INFORMATION ON THE PROCESSING OF PERSONAL DATA

Pursuant to the articles. 13 and 14 of the European Regulation 2016/679 (GDPR) and the current legislation on the processing of personal data, the Pinocchio Museum Experience carries out the processing correctly, lawfully and transparently, respecting the interests, rights and fundamental freedoms of the interested party.

The objective is to guarantee maximum transparency regarding the processing of personal data in relation to the services provided by Pinocchio Museum Experience, existing or future contracts, the publication or reproduction of the aforementioned data.

DATA CONTROLLER

The Data Controller is Spazio Ricasoli s.r.l. VAT number IT06821200489, via Bolognese, 165 – 50139 Florence (FI).

For this purpose, all the information necessary for users, also regarding navigation on the site, this information is published on the Pinocchio Museum Experience website (www.pinocchioflorence.it) under the Privacy heading and identifiable at the bottom of each web page.

PROCESSING METHODS

The processing is carried out in an automated and/or manual manner and/or with electronic and/or automated tools and supports.

The data may be processed by subjects qualified as External Data Processors who operate under the direct authority of the Data Controller (employees and/or collaborators in various capacities).

In this regard, it should be noted that the emails are managed by the company ARUBA s.p.a. The management of online receipts is entrusted to the company Regiondo s.r.l. The receipts at the point of sale inside the museum are entrusted to the company SumUp and Giunti Editore, while online communication and the related marketing data are entrusted to the company Wix Ltd.

OBJECT OF THE TREATMENT

The data provided and processed by the Data Controller concerns common and personal data. The data is processed in compliance with the obligations of correctness, lawfulness and transparency in accordance with the applicable legislation, protecting the confidentiality and rights of the interested parties.

The provision of the requested data is mandatory, pursuant to the applicable laws and regulations in force and failure to provide them could jeopardize access to the requested service, such as the lack of sending communication and information on reservations made at the Pinocchio Museum Experience.

PURPOSE OF DATA PROCESSING

The data provided by individuals will be processed for the following purposes:

• Manage the relationship with the interested party to fulfill the obligations to which the interested party is a party: the data will be processed for the formalization and management of the contractual relationship such as the request or booking of a visit or the online purchase of the entrance ticket or also for invoicing or issuing ticket receipts. Furthermore, they will be processed for the sending of automatic electronic communications strictly connected to the execution of the respective contractual obligations such as confirmation of collection and booking.

• Fulfill legal obligations to which the Data Controller is required: the data will be processed for the fulfillment of legal obligations established by community regulations, national laws or other regulatory sources. In particular, the Data Controller may process the data for the fulfillment of accounting and tax obligations.

• Receive information on the Museum's initiatives, subject to explicit consent: With your consent, the Museum may process personal data in order to send commercial, promotional and advertising communications of events and initiatives of the Museum alone. For these purposes, the Data Controller will use automated contact methods such as, for example, newsletters, apps. The Data Controller may process personal data in order to identify and offer communications and initiatives more appropriate to your personal needs.

• Statistical analysis: collection of data and information in aggregate and anonymous form in order to verify the correct functioning of the website. None of this information is related to the natural person-user of the website and does not allow identification in any way.

• Execute orders from the Authority: your data could be processed to fulfill obligations arising from an Order from the Authority (for example, to ascertain and prosecute an offense committed via the web or against a user).

CONSERVATION

The personal data will be stored either in a paper archive at the operational headquarters of the business in Via Ricasoli 44 or in electronic archives managed by third-party companies with which the Data Controller has collaborative relationships for the performance of fundamental functions in the management of the Pinocchio Museum Experience.

The data processing carried out by the Data Controller fully complies with the provisions of the art. 32 of the GDPR 2016/679 regarding security measures, also by the aforementioned specifically appointed subjects and in compliance with the provisions of the art. 29 GDPR 2016/679.

