Privacy policy

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

REGULATION (EU) No. 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL OF 27 APRIL 2016

The Municipality of Vinci, with registered office in Piazza Leonardo Da Vinci 29, in its capacity as Data Controller (hereinafter also referred to as the “Controller”), pursuant to Article 13 of Regulation (EU) No. 2016/679 (hereinafter “GDPR” or “Regulation”), hereby informs that personal data will be processed according to the following methods and purposes.

Principles applicable to data processing

The Controller processes the data subject’s personal data (hereinafter “personal data” or “data”) in order to carry out a contract or pre-contractual measures.
Pursuant to the Regulation, the Controller informs that the aforementioned legislation provides for the protection of individuals with regard to the processing of personal data, and that such processing will be based on the principles of fairness, lawfulness, transparency, and the protection of confidentiality and fundamental rights.

Legal basis

The Controller processes the personal data of the data subject:

where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (Art. 6(1)(e));
where the processing is necessary for the purposes of the legitimate interests pursued by the Controller or by third parties (Art. 6(1)(f)).

Purposes of processing

Personal data are processed:

A) Without the data subject’s express consent (Art. 6(1)(b) GDPR), for the following purposes:

to perform a task carried out in the public interest or in the exercise of official authority, and for the legitimate interests pursued by the Controller or third parties;
to disclose data to persons, entities, or authorities where required by law or official orders;
to exercise the Controller’s rights, such as the right of defence in legal proceedings.

B) Only with the specific and separate consent of the data subject (Art. 6(1)(a) and Art. 7 GDPR), for the following purposes:
i) to allow you to receive newsletters or other informative material from the Municipality, as well as to use apps provided by the Municipality of Vinci;
ii) to use specific services provided by the Municipality (including but not limited to: school meals, school transport, library services, online tax payments).

Failure to provide consent will make it impossible to carry out the above activities.
In relation to the purposes described under point B), refusal and/or provision of inaccurate or incomplete information may prevent you from receiving the Municipality’s newsletters or other informative material, using the Municipality’s apps, or accessing specific services provided by the Municipality.
You may withdraw your consent at any time.

Data processing methods

Personal data are processed through the operations specified in Art. 4(2) of Regulation (EU) 2016/679, namely: collection, recording, organisation, storage, consultation, processing, modification, selection, retrieval, comparison, use, interconnection, restriction, communication, erasure, and destruction.
Personal data are processed in both paper and electronic and/or automated form.
The Controller will process personal data for the time necessary to fulfil the purposes outlined above and, in any case, for no more than 10 years after the termination of the work or collaboration relationship.

Access to and disclosure of data

Data may be made accessible for the purposes referred to in Art. 3:

to employees and collaborators of the Controller, in their capacity as authorised data processors and/or system administrators;
to persons, entities, or authorities where disclosure is mandatory under legal provisions or official orders;
to other public bodies, including local entities, for administrative and accounting purposes and for compliance with legal obligations; your data may also be shared with companies in which the Municipality holds a stake, if necessary for administrative/accounting purposes and legal compliance;
to third parties having a contractual relationship with the Municipality, for administrative/accounting purposes and legal compliance.

The Controller may disclose data for the purposes referred to in Art. 3 to persons, entities, or authorities where required by law or official orders.
These entities will process the data in their capacity as independent data controllers.

Data transfer

Personal data are stored on servers located within the European Union. However, it is understood that the Controller may, if necessary, move the servers outside the EU.
In such cases, the Controller ensures that any data transfers outside the EU will take place in accordance with applicable legal provisions, subject to the adoption of the standard contractual clauses issued by the European Commission.

Data subject’s rights

Pursuant to Art. 15 of the GDPR, the data subject has the right to obtain confirmation from the Controller as to whether or not personal data concerning them are being processed and, where that is the case, access to the personal data and the following information:

a) the purposes of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipients to whom the personal data have been or will be disclosed;
d) the envisaged retention period for the personal data, or, if not possible, the criteria used to determine that period;
e) the right to request from the Controller rectification or erasure of personal data or restriction of processing concerning the data subject or to object to such processing;
f) with reference to the consent given for the purposes set out in Art. 2 point B), the right to withdraw consent at any time;
g) the right to lodge a complaint with the supervisory authority.

How to exercise your rights

You may exercise your rights at any time by sending:

a registered letter with return receipt to Comune di Vinci, Piazza Leonardo da Vinci 29;
an email to: protocollo@comune.vinci.fi.it.

Data Controller, Data Processor, and Representatives

The Data Controller is the Municipality of Vinci, with registered office in Piazza Leonardo da Vinci 29.
The updated list of data processors and authorised personnel is kept at the Controller’s registered office.

The DPO (Data Protection Officer) is Dr. Elisa Subrizi – email: dpo@comune.vinci.fi.it, phone: +39 0577 931930

This information notice is provided pursuant to Art. 13 of Legislative Decree 196/03 by the Municipality of Vinci and applies to the website www.museoleonardiano.it.
Users must carefully read this notice and bear full responsibility before providing any information or completing any electronic form on the site.

Data processed and purposes

The types of personal data processed include browsing data, data voluntarily provided by users of the site, and cookies.
Browsing data are collected by the site for its normal operation, such as data transmitted through internet protocols. None of these data are disclosed or disseminated.
Data provided by users when registering to “Book your visit” or requesting the Press Kit are not disclosed to third parties or used for purposes other than those stated.
The purpose is to enable the Leonardo Museum to arrange visits and deliver press materials.
For information on cookies, see our Cookie Policy.

Data processing and data controller

Data are processed using automated tools by the staff of the Municipality of Vinci and the Leonardo Museum, only for the time necessary to achieve the purposes for which they were collected.
Specific security measures are in place to prevent data loss, unlawful or improper use, and unauthorised access.
Data subjects may at any time obtain confirmation as to whether or not personal data concerning them exist, and to know their content and origin, verify their accuracy, or request their integration, updating, or rectification (Art. 7 of the Personal Data Protection Code).
Pursuant to the same article, data subjects have the right to request the erasure, anonymisation, or blocking of data processed unlawfully, as well as to object, on legitimate grounds, to their processing.
The data controller is the Municipality of Vinci, and information regarding personal data can be requested by writing to: info@museoleonardiano.it