Information on the Processing of Personal Data

Pursuant to Art. 13 of the EU Regulation 2016/679 (“GDPR”)

1.     Data Controller

The Controller of the Data Processing (hereinafter, the “Processing”) is Veneranda Fabbrica del Duomo di Milano (hereinafter, the “Data Controller” or “VFD”), in the person of its pro tempore legal representative, with its registered office in 20122 Milano (MI), Via Carlo Maria Martini, 1, no. 315 in the Register of Legal Persons in the Prefecture of Milan, tax code and VAT number 01989950157, privacy email address privacy@duomomilano.it.

2.     Type of Processed or Processable Data

Processed or processable Data belong to the category of Personal Data (“Data”), defined as any information relating to an indentified or identifiable natural person (“Interested Party”); an identifiable natural person is one considered to be identified, either directly or indirectly (P26, P27, P30 of GDPR).

3.     Object, Legal Basis, and Purpose of the Processing

Processing is aimed at receiving and managing the donations received from the Interested Party and at fulfilling the related accounting, tax, and insurance obligations of the Data Controller; Processing does not involve any automated decision-making process.

The legal basis and purpose of the Processing reside in the execution of the legal obligations inherent in donations and their related accounting obligations, and include the conservation and archiving of Data strictly connected and instrumental to the execution of that which is indicated (Art. 6, No. 1, Lett. a), b), c), e) of GDPR).

4.     Processing Methods and Scope of Data Communication

Data processing will be based on the principals of correctness, lawfulness, and transparency, in an appropriate manner, and in compliance with the rules of confidentiality and security.

The Processing of Data is carried out electronically by the Data Controller and by other subjects who, selected accordingly in terms of reliability and competence, carry out operations instrumental to the pursuit of the Data Controller’s corporate purpose.

Furthermore, the Data may come to the attention of subjects who process the Data on behalf of the Data Controller, as persons in charge and external managers of the Processing; these subjects, who have been instructed to do so by the Data Controller pursuant to Artt. 28 and 29 of GDPR, will process the Data exclusively for the purposes indicated in this information and in compliance with the provisions of the applicable legislation.

In some cases, for the purpose of fulfilling the legal obligations related to donations, the Data may be made available to third parties (such as the Municipality of Milan, and the Superintendence of Archaeology, Fine Arts and Landscape), who will treat said Data as independent data controllers in compliance with the information provided.

The complete and updated list of Data Processors appointed by the Data Controller can be requested by sending an email to the following address: privacy@duomomilano.it.

5.     Data Transfer

The Data may be processed both inside and outside the European Economic Area in compliance with the rights and guarantees established by current legislation, it being understood that any Data transfer outside of the European Economic Area will occur where adequate conditions are present in the country of transfer or, in any case, subject to the signing of agreements including adequate contractual standards containing clauses approved by the European Commission for Data Protection.

6.     Data Retention

The Data collected to make a donation will be kept for the maximum term of no. 10 (ten) years from the date of the last transaction for the purpose of fulfilling accounting and legal obligations. The Data collected, with the express consent of the Interested Party, for the sending of the newsletter, will be kept for 24 months.

7.     Rights of the Interested Party

Pursuant to Art. 13 of the GDPR, the Interested Party has the right to:

a) Ask the data controller for access to personal Data and the correction or cancellation of said Data, or to limit the processing or to oppose the processing of said Data;

b) Withdraw consent at any time, without prejudice for the lawfulness of the data processing based on the consent given prior to annulment, in relation to data processing founded on the legal basis of consent;

c) Lodge a complaint with the National Supervisory Authority (Guarantor for the Protection of Personal Data);

d) Receive the personal data provided in a structured, commonly-used and readable (on automatic devices) format for portability purposes, where applicable;

To exercise the rights listed above, as well as for any requests regarding the processing of Data and the adopted security measures, it is possible to contact the following email address: privacy@duomomilano.it.

8.     Cookies

This webpage does not use profiling cookies to detect behaviour associated with IP or other information combinable with the user who is browsing the page. Only technical cookies from the page manager and third-party analytics are used, though without the possibility of identifying the Interested Party (IP masking), aimed at improving navigation and usability.