PRIVACY STATEMENT ON PERSONAL DATA PROCESSING – VIDEO RECORDINGS – REV00 June 14th, 2018
Pursuant to Article 13 of the EU Regulation 679/2016 on the protection of personal data collected from the data subject
- Data Controller
- The Data Controller is the Museo dei Bambini SCS Onlus with registered office in Via Flaminia no. 80/86 -00196 (RM)
- The Data Processor is Patrizia Tomasich in compliance with the principles of protection of personal data.
- The Museo dei Bambini SCS Onlus staff is tasked with data processing.
2. Source of personal information
In accordance with Article 13 of the EU Regulation 679/2016, we hereby inform you that the Museo dei Bambini Soc. Coop. Sociale Onlus processes personal data collected from the data subjects who have freely communicated in person and/or by means of forms, telephone or fax their personal information to our offices.
3. Purposes of personal data processing
Il Museo dei Bambini scs Onlus will process personal data collected from the data subjects for the purposes strictly related and instrumental to the activities as specified in the full disclaimer. In accordance with the above-mentioned regulation, the Data Controller shall guarantee that processing of personal data be carried out in the respect of the data subject’s fundamental rights and freedoms, as well as of the data subject’s dignity, specifically for privacy, personal identity and the right of personal data protection.
3.1 All personal data communicated with this disclaimer is processed only for the purposes of taking video and audio recordings, and photos that will be: reproduced and disclosed to promote the Museum and its events
4. Personal data collection and consequences for non-consent to processing
The collection of personal data for the purposes referred to in item 3.1 is optional and therefore not compulsory; consent to processing can be given by selecting the appropriate check box provided at the bottom of this privacy statement and by signing the disclaimer. Should the user not consent to the collection of their personal data, the child’s photo and video recordings cannot be used.
5. Data communication and disclosure
Personal data, i.e. photos, audio and video recordings freely obtained from the data subject will be disclosed on the following channels:
- website pages https://www.mdbr.it;
- Explora Il Museo dei Bambini di Roma Social Media pages, such as FB, Twitter, YouTube, Instagram, Flickr and the like;
- on hardcopy such as banners, leaflets, press releases, newspapers, etc.
- audiovisual channels (such as TV, radio, cinema and similar).
Personal data, whenever necessary, might be communicated to:
5.1 all subjects whose access right is acknowledged pursuant to and for the purposes of law provisions;
5.2 our contractor personnel, employees and suppliers or sponsors, in relation to their tasks and/or our contractual obligations to them, for the purposes of the business relationships with the data subject;
5.3 all public and/or private subjects, individuals and/or legal bodies (legal, administration and tax offices, Courts, etc.), whenever data communication proves necessary or functional to our business and activities;
In the cases described above, only basic data – and no more than basic data – will be communicated for the purposes for which it is communicated.
6. How personal data is processed
Personal data collected from the data subject, including the image contained in the photos/video recordings, will be processed according to the applicable law, in the respect of the principles of fairness, lawfulness, transparency and confidentiality that inspire the activity of the Museo dei Bambini SCS Onlus.
Personal data may be held electronically and on hardcopy and is subject to appropriate safeguards in order to ensure protection and privacy under the GDPR. Data will be processed and stored on premises where access is constantly monitored; in particular, all technical, computer, organisational, logistic and safety procedural safeguards will be adopted so that the appropriate data protection level specified in the regulation is maintained; access will be allowed only to persons tasked with processing by the Data Controller or Data Processors being appointed by the Data Controller.
7. How long personal data will be kept
All data collected (photos, video and audio recordings) will be kept in our databases and it will be published only for information and promotional purposes as well for the institutional use by the Museum. All data collected will be kept in our databases in order to keep a history record of events and activities carried out by the Museum for the purposes of periodical historical publications. Data stored is checked periodically for obsolescence in relation to the purposes for which it has been collected.
8. Rights of the data subject
The data subject can, at any time, exercise the following rights:
a. right of access to personal data: obtain confirmation or not that their personal data is being processed; in this case, the right of access to the following information: purposes, data categories, recipients, how long data will be kept, the right to lodge a complaint with a supervisory authority , the right to rectification or erasure or right to restrict processing or right to object to processing, as well as whether an automated decision-making process is in place;
b. right to rectification or erasure of data or right to restrict processing; “right to restrict processing” means to mark data stored to restrict its processing in future;
- right to object to processing: right to object for reasons related to the data subject’s particular situation of processing data in order to carry out a task of public interest or pursue a legitimate interest;
d. right to data portability; in the case of automated processing done based on consent or for the purpose of a contract, right to receive personal data in a commonly used, machine-readable and structured format; specifically, data will be provided by the Data Controller in word format or similar format;
e. right to revoke consent to processing for the purposes of direct marketing and market analyses; exercising this right does not compromise in any way whatsoever the lawfulness of data processing done prior to the revocation;
f. Right to lodge a complaint with a supervisory authority pursuant to article 77 of GDPR based on the data subjects’ private address, place of work, or place of breach of their rights; for Italy the competent supervisory authority is the Data Protection Authority (Garante per la protezione dei dati personali) who can be contacted through the website http://www.garanteprivacy.it.
The rights described above can be exercised by sending a request to the Data Controller at the following e-mail address firstname.lastname@example.org and contact information included in this privacy statement. The right to object of data subjects to processing of their own personal data for the purposes of disclosing and reproducing photos and audio-video recordings is extended to traditional practices.
Requests related to the exercise of the data subject’s rights will be handled without unjustified delay and within a month from the date of request; only in more complex cases and in the face of a high number of requests, the above term can be extended by 2 (two) more months.