Gres Art s.r.l. Società Benefit firmly believes that transparency is the basis of his relationship with his users (hereinafter the “Users”). For this reason, Gres Art s.r.l. Società Benefitwishes to be completely transparent regarding the way in which your personal data will be processed when you browse through the websites www.gresart671.org and www.ticket.gresart671.org (hereinafter the “Sites”) and/or request information as well as purchase tickets and/or register for events/workshops through the Sites. This Privacy Policy is provided pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter the "GDPR").
1. Data Controller
The Data Controller is Gres Art s.r.l. Società Benefit(hereinafter the “Data Controller”) whit its registered office at Via San Bernardino, 149/A, 24126 Bergamo (BG), Italy, tax identification and VAT no. 04688290164, in the person of the legal representative pro tempore, domiciled at the Data Controller's registered office. You can contact the Data Controller at the following addresses:
- by e-mail: info@gresart671.org;
- by postal mail: Via San Bernardino, 141, 24126 Bergamo (BG), Italy.
The Data Controller may appoint other entities responsible for processing (hereinafter the "Data Processors"), as well as authorized subjects to carry out processing operations (hereinafter the "Authorized subjects") pursuant to Articles 28 and 29 of the GDPR. A complete and updated list of Data Processors and Authorized subjects is available by contacting the Data Controller at the contact details above.
2. Type of data processed, purpose of processing, legal basis and nature of data provision
3. Browsing data
When browsing the Sites, the computer systems and software procedures used to operate them acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This category of data includes the IP addresses or domain names of the user’s computers, the URI/URL (Uniform Resource Identifier/Locator) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and computer environment. Browsing data are processed for the following purposes:
- to verify the proper functioning of the Sites and the services offered.
When there is a legal obligation browsing data may also be used for the investigation of criminal offences by the Judicial Authorities.
The legal basis for the processing is the legitimate interest of the Data Controller in the proper functioning of the Sites.
The provision of browsing data is necessary for accessing the Sites.
4. Cookie
When browsing the Sites, cookies are used as explained in the Cookie Policy.
5. Personal data provided by the Data subject
When sending requests through the Sites, making purchases or registering for events/exhibitions/workshops as well as when browsing the Sites and/or subscribing to the newsletter, the Data Controller processes your common personal data such as, but not limited to: your first and last name, contact information (e-mail and phone number), zip code, payment instrument information, etc..
Personal data voluntarily provided by you are processed for the following purposes:
- manage your requests, sent through the "Contact" form. The legal basis for processing is the execution of pre-contractual and contractual measures taken at the request of the data subject. The provision of data is necessary to enable the Data Controller to reply to your requests.
- management of your reservations at the restaurant "Gres Cafe" and/or “Portico”. The legal basis for the processing is the execution of pre-contractual and contractual measures taken at the request of the data subject. The provision of data is necessary to enable the Data Controller to register your reservation;
- evaluate your spontaneous application and manage the selection process. The legal basis for the processing of your data is the execution of pre-contractual measures taken at your request, and the provision of data for this purpose is necessary in order to evaluate your application. We ask you not to send data belonging to special categories (e.g., data disclosing health status) if you consider it appropriate to provide such data, including at any subsequent interviews, you will be asked to provide appropriate consent, which you may revoke at any time;
- manage your purchases and bookings for visits to exhibitions and/or registration for workshops and events, via the website www.ticket.gresart671.org, including the administrative management of the contract (even where participation is free of charge), the dispatch of tickets, the management of payments, credits and any disputes and prevention of fraud as well as in fulfilment of all obligations required by applicable laws and regulations. The legal bases for the processing are the performance of a contract to which the data subject is a party as well as the fulfilment of legal obligations to which the Data Controller is subject. The provision of data is necessary for the proper management of the contractual relationship;
- manage your participation in events, exhibitions and workshops, including the sending of communications and information related to the event/exhibition/workshop, the inclusion of your name in the list of participants, as well as in fulfilment of all obligations required by applicable laws and regulations (e.g., regarding safety). During the event, photos and videos may be taken in areas appropriately marked by signs with specific information on the processing of personal data. Where required, participants will be provided with release forms to be signed, also pursuant to Article 10 of the Italian Civil Code and Articles 96 and 97 of the Italian Copyright Law. Legal bases for the processing are the performance of a contract to which the data subject is a party as well as the fulfilment of legal obligations to which the Data Controller is subject. The provision of data is necessary to enable you to participate in the event/exhibition/workshop.
