We remind you that the entire content of this site is property of Fondazione art. 49 and may not be downloaded, sold or transferred to third parties, modified, altered or reworked in any way. Fondazione art. 49 remains the sole owner in accordance with the current legislation.
EUROPEAN REGULATION 2016/679 (GDPR)
The “European Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data” (hereinafter “GDPR”) provides for the protection of persons and other subjects with regard to the processing of personal data. Fondazione art. 49 as “Data Controller”, pursuant to Article 13 of the GDPR, provides you with the following information:
CATEGORIES OF DATA
Fondazione art. 49 will process personal and/or sensitive data entered in the contact form.
SOURCE OF PERSONAL DATA
The personal data that Fondazione art. 49 will hold is collected directly from the person concerned when filling in this contact form.
DATA CONTROLLER
The data controller is Fondazione art. 49, Via Rubens 19, 20148 Milan.
PURPOSES FOR WHICH THE DATA IS PROCESSED
The processing of your data, collected and stored in connection with the completion of the form, is carried out for the following purposes: to respond to requests for information sent via the form, to provide assistance and support services, to proceed with newsletter subscription, to send educational, informative and commercial communications, and to manage commercial profiling activities.
LEGAL BASIS OF THE PROCESSING
When you fill in the form, you will always be asked for your explicit consent to the processing, which is optional with respect to the request for information, assistance and support, but indispensable in order for you to have access to our further services (newsletters, educational, informative and commercial communications, profiling).
RECIPIENTS OF THE DATA
Within the limits pertinent to the processing purposes indicated, your data may be communicated to partners, consultancy companies, private companies, appointed as Data Processors by the Data Controller. Your data will not be disseminated in any way. The Data Processors and Persons in Charge of Processing in office are punctually identified in the Privacy Document, which is updated periodically.
TRANSFER OF DATA ABROAD
Data collected will not be transferred outside EU countries.
STORAGE PERIOD
We process and store your data for all the time: – valid and useful for the purposes of requesting information, assistance and support and related services – useful and corresponding, at most, to the limitation period provided by Italian law for the exercise of your rights and to the extent necessary to fulfil our legal obligations starting from your last interaction with us – useful and necessary in the event of ascertainment of responsibility for hypothetical computer crimes to the detriment of our platforms or the platforms of our business partners, or by our journalists – until your revocation, in the case of consent given for the activity of newsletters, educational, informative and commercial communications, profiling. A check on the obsolescence of the retained data in relation to the purposes for which they were collected is carried out periodically.
OBLIGATORINESS OR NOT TO PROVIDE DATA
We inform you that the provision of data is optional for some fields and obligatory for others (marked with an asterisk), and failure to provide the obligatory data will result in the form NOT being sent.
OBLIGATORY CONSENT
The provision of consent to data processing by ticking the appropriate box is optional, but indispensable in order to proceed with sending the form.
DATA PROCESSING METHODS
The personal data you provide will be processed in compliance with the aforementioned legislation and with the confidentiality obligations that govern the Data Controller’s activities. The data will be processed both by computer and on paper or any other suitable type of support, in compliance with the appropriate technical and organisational security measures provided for by the GDPR.
RIGHTS OF THE DATA SUBJECT
The data subject shall always have the right to request from the Controller access to his/her data, rectification or erasure of data, restriction of processing or the possibility to object to processing, to request data portability, to withdraw consent to processing by asserting these and the other rights provided by the GDPR by simple communication to the Controller. The data subject may also lodge a complaint with a supervisory authority:
Art. 15 Data subject’s right of access
1. The data subject shall have the right to obtain from the data controller confirmation as to whether or not personal data relating to him are being processed and, if so, to obtain access to the personal data and to the following information: a) the purposes of the processing b) the categories of personal data concerned c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if recipients are in third countries or international organisations d) where possible, the period for which the personal data are to be retained or, if this is not possible, the criteria used to determine that period e) the existence of the data subject’s right to request from the controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning him or her or to object to their processing f) the right to lodge a complaint with a supervisory authority g) where the data are not collected from the data subject, all available information as to their source h) the existence of an automated decision-making process, including profiling as referred to in Article 22(1) and (4), and, at least in such cases, meaningful information on the logic used, as well as the importance and the envisaged consequences of such processing for the data subject. 2. Where personal data are transferred to a third country or an international organisation, the data subject shall have the right to be informed of the existence of appropriate safeguards within the meaning of Article 46 relating to the transfer. 3. The controller shall provide a copy of the personal data undergoing processing. In case of further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. If the data subject makes the request by electronic means, and unless otherwise specified by the data subject, the information shall be provided in a commonly used electronic format. 4. The right to obtain a copy referred to in paragraph 3 shall not infringe the rights and freedoms of others.
Art. 16 Rectification and cancellation Right of rectification
The data subject shall have the right to obtain from the data controller the rectification of inaccurate personal data concerning him/her without undue delay. Taking into account the purposes of the processing, the data subject has the right to obtain the integration of incomplete personal data, also by providing a supplementary declaration.
