Privacy Policy

in accordance with art. 13 and art. 14, Regolamento UE 2016/679

(General Data Protection Regulation – GDPR)

Why This Notice

This page describes how the site is managed with reference to the processing of the personal data of users who consult it. Following consultation of this site, data relating to identified or identifiable persons may be processed.
This information is provided pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR 2016/679), to those who interact with the web services of Fondazione Teatro Regio di Parma (hereinafter “Foundation”) for the protection of personal data, accessible electronically from the address: www.teatroregioparma.it

The information is provided only for the Foundation’s website and not for other websites that may be consulted by the user via links.
The information is also inspired by Recommendation no. 2/2001 that the European authorities for the protection of personal data, gathered in the Group established by Article 29 of Directive no. 95/46/EC, adopted on 17 May 2001 to identify some minimum requirements for the collection of personal data online, and, in particular, the methods, times and nature of the information that the data controllers must provide to users when they link to web pages, regardless of the purpose of the link.

Type of data processed
Browsing data
The computer systems and software procedures used to operate these websites acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.
This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.
This category of data includes the IP addresses or domain names of the computers used by users who connect to the site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters related to the user’s operating system and IT environment.
These data are used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning and are deleted immediately after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the site: except for this eventuality, at present the data on web contacts do not persist for more than seven days.

Data provided voluntarily by the user
The Foundation will process the personal data that the user provides at the time of requesting a specific service or in any case as part of the relationship with the portal www.teatroregioparma.it
Such data may include:
Identification data (first and last name)
Contact details (email address and telephone)
Professional data (company, school, etc.)

With regard to the “Ticketing” section on the website, the related data processing is governed according to the methods and purposes indicated in the information in the specific section to which reference is made in full.
With reference to the “reserved” section of the website, it should be noted that:
• The reserved area will be divided into four distinct access profiles, each characterized by specific functions and contents that can be consulted in relation to the type of associated profile.
• Within the reserved area it will not be possible to independently upload documents or further information; users will only be able to consult their personal information (such as, for example, the status of subscription to the newsletter or other services requested) as well as download the documentation made available by the Foundation according to the profile to which they belong.
• In order to allow the display of tickets purchased for the Foundation’s shows through the Vivaticket portal, the system will make a call to the relevant platform, allowing the user to consult them within their reserved area.

Purposes and legal bases of the processing
The personal data you provide will be used for the following purposes:

a) manage correct navigation on the website (art. 6 para. 1 l. b of the GDPR);
b) manage requests for information in relation to the specific forms present in the various areas of the site (art. 6 par. 1 l. b of the GDPR);
c) manage registration and access to the reserved area of the site, allowing the user to consult their information and download any dedicated material (art. 6 par. 1 l. b of the GDPR);
d) subject to specific consent, to receive periodic updates, information content and news through the Foundation’s newsletter service (art. 6 par. 1 l. a of the GDPR)
e) subject to specific consent, for the sending, by e-mail, of commercial, promotional and informative communications relating to the services and initiatives of the Data Controller (art. 6 par. 1 l. a of the GDPR)
f) to comply with obligations deriving from legal provisions both in civil and tax matters, EU legislation, as well as rules, codes or procedures approved by Authorities and other competent institutions.
In addition, they may be processed to follow up on requests from the competent administrative or judicial authority and, more generally, from public bodies in compliance with legal formalities (Article 6 paragraph 1 letter c GDPR).

Data Controller, Data Processor and DPO
The Data Controller is Fondazione Teatro Regio di Parma in the person of its legal representative.
The list of External Data Processors is constantly updated and can be consulted at the company’s registered office.
The Company has appointed a DPO who can be contacted at the e-mail address dpo@teatroregio.it.

Nature of the Contribution
The provision of data is mandatory with regard to the purposes indicated in letters a), b), c) and f): any refusal to provide the data will make it impossible for the Foundation to proceed with the complete provision of the services offered.
For the purposes referred to in letters d) and e), the provision of data is optional and any refusal will make it impossible to receive informative and commercial communications.

Processing methods
All personal data are processed mainly through electronic tools and methods; however, processing by paper means is not excluded a priori.
The data will be stored in a form that allows the identification of the data subjects only for the time strictly necessary to achieve the purposes for which the data were originally collected and, in any case, within the limits of the law.
In order to ensure that your personal data is always accurate, up-to-date, complete and relevant, we invite users and other interested parties to keep their data up to date by reporting any changes to the following email address: …………[BA1.1]
Security measures will be used to guarantee the confidentiality of the data subject to whom such data refer and to avoid undue access to third parties or unauthorized personnel.

