Privacy Policy on the Processing of Personal Data
PREAMBLE
This privacy policy complies with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), as well as the Italian Privacy Code (Legislative Decree No. 196 of 30 June 2003). The document has also been drafted in accordance with the Guidelines issued by the Italian Data Protection Authority (in particular, the Anti-Spam Guidelines issued on 4 July 2013).
Data Controller:
Associazione Culturale Controluce Teatro d’Ombra
Via della Rocca 23 – 10123 Turin (TO), Italy
VAT No. 07752280011
Phone: +39 011 19740267
Email: info@festivalincanti.it
Website to which this privacy policy refers: https://www.festivalincanti.it/ (“Website”).
The Data Controller has not appointed a Data Protection Officer (DPO). Therefore, any request for information can be addressed directly to the Data Controller.
GENERAL INFORMATION
This document describes how the Data Controller processes your personal data provided through the Website.
Below are the main types of processing of your personal data. In particular, the legal basis for each processing activity is explained, along with whether the provision of data is mandatory and the consequences of failing to provide such data.
To clearly outline your rights, we have specified, where necessary, if and when a particular type of personal data processing is not carried out.
Website Registration
The Website does not offer a registration option. Therefore, the Data Controller does not process your personal data for this purpose.
Purchases on the Website
It is not possible to make purchases on the Website. As a result, your personal data will not be processed for this purpose. The Data Controller does not process user data to send “reminder” emails regarding the purchase of the Controller’s products and/or services.
Responding to Your Requests
Your data will be processed in order to respond to your information requests. Providing your data is optional; however, refusal to do so will make it impossible for the Data Controller to respond to your inquiries. The legal basis for this processing is the legitimate interest of the Data Controller in responding to user requests. This legitimate interest corresponds to the user’s own interest in receiving a reply to communications sent to the Data Controller.
General Marketing
With your consent, the Data Controller may process the personal data you provide in order to send you newsletters regarding its own products or those of third parties. The legal basis for this processing is your consent. Providing your personal data for this purpose is entirely optional. Failure to give consent for marketing purposes will prevent you from receiving newsletters about the products/services of the Data Controller and/or third parties, and will also prevent the Data Controller from conducting market research, including surveys aimed at assessing user satisfaction. These communications will be sent to the email address you provided on the Website.
Profiling
With your consent, the Data Controller may process your personal data for profiling purposes, meaning to send you advertising materials and/or newsletters concerning its own products or those of third parties that may be of specific interest to you. The legal basis for this processing is your consent. Providing your data for this purpose is entirely optional. Failure to give consent for profiling purposes will prevent the Data Controller from developing your commercial profile—based on your preferences and purchasing habits—and from sending you advertising materials regarding products of the Data Controller and/or third parties that are tailored to your specific interests. These communications will be sent to the email address you provided on the Website.
Data Sharing
The Data Controller does not sell or transfer your personal data to third parties.
Geolocation
The Website implements IP address geolocation tools in order to display the site correctly when accessed from outside Italy.
Curriculum Vitae
It is not possible to submit a curriculum vitae through the Website. Therefore, your data will not be processed for this purpose.
Photos and Videos
The Data Controller does not request the publication of photographs and/or videos depicting you. Therefore, your data will not be processed for this purpose.
Disclosure of Personal Data
In the course of its regular business activities, the Data Controller may disclose your personal data to certain categories of recipients. These are listed in Article 2. To better protect your rights, Article 2 may also specify, in some cases, when your data will not be disclosed to third parties.
It is important to distinguish between “disclosure” of personal data to third parties and “transfer” (as described in the previous section). In the case of disclosure, the third party receiving the data may use it only for the specific purposes outlined in their relationship with the Data Controller. In the case of a transfer, the third party becomes an independent Data Controller of the personal data. Moreover, the transfer of your personal data to third parties always requires your explicit consent.
Notwithstanding the above, the Data Controller reserves the right to use your personal data as necessary to comply with applicable legal obligations.
SPECIFIC PRIVACY NOTICE
Article 1 – Data Processing Methods
1.1 The processing of your personal data will primarily be carried out using electronic or otherwise automated means, with methods and tools suitable for ensuring the security and confidentiality of the personal data.
1.2 The information collected and the methods of processing will be relevant and not excessive in relation to the type of services provided. Your data will also be managed and protected in secure IT environments appropriate to the circumstances.
