Memoriale della Shoah di Milano

PRIVACY POLICY STATEMENT

This Privacy Policy Statement is provided pursuant to Article 13 of Italian Legislative Decree no. 196 of 30 June 2003 (D.Lgs. 196/03 – “Personal Data Protection Code”) and describes how the personal data of users of the Memorial website www.memorialeshoah.it (“Website”), owned and operated by Fondazione Memoriale della Shoah di Milano ONLUS (“Foundation”), are processed.

The Foundation processes user data in accordance with principles of propriety, legitimacy and transparency, and protection and respect for user rights.

User personal data will be processed pursuant to applicable laws and regulations, in particular D.Lgs. 196/2003 as currently amended and EC Directives, observing all security measures provided by the Italian Data Protection Authority (Garante per la Privacy) to protect personal and sensitive data.

The following information regarding processing of user personal data is provided pursuant to and in accordance with Article 13 of the Italian Privacy Code.

DATA CONTROLLER

The Data Controller, as defined in Art. 4, Section 1, Letter g) of D.Lgs. 196/2003, is Fondazione Memoriale della Shoah di Milano ONLUS (“Foundation”) with legal headquarters at Via Sally Mayer no. 2, 20144 Milano (MI).

TYPE AND SOURCE OF PERSONAL DATA SUBJECT TO PROCESSING

Navigation data

As part of their normal operations, the IT systems and software processes that allow our website to function acquire certain personal data that are implicitly transferred during use of internet communication protocols. These data are not acquired with the purpose of personally identifying the user. However, given their inherent nature, they could be used, if combined and processed with data held by third parties, to identify the user.

This category of data includes IP addresses or the domain names of user computers that connect to the website, URI (Uniform Resource Identifier) addresses of the accessed resources, the date and time of the request, the method used to submit the request to the server, the size of the file transferred in response, the numeric code indicating the status of the response provided by the server (success, error, etc.), and other user operating system and IT environment parameters.

Navigation data and cookies are used exclusively to obtain anonymous statistical information on how the website is used and whether it is functioning properly. These data may also be used to determine responsibility for any information attacks against the website.

Data provided voluntarily by the user and the purpose of their processing

Registration on the website

The Foundation collects and processes data provided directly and voluntarily by the user when filling out website registration forms.

By registering on the website, users are able to access services provided by the Foundation exclusively to registered users, specifically: online reservation of Memorial tours, participation in events and seminars, requests for information about the Foundation and/or contact request.

These personal data may include, as an example: name and surname, mailing address, email address, telephone, codice fiscale (Italian national identification number, if applicable), birthdate.

Donations

Users wishing to donate to the Foundation will find information and donation forms here.

When making a donation, the user provides the information required by the chosen payment option (PayPal, credit card, credit transfer): name, surname, mailing address, telephone, email.

The Foundation processes user data provided when making a donation exclusively for administrative purposes and for operations associated with payment processing.

Publication of Memorial visitor and supporter data

The Foundation publishes only the names of Memorial visitors and supporters who have given their consent when registering for an event or making a donation.

The names of consenting users may be published in a special section of the website where they can be viewed by all website users.

The published data include the name and surname of the visitor or supporter and also the amount of any donation made to the Foundation.

Foundation news and information

When registering with the website or making a donation to the Foundation, the user is asked whether he or she wishes to receive news and information on Foundation activities, events and initiatives. If so, in addition to data necessary for processing the registration request or donation, the user is also asked to provide an email address. This information is used exclusively for the purpose of sending Foundation news and information to the user.

Cookies

For details on how cookies are used, see the specific Cookie policy.

PURPOSE OF USER PERSONAL DATA PROCESSING

Personal data will be processed by the Foundation for the following purposes:

For the creation of a personal user account allowing the user to access services reserved for registered users;
To allow the user to make reservations for events, discussions or other initiatives organized by the Foundation;
For administrative purposes regarding donations to the Foundation and to manage relations with supporters;
For possible publication of statistical (non-personally identifiable) data on visitors to the Shoah Memorial and on Foundation supporters;
For sending news, information, promotions, catalogues, invitations to exhibitions, events or other initiatives, or offers of Foundation products or services (by mail, email, telephone or other forms of electronic communication) to users who have expressed consent thereto.

Personal data used for statistical purposes are processed in a strictly anonymous form. Except as permitted by law, personal data will not be released or published without user consent.

PROVISION OF PERSONAL DATA

The provision of personal data is optional. Those who choose not to provide their personal data:

will not be able to take advantage of services reserved for registered users;
will not be able to make reservations for events, discussions or other initiatives organized by the Foundation;
will not be able to make a donation to the Foundation;
will not be able to have their names published on the Foundation website on the lists of visitors and/or donors;
will not be able to receive news, information, promotions, catalogues, invitations to exhibitions, events or other initiatives, or offers of Foundation products or services.