In addition, with your consent, your personal data may be processed for the purposes of:
- marketing, i.e., to contact you by e-mail and/or to send (including by automated means) our newsletter, communications, including those of a commercial nature, informational and advertising material, invitations to workshops, events and initiatives or to invite you to participate in market research or other surveys and/or activities aimed at detecting your degree of satisfaction with respect to the Data Controller's initiatives. Should you decide not to receive any more marketing communications, you may unsubscribe using the appropriate button at the bottom of the commercial e-mails, or by writing to info@gresart671.org. The provision of data and consent is always optional.
- save your credit card details or the details of the means of payment used by you, for the sole purpose of facilitating your further purchases. The provision of data and consent is always optional.
6. Personal data of minors
The protection of minors online is a fundamental element of the Data Controller's corporate policy. Therefore, the Data Controller does not accept registrations or orders sent by those who have not reached the age of majority and will not knowingly collect and process personal data of such persons. By purchasing or registering for events, workshops and initiatives or by giving consent to marketing on the Sites, the User declares that he/she has reached the age of majority according to the legislation of his/her country of residence.
7. Third-party advertisers and links to other websites
The Sites may include advertisements from parties other than the Data Controller (hereinafter the "Third Parties") and links to other websites and/or applications. By accessing such websites and/or applications, Third Parties may collect information about you when you interact with their content, advertising, and services under the terms and conditions described in their respective websites/applications.
8. Processing methods and retention time
The Data Controller has taken specific security measures to prevent data loss, unlawful or incorrect use and unauthorized access. Personal data are kept for the time strictly necessary to achieve the purposes for which they were collected. Specifically:
- for the management of your requests, the retention time is equal to the time necessary to process your request;
- for the management of your reservations at the restaurant "Gres Café" and/or “Portico”, the retention time is equal to the time necessary to manage your reservation;
- in order to evaluate your spontaneous application and manage the selection process, the retention time is 12 months from the receipt of the application, in the case of non-employment;
- for the management of your purchases and bookings for visits to exhibitions and/or registration for workshops and events, the data will be retained for up to ten years after the purchase/booking or registration as well as for any further period required by law;
- for the management of your registration and participation in events, exhibitions and workshops, the data will be kept for the time strictly necessary to ensure your participation in the event/exhibition/workshop as well as for the further period required by law;
- for marketing activities, the data will be kept for 5 years from the date you gave your consent;
- your credit card details or the details of the means of payment used by you, will be retainedfor 6 months from the date you gave your consent.
To receive more information, you can write by e-mail to info@gresart671.org.
9. Disclosure of data
In order to fulfil specific legal obligations or for reasons strictly functional to the execution of the relationship with the Data Controller, in relation to the above-mentioned purposes, your personal data may be communicated to the following recipients: external consultants in legal, tax and commercial matters, banking institutions, judicial authorities, public bodies and institutions as well as other third parties, in the capacity of Data Processors or autonomous data controllers, in the event that this is strictly necessary to carry out marketing and information activities or for the proper management of the contractual relationship or to fulfil specific legal obligations.
10. Transfer of data outside the European Economic Area (EEA)
Your personal data will not be transferred outside the European Economic Area (EEA). Should it become necessary to transfer data outside the European Economic Area (EEA), the Data Controller will update this Privacy Policy. In any case, any data transfers will be carried out in accordance with and within the limits provided by the applicable legislation and, in particular, Articles 44 et seq. GDPR.
11. Data Subject’s rights
As provided for in Article 13 of the GDPR, the User may at any time:
- request from the Data Controller access to his personal data and their rectification or cancellation, or the restriction of the processing of data concerning her/him;
- object to the processing of personal data (see also the next paragraph);
- exercise the right to data portability;
- withdraw consent at any time without affecting the lawfulness of the processing based on the consent given before the revocation;
- lodge a complaint with a supervisory authority.
The rights described above in letters a), b), c) and d) may be exercised by making a request to the Data Controller at the following addresses without any formalities:
- by e-mail: info@gresart671.org;
- by postal mail: Via San Bernardino, 141, 24126 Bergamo (BG), Italy.
12. Right to object
Pursuant to Art. 21 par. 1 and par 2. of the GDPR for processing for marketing purposes you have the right to object, which can be exercised by writing to info@gresart671.org. By writing to this address, you may no longer receive commercial communications from the Data Controller. Furthermore, to unsubscribe from the newsletter service or stop receiving commercial communications, you may also click at any time on the "unsubscribe" link at the bottom of each communication you receive.
13. Amendments
The Data Controller reserves the right to amend this Privacy Policy at any time, including due to changes in applicable legislation, by updating this page. We therefore invite you to periodically check the Privacy Policy for updates.
This Privacy Policy (Rev.0) was issued and is effective from 15.07.2024.