We also point out that, in compliance with the principles of lawfulness, purpose limitation and data minimization, pursuant to art. 5 GDPR 2016/679, subject to free and explicit consent, personal data will be kept for the period of time strictly necessary to achieve the purposes for which they are collected and processed.

SCOPE OF COMMUNICATION AND DISSEMINATION

We inform you that the data collected will never be disseminated and will not be communicated without explicit consent of the interested party, except for necessary communications which may involve the transfer of data to qualified subjects, such as for example external managers who operate under the direct authority of the Owner, employees and/or collaborators in various capacities, consultants or other subjects. Furthermore, the data will be communicated, regardless of the granting of consent, for the fulfillment of legal obligations, including but not limited to tax obligations.

The Data Controller does not transfer data to non-European countries.

RIGHTS OF THE INTERESTED PARTY

At any time, the interested party may exercise, pursuant to the articles. from 15 to 22 of EU Regulation no. 2016/679, the right to:

• ask for confirmation of the existence or otherwise of your personal data;

• obtain information on the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be communicated and, when possible, the retention period (right of access of the interested party);

• obtain rectification and deletion of data (right of rectification);

• obtain the limitation of treatment;

• obtain data portability, i.e. receive them from a data controller, in a structured format, commonly used and readable by an automatic device, and transmit them to another data controller without impediments (right to obtain notification from the data controller in cases of rectification, deletion of personal data or deletion thereof);

• object to processing at any time (right to object);

• revoke consent at any time without prejudice to the lawfulness of the processing based on the consent given before the revocation (right of revocation);

• request the deletion of your data to the extent compatible with the owner's regulatory obligations (right to be forgotten);

• lodge a complaint with a supervisory authority.

We inform you that the interested party has the right to lodge a complaint with the Guarantor for the Protection of Personal Data following the procedures and indications published on the Authority's website www.garanteprivacy.it

We inform you that the exercise of the rights of the interested party, referred to in the aforementioned articles, such as the right of cancellation or opposition, meets the limits imposed by the relevant regulations (Prime Ministerial Decree of 22 February 2016 articles 56,57 and Prime Ministerial Decree of 24 October 2014, art. 7) regarding the obligations to retain personal data.

If the conditions set out above are respected, the interested party can revoke his/her consent, at any time and without prejudice to the lawfulness of the processing, by writing to amministrazione@pinocchioflorence.it

DATE BREACH

Spazio Ricasoli s.r.l. has chosen and delegated the management of the storage of personal data in electronic form to third-party companies (SumUp s.p.a., Regiondo s.r.l., Wix Ltd.) recognized for their professionalism and reliability.

Furthermore, it undertakes to promptly communicate any Data Breach (violations of personal data), which may compromise the security of users' personal data, to the users themselves and to the competent authorities within the terms established by law.

VIDEO SURVEILLANCE

With reference to the installation of the video surveillance system located in the area used for the laboratories, the purpose of the processing concerns the counting of the maximum number of presences in the specific rooms. The images will be treated in accordance with the law and will not be disseminated except for the fulfillment of legal obligations or orders from the Authority for the purposes of preventing crimes or other offences. The processing of images for these purposes is based on the pursuit of a legitimate interest of the Museum and the fulfillment of legal obligations to which the Data Controller is bound.

UPDATES

The Data Controller reserves the right to make changes or additions to the aforementioned information, also as a consequence of regulatory changes.

COOKIE

Some information on the Pinocchio Museum Experience website is collected using cookies (technical, commercial and third parties) and other tracking technologies. Third-party cookies refer to companies such as: Wix, Google, Meta, Pinterest. Cookies allow the technical functioning of the site, the optimization of navigation for users and the acquisition of statistical data.

The Pinocchio Museum Experience website does not use cookies to profile users' sensitive data.

You can manage your cookie preferences via the disclaimer on the site or via your browser. At any time, the navigator has the right to remove cookies from his browser through a normal "cleaning" procedure. Appropriate information can be found on the website of the manufacturer of your browser.

PRIVACY