Personal Data Controller

Pursuant to Article 13 of the EU Regulation 2016/679 (hereinafter “GDPR”) Museo Dei Bambini Scs (hereinafter “Data Controller”), Via Flaminia n. 80/86, 00196 Rome, CF/P.IVA 05504141002, Tel. 06 3613776, e-mail privacy@mdbr.it, in its capacity as “Data Controller”, informs you that your personal data collected will be processed in compliance with the aforementioned legislation, in order to guarantee the rights, fundamental freedoms, and dignity of individuals, with particular reference to confidentiality and personal identity

Source of personal data

Pursuant to Article 13 of EU Reg. 2016/679, we inform you that Museo Dei Bambini Scs processes personal data of data subjects who have voluntarily communicated, through registration on the website https://www.explorahub.eu/ their personal data.

3 Purposes of the processing of personal data

According to the indicated law, the Data Controller guarantees that the processing of personal data is carried out with respect for the fundamental rights and freedoms, as well as the dignity of the data subject, with particular reference to confidentiality, personal identity and the right to protection of personal data.

All personal data communicated by data subjects, are processed for fulfillments related to:

Entry of master data into computer databases, to provide registered users with customized an unique software and to fulfill specific requests from them;

• Allow to download specific documentation about the software
• Allow to answer to specific request upon software

The legal bases for processing for the above purposes are Art. 6.1.b) and 6.1.c) of the Regulations, i.e. the execution of a contract or pre-contractual measures and legal obligations.

Personal data may also be used for purposes functional to the promotional activity of the services of Museo Dei Bambini Scs, such as:

• 3.1 marketing purposes, promotion of training courses, teachers registered to the platform, such as receiving and sending communications of a commercial and promotional nature, through mailing lists, proposing new initiatives, communication of new software published and services via email, telephone or mail;;
• 3.2 profiling purposes, sending personalized communications with respect to the preferences encountered by registered users.

The legal basis for the processing of personal data for the purposes mentioned in 3.1 and 3.2 is Article 6.1.a) of the GDPR as the treatments are based on consent.

• 3.3 Detection of the degree of satisfaction with the quality of services offered by means of a satisfaction questionnaire, sent at the same time as sending the ticket purchased online. Completion of the questionnaire is optional and totally anonymous, it is sent in order to comply with the requirements of the EN ISO 9001:2015 quality certification and to be able to make improvements where they are necessary regarding the satisfaction expressed.

The legal basis for the purpose mentioned in section 3.3 is art.6.1 f) i.e. the legitimate interest of the Data Controller

4 – Provision of data and consequences in case of failure to consent to processing

The provision of your data for the purposes referred to in point 3.1 is necessary to enable the provision and management of the service, your refusal to provide the data in question will result in the impossibility of obtaining the use of the service proposed by the Owner

With reference to the purposes of the processing referred to in points 3.1 and 3.2, consent to the processing of data is optional and may be expressed by checking the appropriate box, for each distinct purpose present. Failure to consent will not entail any consequence on the possibility of receiving the requested services and will imply only the consequences described below:

• the impossibility of receiving informative and promotional communications from Museo Dei Bambini Scs;
• the impossibility of receiving personalized training paths.

Communication and dissemination of data

The personal data that interested parties have voluntarily communicated, should it be necessary, may be communicated, to:

• 5.1 all subjects to whom the right of access is recognized by virtue of regulatory provisions;
• 5.2 to our collaborators, employees and suppliers, within the scope of their duties and/or any contractual obligations with them, inherent to business relations with the data subjects;
• 5.3 to post offices, forwarding agents and couriers for sending documentation and/or material;
• 5.4 to all those public and/or private entities, individuals and/or legal entities (legal, administrative and tax consulting firms, Judicial Offices, Chambers of Commerce, Municipality of Rome, etc.), if the communication is necessary or functional for the performance of our activities and in the manner and for the purposes described above;
• 5.5 banking institutions for the management of collections and payments arising from the execution of contracts.