1.3 The Website does not process “special categories of data.” Special data includes information revealing racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership in political parties, trade unions, religious, philosophical, political or trade union organizations, as well as data concerning health or sexual orientation.
1.4 The Website does not process judicial data.
Article 2 – Disclosure of Personal Data
The Data Controller may disclose your personal data to certain categories of recipients. The following are the categories of recipients to whom the Data Controller reserves the right to disclose your data:
- The Data Controller may disclose your personal data to all entities (including Public Authorities) who have access to such data by virtue of regulatory or administrative measures.
- Your personal data may also be disclosed to all public and/or private entities, natural and/or legal persons (such as legal, administrative, or tax consultants, Judicial Offices, Chambers of Commerce, Labor Offices, etc.), whenever such disclosure is necessary or functional for the proper fulfillment of legal obligations.
- The Data Controller employs staff and/or collaborators in various capacities. For the proper functioning of the Website, the Data Controller may disclose your personal data to these employees and/or collaborators.
- In the regular operation of the Website, the Data Controller makes use of companies, consultants, or professionals responsible for installing, maintaining, updating, and generally managing the Data Controller’s hardware and software, or systems used in the provision of services. Therefore, for these purposes only, your data may also be processed by these entities.
- For the sending of its communications, the Data Controller uses external companies responsible for managing this type of communication (CRM platforms). Your personal data (particularly your email address) may therefore be disclosed to these companies.
- The Data Controller does not use external companies to provide customer care services.
- Buyers’ personal data is not disclosed to couriers or shipping agents.
The Data Controller reserves the right to update the above list in line with its routine operations. Therefore, you are encouraged to regularly consult this privacy notice to verify which entities your personal data may be disclosed to.
Article 3 – Retention of Personal Data
3.1 This article outlines how long the Data Controller reserves the right to retain your personal data.
- Your personal data will be stored only for the time necessary to ensure the proper delivery of the services offered through the Website.
- For customer care purposes, data will be deleted once the support service is completed and, in any case, no later than 3 months after the last email exchange with the data subject.
- For “profiling” marketing purposes, unless consent is withdrawn earlier, data will be retained for 12 months from the date of provision. After consent is withdrawn or the 12-month period expires, personal data will be deleted and no longer used for this purpose.
- For general marketing purposes, unless consent is withdrawn earlier, data will be retained for 24 months from the date of provision. After consent is withdrawn or the 24-month period expires, personal data will be deleted and no longer used for marketing purposes.
3.2 Without prejudice to Article 3.1, the Data Controller may retain your personal data for as long as required by specific applicable regulations, as amended from time to time.
Article 4 – Transfer of Personal Data
4.1 The Data Controller is based in a country that ensures an adequate level of data protection according to current legislation. If your personal data is transferred to a non-EU country for which the European Commission has issued an adequacy decision, the transfer is considered legally secure. This Article 4.1 lists the countries to which your data may be transferred and where the European Commission has recognized an adequate level of protection:
- Your personal data may be transferred to the United States, in accordance with the European Commission’s adequacy decision. This decision recognizes that the U.S. provides a level of personal data protection comparable to that of the European Union.
4.2 In addition to what is stated in Article 4.1, your data may also be transferred to non-EU countries for which the European Commission has not issued an adequacy decision. You are therefore encouraged to regularly review this Article 4.2 to check which such countries your data may be transferred to.
4.3 In this article, the Data Controller indicates the countries where its activity is specifically targeted. This may imply that the law of the targeted country applies alongside the legislation governing the relationship with the user, as described in the Preamble.
- Upon the user’s request, the Data Controller will apply the data protection regulations that are more favorable to the user, as established by the user’s national legislation.
Article 5 – Data Subject’s Rights
The Data Controller informs you that you have the right to:
- request access to your personal data, and request its rectification or deletion, or the restriction of processing, or to object to such processing; you also have the right to data portability
- withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal
- lodge a complaint with a supervisory authority
These rights may be exercised informally by contacting the Data Controller using the contact details provided in the Preamble.
Article 6 – Amendments and Miscellaneous
The Data Controller reserves the right to make changes to this privacy notice at any time, by giving appropriate notice to users of the Website, while ensuring in any case an adequate and equivalent level of protection for personal data.
To stay informed about any changes, you are encouraged to regularly review this notice. In the case of substantial changes to this privacy policy, the Data Controller may also notify you via email.