systems used to read the communication; details of the activities of individual users; details of the emails sent, if emails have been received or not, and forwarded emails. All these data are used in order to collate and, if necessary, improve the results of the communications. Lawful basis: The processing is based on consent to the processing of the personal data (recitals 42, 43). Art. 6 par. 1 lett. a) of the GDPR. Data storage period: until consent is withdrawn (Opt-out). Nature of provision of data: Providing your data is optional.Failure to provide the necessary data will make it impossible to receive direct marketing communications.
PURPOSES D) Purposes of the processing: Profiling activities Non-automated profiling for better management of services and for sending promotional communications more in line with your own preferences, including through banners that will appear while browsing. Lawful basis:The processing is based on consent to the processing of personal data; (Recitals 42, 43). Art. 6 par. 1 lett. a) of the GDPR. : Data storage period: until consent is withdrawn (Opt-out) and in any case for a maximum of 3 years. Nature of provision of data: Providing your data is optional. Failure to provide the necessary data will make it impossible to carry out analysis and send targeted communications.
5. WHO WILL THE PERSONAL DATA BE SHARED WITH? RECIPIENTS OF THE DATA
The personal data that is processed will not be circulated.
The personal data will be shared with parties who will process the data as independent Data Controllers or Data Processors (art. 28 GDPR) and will be processed by natural persons (art. 29 GDPR) who will act under the authority of the joint controllers and the Data Processors on the basis of specific instructions provided regarding the purposes and methods of the processing. The data will be shared with recipients belonging to the following categories: – Parties who provide services for managing communications networks, including email, web hosting, newsletter systems, etc.; – CRM platform providers; – Professionals, studios or companies who provide support and consultancy services to us; – The relevant authorities in order to comply with legal obligations and/or public administration regulations, if required.
The list of Data Processors under art. 28 can be obtained by sending an email to: privacy@triennale.org or contacting the other addresses indicated above.
6. WILL THE DATA BE TRANSFERRED TO A COUNTRY OUTSIDE THE EEA?
The personal data will not be transferred outside the EEA.
7. IS THERE AN AUTOMATED PROCESS?
The personal data will be subject to processing using paper, manual, electronic and automated means. In particular, subject to your specific consent, your data will be processed using automated means - through data collation systems - in order to improve the Data Controller's supply of goods and services, developing your profile and analysing your consumer buying habits and choices in order to be able to send you suggestions and offers in line with your tastes (profiling). For further details you can write to the email address privacy@triennale.org.
8. RIGHTS OF INTERESTED PARTIES
You can exercise your rights under art. 15 ff. of the GDPR by contacting the DPO at the addresses indicated above or contacting the joint controllers using their respective contact details.You have the right, at any time, to request: access to your personal data (art.15); the rectification (art.16) or erasure of your data (art.17); or restriction of the processing (art.18). The joint controllers shall communicate any rectification or erasure or restriction of processing of the personal data to each recipient to whom the personal data have been disclosed (art. 19). The joint controllers shall inform the interested party who the recipients are, if so requested by the interested party. In the situations described above, you have the right to the portability of your data (art.20) and in this case you will be supplied with the data in a structured, commonly-used and machine-readable format. Where applicable, you have the right to object (art.21), at any time, to the processing of your data based on legitimate interest, by writing to the contact details provided above, with the subject “objection”; in cases where the lawful basis is consent, you have the right to withdraw your consent without affecting the lawfulness of the processing carried out before the withdrawal of consent.To stop receiving direct marketing communications, simply send an email at any time to: privacy@triennale.org with the subject “unsubscribe newsletter” or use the automatic unsubscribe functions provided in emails.If you only wish to opt out of profiling, simply send an email to: privacy@triennale.org with the subject “no profiling” or use the opt-out options shown in your personal area. If you consider that the processing of your personal data carried out by the joint controllers is taking place in breach of the GDPR (EU) 2016/679, you have the right to lodge a complaint to the Supervisory Authority, in particular in the Member State where you habitually reside or work, or in the place where the alleged GDPR breach took place (Garante Privacy https://www.garanteprivacy.it/), or to take legal action in the appropriate courts of law.
9. CHANGES TO THE PRIVACY POLICY
The joint controllers may change, amend, add or remove any part of this privacy policy. In order to facilitate monitoring of any changes, the privacy policy will include a notification of the date when the policy was updated.
Date of update: 6 June 2023