The data may be communicated to third parties appointed as Data Processors pursuant to Article 28 of the GDPR. To the Data Processors or Persons in charge, eventually designated, Museo Dei Bambini Scs gives adequate operating instructions, with particular reference to the adoption and observance of security measures, in order to be able to guarantee the confidentiality and security of the data. The list of Data Processors and Authorized Processors can be consulted at the aforementioned owner’s office. In any case, only data that are essential, and not excessive, with respect to the purposes for which they are communicated will be communicated.

Transfer of data to third countries

The Data Controller does not transfer personal data to third countries.

The modalities of the processing

The processing concerns common personal identification data. Personal data is processed using both paper and computer media with the observance of all precautionary measures to ensure security and confidentiality. The data will also be managed and protected in environments whose access is under constant control; in particular, all technical, IT, organizational, logistical and procedural security measures will be taken so that the appropriate level of data protection required by law is guaranteed, allowing access only to the persons in charge of the processing by the Data Controller or the Managers eventually designated by the same.

Period of data retention

In accordance with the principles of lawfulness, purpose limitation and data minimization, pursuant to Article 5 of GDPR 2016/679, personal data will be retained for the period of time strictly necessary for the pursuit of the specific purposes of the processing for which the user has given his or her consent and, specifically:

for the purposes indicated in point 3.1 for the time necessary for the fulfillment of contractual and fiscal obligations, no longer than 10 years from the time of the collection of your data, for the online shop the data collected are used to provide the service of selling the Training designed by Children’s Museum SCS and functional to the collection of credits through the “Teacher’s Card” platform;

for the purposes indicated in points 3.1 and 3.2, i.e., for direct marketing and profiling purposes, until cancellation or revocation by the data subject from the time of the granting of consent to processing and no later than the term of 10 years, after this term, the data will be kept in an anonymized archive, for the history of records and statistics.

For the purposes indicated in point 3.3, that is, the liking questionnaire, no personal data are collected, being filled in and sent anonymously by the data subject.

Rights of data subjects.

The interested party may, at any time, exercise the following rights:

• Right of access art. 15: to obtain confirmation as to whether or not personal data concerning him or her is being processed, and if so, to obtain access to the personal data;
• Right of rectification Art. 16: To obtain rectification of inaccurate personal data concerning him/her without undue delay;
• Right to be forgotten Art. 17: Obtain the deletion of personal data concerning him/her without undue delay, and the data controller is obliged to delete personal data without undue delay if certain conditions are met;
• Right to restriction of processing Art. 18: Obtain restriction of processing in certain cases;
• Right to data portability art. 20: to receive in a structured, commonly used and machine-readable format the personal data provided concerning him/her and has the right to transmit such data to another Data Controller, without hindrance from the Data Controller to whom he/she provided it, in certain cases;
• Right to object Article 21: to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her;

Withdraw express consent at any time (Conditions for consent art. 7).

To lodge a complaint pursuant to Art. 77 GDPR to the competent supervisory authority based on his or her habitual residence, place of work or the place of violation of his or her rights; for Italy, the competent authority is the Garante per la protezione dei dati personali, which can be contacted through the contact details given on the website http://www.garanteprivacy.it.

The above rights, may be exercised by making a request to the Data Controller, at the contact details given in this notice. The data subject’s right to object to the processing of his or her personal data for marketing purposes, extends to traditional marketing purposes, and in any case, it is without prejudice to the possibility for the data subject to exercise this right in part, i.e., in this case, by objecting, for example, only to the sending of promotional communications carried out through automated means. Requests relating to the exercise of the user’s rights will be processed without undue delay and, in any case, within 30 days of the request; only in cases of particular complexity and the number of requests, this period may be extended by an additional 2 (two) months. Requests to exercise one’s rights may be sent to the e-mail: privacy@mdbr.it

We also remind you that the interested party from his profile, in the Privacy section, by entering the password chosen to access, has the possibility at any time to download all