On May 25, 2018, the new EU General Data Protection Regulation (GDPR) went into effect.

Following the entering into force of the GDPR, the Istituto Villa Adriana e Villa d’Este has reviewed his policies about the management and retention of personal data acquired and stored for different purposes.

The information below illustrates how the Istituto Villa Adriana e Villa d’Este processes such data  and how users, as concerned parties, may exercise their rights under existing legislation.

DATA CONTROLLER

The Data Controller of personal data is the Ministry of Culture.

DATA PROTECTION OFFICER (DPO)

The Data Protection Officer (DPO) is Dott. Andrea Bruciati, Director of the Istituto.
E-mail: va-ve@cultura.gov.it
PEC: va-ve@pec.cultura.gov.it
Telefono: + 39 0774 5589
Indirizzo: Piazza Trento 5, 00019 – Tivoli (Roma)

ASSISTANT DPO

For the Istituto Autonomo Villa Adriana e Villa d’Este the Assistant DPO is Dott.ssa Tiziana Magrini.

LOCATION OF DATA PROCESSING

Processing related to the web services of this website takes place at the aforementioned Istituto and is  handled by the technical staff of the department in charge of processing, or by persons in charge of occasional maintenance operations.

No data derived from the web service is communicated or disseminated to their parties.

The personal data provided by users who request informative material (newsletter, requests, booklets, catalogues, documents, reports about services or the website itself) are used and stored only to  perform the service requested, and will be transferred to other Offices of the Istituto or other public or private entities only should this be needed in order to provide the requested information.

PROCESSING METHOD

Personal data are processed by automated tools for the time strictly necessary to meet the purposes for which they were collected. Specific security measures are observed to prevent the loss of data, illicit or incorrect use and unauthorised access.

TYPES OF DATA PROCESSED

Navigation data

Computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of internet communication protocols. This information is not collected to be associated with identified parties, but by their very nature may, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of computers used by users connecting to the site, the URI (Uniform Resource Identifier) ​​of requested resources, the time of request, the method used to submit the request to the server, the size of the file obtained in reply, the numerical code indicating the status of the reply provided by the server (successful, error, etc.) and other parameters regarding the operating system and computer environment of the user.
These data are used only to obtain anonymous statistical information on site use and to check its correct functioning. The data may be used to ascertain responsibility in case of hypothetical computer crimes against the site or for detection of crimes by the judicial Authority.

Data provided voluntarily by user The optional, explicit and voluntary sending of electronic mail to the addresses indicated on this website entails the subsequent acquisition of the sender’s email, necessary for responding to requests, and of any other personal data included in the message. Specific summary information will be progressively reported or displayed on pages of the website set up for particular services on request.

Data provided voluntarily by user

The optional, explicit and voluntary sending of electronic mail to the addresses indicated on this website entails the subsequent acquisition of the sender’s email, necessary for responding to requests, and of any other personal data included in the message. Specific summary information will be progressively reported or displayed on pages of the website set up for particular services on request.

Personal data collected through cookies

The website does not collect any personal data of users.

Cookies are not used for the transmission of information of a personal nature. Only persistent third-party cookies will be used for collective tracking of webpages visited by users.

The use of so-called session cookies (which are not stored in a persistent manner in the user’s computer and which disappear by closing the browser) is strictly limited to the transmission of session user-id information (made up of random numbers generated by the server), necessary to allow the safe and efficient exploration the website.

The so-called session cookies used on this site avoid having to use other computer techniques, which are potentially harmful to the surfing privacy of users and do not allow acquiring the user’s personal id data.

OPTIONAL DATA PROVISION

Subject to the specifications made with regard to navigation data, users are free to provide the personal data shown on the information request or contact forms to request delivery of information, promotional or commercial materials and other communications. Failure to provide such data may entail the failure to be provided with the items requested.

DATA SUBJECT RIGHTS

As one of the subjects concerned with the personal data indicated above, you have the faculty to exercise your rights in accordance with the methods and within the limits set by the current privacy legislation.

In relation to the processing of personal data, you have the right to request:

• Access: the user may request confirmation whether or not data concerning him/her are being processed, as well as further clarification of the information contained in this Information Notice, and also to receive the data themselves, within the limits of reasonableness;
• Erasure: può chiedere che i suoi dati acquisiti o trattati, vengano cancellati, qualora non siano più necessari alle nostre finalità o laddove non vi siano contestazioni o controversie in essere, in caso di revoca del consenso o sua opposizione al trattamento, in caso di trattamento illecito, ovvero qualora sussista un obbligo legale di cancellazione;

may request that his/her data acquired or processed be deleted under any of the following conditions: if data are no longer necessary in relation to the purposes for which they were

collected;

• Restriction of processing: può chiedere la limitazione del trattamento dei suoi dati personali, quando ricorre una delle condizioni di cui all’art. 18 del GDPR; in tal caso, i dati non saranno trattati, salvo che per la conservazione, senza il consenso dell’utente fatta eccezione per quanto esplicitato nel medesimo articolo al comma
• Object: può opporsi in qualunque momento al trattamento dei suoi dati che hanno come base giuridica un interesse legittimo del titolare e/o al trattamento per finalità di marketing inclusa la profilazione;
• l’opposizione prevarrà sempre e comunque sul nostro interesse legittimo a trattare i suoi dati per finalità di marketing;
• Data portability: può chiedere di ricevere i suoi dati, o di farli trasmettere ad altro titolare indicato dall’utente, in un formato strutturato, di uso comune e leggibile da dispositivo automatico.

Furthermore, pursuant to Art. 7, par. 3, GDPR, you can exercise your right to withdraw consent at any time, without prejudice to the lawfulness of the processing based on consent previously granted.

The user has the right to lodge a complaint with the Supervisory Authority, which in Italy is the Italian Data Protection Authority.

It should be noted that this document is an expression of the “personal data protection policy” applied by the Istituto Autonomo Villa Adriana e Villa to this site, which is constantly checked and updated.