REGARDING THE PROCESSING OF PERSONAL DATA RELEASED, WE INFORM THAT:
CONTROLLER OF DATA PROCESSING AND DATA PROTECTION OFFICER (RPD/DPO)
The Controller of the Processing is Fondazione Arena di Verona, with registered offices in Via Roma 7/D - 37121 Verona e-mail protocollo@arenadiverona.it (hereafter for brevity indicated as “Fondazione”).
The Data Protection Officer (RPD/DPO) nominated by la Fondazione can be contacted at rdp@arenadiverona.it
TYPE OF DATA PROCESSED, PURPOSE AND LEGAL BASIS OF PROCESSING
The following personal data are collected and processed: common personal data (name, surname, place and date of birth, contact data, e-mail, address, mobile phone, land line, fax, ID document, data regarding payment, data regarding credit cards) any data of a particular nature (e.g. data regarding health – data regarding functional diversity) from: spectators, individuals accompanying spectators/ teachers or directors in the event of spectating pupils/students for: a) contractual purposes and those regarding the management of the contractual relationship and handling of a request for reimbursement in the event of a show being cancelled; b) administrative-accounting-tax and legal obligations connected with the invoicing and control of the contractual relationship; c) purchase of tickets at reduced rates; d) for marketing purposes including mail-out of newsletters and promo/advertising material of the Fondazione and the events it organizes, survey after the performances.
The legal basis of the processing is therefore: contractual obligations for the purposes as per letter a); legal obligations, for the purposes as per letter b); consent expressed by the interested party, requested by means of the appropriate form(s), for the purposes as per letters c) and d).
COMMUNICATION OF DATA TO THIRD PARTIES – RECEIVERS OF THE DATA
Fondazione can communicate processed data for the abovementioned purposes to: i) in-house subjects responsible for processing and system administrators in the event of IT work; ii) external subjects in the following categories: external consultants and their representatives/banks, insurance companies and banks/ control bodies and organizations, partners, organizers of the event; iii) communication companies.
TRANSFER OF DATA TO THIRD COUNTRIES
The processed data may be transferred by the Controller to third countries for the above-mentioned purposes. Nevertheless, in the event of the transfer of data to third countries, this will be done respecting current provisions at the time on such matters according to Art. 44 et seq. GDPR 2016/679.
PROCESSING METHODS, PERIOD AND CRITERIA OF DATA RETENTION
The data will be processed in printed or digital format. The data will be processed by the Controller for the period necessary for achieving the aforementioned purpose(s) and, at the end of this/these, for any further period prescribed by law regarding the preservation of contracts and administrative data and/or for defence in court (ten years from the last use and/or termination due to the limitation period). The data as per the purposes c) and d) will be retained for the time necessary to pursue the purposes for which they were collected and in any case until consent is revoked by the interested party.
DATA RELEASE
The release of data and any consent for the purposes as per letter c) is compulsory for fulfilment of the contractual relationship and for legal purposes. The release of the data for the purposed as per letter d) is merely optional and subject to the consent of the interested party. Failure to release data makes it impossible to accomplish the aforementioned purposes.
RIGHTS OF THE DATA SUBJECT, WITHDRAWAL OF CONSENT AND COMPLAINT TO THE CONTROL AUTHORITY
Should the legal prerequisites exist, the data subject has the right at any time to request access to his/her personal data, their rectification, cancellation or restriction, or to block processing and exercise the right to data portability.
In any case, the data subject has the right to withdraw at any time any consent given for data processing, without prejudicing the legality of the processing based on the consent granted prior to the withdrawal.
In the event of a presumed violation, the data subject, in the event of the prerequisites existing, also has the right to submit a complaint to a data processing control Authority in the EU member country in which he/she habitually resides, in the EU country in which he/she works or in which the violation occurred.
PROFILING AND AUTOMATED DECISION MAKING PROCEDURE
Processing is not carried out using automated decision-making procedure (e.g. profiling).
CONTACTS AND REQUESTS
To obtain further information on the processing of personal data, opposing processing or exercising the rights foreseen by current law on matters of personal data protection (access, amendment, deletion, limitation, opposition, portability) and/or receive the complete list of the internal and external subjects responsible for the processing and/or receive information regarding the transfer of data to non-EU countries and relative guarantees, including data transfer procedure and protection as per Art. 44 et seq. GDPR, requests can be sent via e-mail to protocollo@arenadiverona.it