Donors who prefer not to have their names published on the list of donations to the Foundation will be listed as “anonymous”. The Foundation cannot guarantee that this attribution can be changed if the donors later choose to have their name listed for the given donation.

PERSONAL DATA PROCESSING METHOD

Personal data provided by users during the registration process are processed by the Foundation as hard copy and/or with computerized means for as long as is strictly necessary to achieve the purposes for which they were collected.

The Data Controller (“Titolare del trattamento” per D.Lgs. 196/03) implements specific security measures to ensure against loss or illicit, unauthorized or otherwise improper use of personal data.

The personal data collected by the Foundation are stored in electronic databases owned by […], the Data Processor (“Responsabile del trattamento” per D.Lgs. 196/03) specifically appointed by the Foundation pursuant to Article 29 of D.Lgs. 196/03. The Data Processor uses its own personnel to process user personal data.

Personal data are processed using methods that minimize the risk of their accidental or deliberate destruction or loss, access by unauthorized parties, processing in ways that the user has not explicitly authorized, and processing for purposes other than those explicitly stated in the Foundation’s Privacy Policy.

The Foundation and all personnel appointed to processing user personal data will implement appropriate administrative, physical, and logical measures to ensure the security and confidentiality of said data, using all the most appropriate means to ensure their proper classification, storage, and confidentiality, including, but not limited to, periodic review, user identification, malware protection, periodic backups, storage in locked cabinets, active and passive fire protection measures, and uninterruptible power supply.

For the purposes indicated above under “Purposes of User Data Processing”, i.e. for the provision of services requested by the user, user personal data may be transmitted to third parties acting as data processors and providing services that contribute to meeting user requests.

MODIFICATIONS TO PRIVACY POLICY STATEMENT

The Foundation may modify its Privacy Policy Statement as necessary in response to changes in national and/or European legislation and technological innovation. Changes to the Privacy Policy will be communicated to users the first time they access the website after the changes have been implemented.

COMMUNICATION OF PERSONAL DATA

User personal data will be accessible by the Data Controller and by the Data Processor(s) appointed by the Data Controller and may be communicated to third parties as provided by law.

Users may request the complete list of Data Processors having access to their personal data.

RIGHTS OF THE DATA SUBJECT

The “Data Subject” according to Article 4, Section 1, Letter i) of D.Lgs. 196/03 is “any natural or legal person, body or association that is the subject of the personal data”. In the specific case, the Data Subject is the user of the Foundation website who provides his or her personal data as outlined above.

The user may exercise at any time the rights provided in Article 7 of D.Lgs. 196/2003, which we list below:

A data subject shall have the right to obtain confirmation as to whether or not personal data concerning him or her exist, whether they are already recorded or not, and communication of such data in intelligible form.
A data subject shall have the right to be informed

of the source of the personal data;

of the purposes and methods of processing;

of the method of processing, if carried out with the support of electronic means;

of the identity of the data controller, data processors and the representative designated above in Article 5, Section 2;

of the parties or categories of entity to which the personal data may be communicated and which may have access to said data in their capacity as designated representative(s) in Italy, data processor(s) or person(s) in charge of the processing.

A data subject shall have the right to

have his or her personal data updated, amended or, if desired, supplemented;

ensure that any of his or her personal data that have been processed unlawfully or are not necessary for the stated purposes for which they have been collected and/or processed will be deleted, rendered anonymous or rendered inaccessible;

certification to the effect that the exercise of rights per Letters a) and b) above is extended to all parties and entities to which the data have been communicated, unless this proves impossible or requires a manifestly disproportionate expenditure of resources compared to the right that is to be protected.

A data subject shall have the right to object, in whole or in part

on legitimate grounds, to the processing of his or her personal data, even where such processing is relevant to the purpose of the collection of said data;

to the processing of his or her personal data for the purpose of advertising, direct marketing or marketing surveys.

Users wishing to exercise their rights per Article 7 of D.Lgs. 196/03 must communicate this the Foundation in writing, either by sending a letter to:

Fondazione Memoriale della Shoah di Milano ONLUS

Piazza Edmond J. Safra n. 1

20125 Milano

or an email to: presidenza@memorialeshoah.it.

Any users deciding to withdraw their consent to the publication of their name on the website as visitors or supporters must communicate this the Foundation in writing, either by sending a letter to:

Fondazione Memoriale della Shoah di Milano ONLUS

Piazza Edmond J. Safra n. 1

20125 Milano

or an email to: presidenza@memorialeshoah.it.

The Foundation will then remove the user’s name from the website.