Art. 17 Right to erasure (‘right to be forgotten’)
1. The data subject shall have the right to obtain from the data controller the erasure of personal data concerning him/her without undue delay and the controller shall be obliged to erase the personal data without undue delay if any of the following grounds applies: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; 4.5.2016 L 119/43 Official Journal of the European Union EN b) the data subject withdraws the consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2)(a) and if there is no other legal ground for the processing c) the data subject objects to the processing pursuant to Article 21(1) and there is no overriding legitimate ground for the processing, or the data subject objects to the processing pursuant to Article 21(2) d) the personal data have been unlawfully processed e) the personal data must be erased in order to comply with a legal obligation laid down by Union law or by the law of the Member State to which the controller is subject f) the personal data have been collected in connection with the offering of information society services referred to in Article 8(1). 2. Where the controller has made personal data public and is obliged under paragraph 1 to erase them, the controller shall, having regard to the available technology and the costs of implementation, take reasonable steps, including technical measures, to inform the controllers who are processing the personal data of the data subject’s request to erase any link, copy or reproduction of his or her personal data. 3. Paragraphs 1 and 2 shall not apply to the extent that the processing is necessary: a) for the exercise of the right to freedom of expression and information b) for compliance with a legal obligation to which the processing is subject under Union or Member State law or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller c) for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) d) for archiving in the public interest, scientific or historical research or statistical purposes in accordance with Article 89(1), insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the purposes of such processing or e) for the establishment, exercise or defence of legal claims.
Art. 18 Right to restriction of processing
1. The data subject shall have the right to obtain from the controller the restriction of processing when one of the following cases occurs: a) the data subject disputes the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of those personal data b) the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead that their use be restricted c) although the controller no longer needs them for the purposes of the processing, the personal data are necessary for the establishment, exercise or defence of legal claims by the data subject d) the data subject has objected to the processing pursuant to Article 21(1), pending the verification as to whether the legitimate reasons of the controller prevail over those of the data subject. 2. Where processing is restricted pursuant to paragraph 1, such personal data shall, except for storage, only be processed with the consent of the data subject or for the establishment, exercise or defence of legal claims or the protection of the rights of another natural or legal person or for reasons of substantial public interest of the Union or a Member State. 4.5.2016 L 119/44 Official Journal of the European Union EN 3. A data subject who has obtained a restriction of processing pursuant to paragraph 1 shall be informed by the data controller before that restriction is lifted.
Art. 19 Obligation to notify in case of rectification or erasure of personal data or restriction of processing
The controller shall communicate to each recipient to whom the personal data have been transmitted any rectification or erasure or restriction of processing carried out pursuant to Article 16, Article 17(1) and Article 18, unless this proves impossible or involves a disproportionate effort. The controller shall inform the data subject of such recipients if the data subject requests so.
Art. 20 Right to data portability
1. The data subject shall have the right to receive in a structured, commonly used and machine-readable format the personal data concerning him/her that he/she has provided to a data controller and shall have the right to transmit those data to another data controller without hindrance from the data controller to whom he/she has provided them where: a) the processing is based on consent within the meaning of point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract within the meaning of point (b) of Article 6(1) and b) the processing is carried out by automated means. 2. When exercising his or her rights in relation to data portability pursuant to paragraph 1, the data subject shall have the right to obtain the direct transmission of personal data from one controller to another, if technically feasible. 3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 4. The right referred to in paragraph 1 shall not affect the rights and freedoms of others.
Art. 21 Right of opposition
1. The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her pursuant to Article 6(1)(e) or (f), including profiling on the basis of those provisions. The controller shall refrain from further processing the personal data unless he can demonstrate compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. 2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him/her carried out for such purposes, including profiling insofar as it is related to such direct marketing. 3. If the data subject objects to the processing for direct marketing purposes, the personal data shall no longer be processed for those purposes. 4.5.2016 L 119/45 Official Journal of the European Union EN 4. The right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information at the latest at the time of the first communication with the data subject. 5. In the context of the use of information society services and without prejudice to Directive 2002/58/EC, the data subject may exercise his/her right to object by automated means using specific techniques. 6. Where personal data are processed for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1), the data subject shall have the right, on grounds relating to his or her particular situation, to object to the processing of personal data relating to him or her, except where the processing is necessary for the performance of a task carried out in the public interest.
Art. 22 Automated decision-making process concerning natural persons, including profiling
1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him/her or significantly affects him/her in a similar way. 2. Paragraph 1 shall not apply where the decision: a) is necessary for the conclusion or performance of a contract between the data subject and a data controller b) is authorised by the law of the Union or of the Member State to which the data controller is subject, which also lays down appropriate measures to protect the rights, freedoms and legitimate interests of the data subject c) is based on the explicit consent of the data subject. 3. In the cases referred to in points (a) and (c) of paragraph 2, the controller shall implement appropriate measures to protect the rights, freedoms and legitimate interests of the data subject, at least the right to obtain human intervention by the controller, to express his or her point of view and to oppose the decision. 4. The decisions referred to in paragraph 2 shall not be based on the special categories of personal data referred to in Article 9(1), unless Article 9(2)(a) or (g) applies and appropriate measures are in place to protect the rights, freedoms and legitimate interests of the data subject.