Data retention
Personal data will be processed only for the time necessary in relation to the purposes described above, and in particular:
• with regard to the data processed for the purposes referred to in letter a), see the Cookie Policy document
• with regard to the data processed for the purposes referred to in letter b) for XXXX[BA2.1] from the transmission of the request
• with regard to the data processed for the purposes referred to in letter c), for 24 months from registration in the reserved area
• with regard to the data processed for the purposes referred to in letter d), for 2 years from the issuance of consent
• with regard to the data processed for the purposes referred to in letter e), for 2 years from the issuance of consent
• with regard to the data processed for the purposes referred to in letter f) for 10 years.

The user can always request the interruption of the processing or the deletion of the data

Place of data processing
The processing related to the web services of this site takes place at the legal and operational headquarters of Delicius and is only handled by specifically appointed personnel; the data are also processed in any other place where the parties involved in the processing are located. In particular, all data relating to the website, as well as the related backup copies, are stored on servers hosted in data centers within the European Union [BA3.1]and compliant with current EU regulations.
For further information, please contact the Data Controller.

Disclosure of data to third parties
No data will be disseminated. Should communication to third party suppliers, consultants or partners be necessary for needs related to the provision of services, the Data Controller will be responsible for appointing the latter as data processors pursuant to Article 28 of the Regulation, by virtue of the ability, experience and reliability demonstrated.
It is understood that users’ personal data may be freely communicated to third parties, such as police forces or other public administrations, whenever this is permitted by law or required by an order or provision of a competent authority. These subjects will process the data as independent data controllers.

Ownership of the processing of cookies
Since the installation of Cookies and other tracking systems operated by third parties through the services used within this site cannot be technically controlled by the Data Controller, any specific reference to Cookies and tracking systems installed by third parties is to be considered indicative.
Given the objective complexity linked to the identification of technologies based on Cookies and their very close integration with the functioning of the web, the user is invited to contact the Data Controller if he wishes to receive any further information relating to the use of Cookies themselves and any use of the same – for example by third parties – carried out through this site.

Security of personal data
Adequate security measures are adopted in order to minimize the risks of destruction or loss – even accidental – of data, unauthorized access or processing that is not permitted or does not comply with the collection purposes indicated in this Privacy Policy.
The transfer, storage and processing of your data collected through the Site is ensured by means of appropriate technical measures. However, the Foundation cannot guarantee its users that the measures adopted for the security of the Site and the transmission of data and information on the Site limit or exclude any risk of unauthorized access or dispersion of data by devices pertaining to the user: We advise you to ensure that your device is equipped with adequate software to protect the transmission of data over the network, both incoming and outgoing (such as up-to-date antivirus systems) and that your Internet service provider has adopted appropriate measures for the security of data transmission over the network (such as firewalls and anti-spam filters).

Rights of the data subject
At any time, you may exercise, pursuant to art. 15-22 of EU Regulation 2016/679, the right to:
a) request confirmation of the existence or otherwise of their personal data and, if so, obtain access to the personal data and information indicated in point b) below;
b) obtain information about the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed (in particular if recipients of third countries or international organisations) and, where possible, the retention period;
c) obtain the rectification and deletion of data;
d) withdraw your consent at any time (however, withdrawing your consent does not affect the lawfulness of processing based on consent before its withdrawal);
e) obtain the restriction of processing;
f) obtain data portability, i.e. receive them from a data controller, in a structured, commonly used and machine-readable format, and transmit them to another data controller without hindrance;
g) object to the processing at any time and also in the case of processing for direct marketing purposes;
h) object to automated decision-making related to natural persons, including profiling;
i) obtain confirmation of compliance with the provisions of art. 19 of EU Regulation 2016/679 for the Data Controller, i.e. the communication – to each of the recipients to whom the personal data have been transmitted – of any rectifications or cancellations or limitations of processing carried out pursuant to art. 16 EU Regulation 2016/679, except in the case where this fulfilment proves impossible or involves a disproportionate effort;
j) lodge a complaint with the competent supervisory authority.

To assert the rights of the data subject and/or to request further information, you may contact the Data Controller Fondazione Teatro Regio di Parma, with registered office and processing office in Strada Garibaldi 16/a, 43121, Parma (PR); tel. 0521 203911, e-mail: xxxxxxx[BA4.1] or by contacting the DPO at the e-mail address dpo@teatroregio.it