privacy policy

Gres Art s.r.l. Società Benefit firmly believes that transparency is the basis of his relationship with his users (hereinafter the “Users”). For this reason, Gres Art s.r.l. Società Benefitwishes to be completely transparent regarding the way in which your personal data will be processed when you browse through the websites www.gresart671.org and www.ticket.gresart671.org (hereinafter the “Sites”) and/or request information as well as purchase tickets and/or register for events/workshops through the Sites. This Privacy Policy is provided pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter the "GDPR").

1. Data Controller

The Data Controller is Gres Art s.r.l. Società Benefit(hereinafter the “Data Controller”) whit its registered office at Via San Bernardino, 149/A, 24126 Bergamo (BG), Italy, tax identification and VAT no. 04688290164, in the person of the legal representative pro tempore, domiciled at the Data Controller's registered office. You can contact the Data Controller at the following addresses:

by e-mail: info@gresart671.org;
by postal mail: Via San Bernardino, 141, 24126 Bergamo (BG), Italy.

The Data Controller may appoint other entities responsible for processing (hereinafter the "Data Processors"), as well as authorized subjects to carry out processing operations (hereinafter the "Authorized subjects") pursuant to Articles 28 and 29 of the GDPR. A complete and updated list of Data Processors and Authorized subjects is available by contacting the Data Controller at the contact details above.

2. Type of data processed, purpose of processing, legal basis and nature of data provision

3. Browsing data

When browsing the Sites, the computer systems and software procedures used to operate them acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This category of data includes the IP addresses or domain names of the user’s computers, the URI/URL (Uniform Resource Identifier/Locator) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and computer environment. Browsing data are processed for the following purposes:

to verify the proper functioning of the Sites and the services offered.

When there is a legal obligation browsing data may also be used for the investigation of criminal offences by the Judicial Authorities.

The legal basis for the processing is the legitimate interest of the Data Controller in the proper functioning of the Sites.

The provision of browsing data is necessary for accessing the Sites.

4. Cookie

When browsing the Sites, cookies are used as explained in the Cookie Policy.

5. Personal data provided by the Data subject

When sending requests through the Sites, making purchases or registering for events/exhibitions/workshops as well as when browsing the Sites and/or subscribing to the newsletter, the Data Controller processes your common personal data such as, but not limited to: your first and last name, contact information (e-mail and phone number), zip code, payment instrument information, etc..

Personal data voluntarily provided by you are processed for the following purposes:

manage your requests, sent through the "Contact" form. The legal basis for processing is the execution of pre-contractual and contractual measures taken at the request of the data subject. The provision of data is necessary to enable the Data Controller to reply to your requests.
management of your reservations at the restaurant "Gres Cafe" and/or “Portico”. The legal basis for the processing is the execution of pre-contractual and contractual measures taken at the request of the data subject. The provision of data is necessary to enable the Data Controller to register your reservation;
evaluate your spontaneous application and manage the selection process. The legal basis for the processing of your data is the execution of pre-contractual measures taken at your request, and the provision of data for this purpose is necessary in order to evaluate your application. We ask you not to send data belonging to special categories (e.g., data disclosing health status) if you consider it appropriate to provide such data, including at any subsequent interviews, you will be asked to provide appropriate consent, which you may revoke at any time;
manage your purchases and bookings for visits to exhibitions and/or registration for workshops and events, via the website www.ticket.gresart671.org, including the administrative management of the contract (even where participation is free of charge), the dispatch of tickets, the management of payments, credits and any disputes and prevention of fraud as well as in fulfilment of all obligations required by applicable laws and regulations. The legal bases for the processing are the performance of a contract to which the data subject is a party as well as the fulfilment of legal obligations to which the Data Controller is subject. The provision of data is necessary for the proper management of the contractual relationship;
manage your participation in events, exhibitions and workshops, including the sending of communications and information related to the event/exhibition/workshop, the inclusion of your name in the list of participants, as well as in fulfilment of all obligations required by applicable laws and regulations (e.g., regarding safety). During the event, photos and videos may be taken in areas appropriately marked by signs with specific information on the processing of personal data. Where required, participants will be provided with release forms to be signed, also pursuant to Article 10 of the Italian Civil Code and Articles 96 and 97 of the Italian Copyright Law. Legal bases for the processing are the performance of a contract to which the data subject is a party as well as the fulfilment of legal obligations to which the Data Controller is subject. The provision of data is necessary to enable you to participate in the event/exhibition/workshop.

In addition, with your consent, your personal data may be processed for the purposes of:

marketing, i.e., to contact you by e-mail and/or to send (including by automated means) our newsletter, communications, including those of a commercial nature, informational and advertising material, invitations to workshops, events and initiatives or to invite you to participate in market research or other surveys and/or activities aimed at detecting your degree of satisfaction with respect to the Data Controller's initiatives. Should you decide not to receive any more marketing communications, you may unsubscribe using the appropriate button at the bottom of the commercial e-mails, or by writing to info@gresart671.org. The provision of data and consent is always optional.
save your credit card details or the details of the means of payment used by you, for the sole purpose of facilitating your further purchases. The provision of data and consent is always optional.

6. Personal data of minors

The protection of minors online is a fundamental element of the Data Controller's corporate policy. Therefore, the Data Controller does not accept registrations or orders sent by those who have not reached the age of majority and will not knowingly collect and process personal data of such persons. By purchasing or registering for events, workshops and initiatives or by giving consent to marketing on the Sites, the User declares that he/she has reached the age of majority according to the legislation of his/her country of residence.

7. Third-party advertisers and links to other websites

The Sites may include advertisements from parties other than the Data Controller (hereinafter the "Third Parties") and links to other websites and/or applications. By accessing such websites and/or applications, Third Parties may collect information about you when you interact with their content, advertising, and services under the terms and conditions described in their respective websites/applications.

8. Processing methods and retention time

The Data Controller has taken specific security measures to prevent data loss, unlawful or incorrect use and unauthorized access. Personal data are kept for the time strictly necessary to achieve the purposes for which they were collected. Specifically:

for the management of your requests, the retention time is equal to the time necessary to process your request;
for the management of your reservations at the restaurant "Gres Café" and/or “Portico”, the retention time is equal to the time necessary to manage your reservation;
in order to evaluate your spontaneous application and manage the selection process, the retention time is 12 months from the receipt of the application, in the case of non-employment;
for the management of your purchases and bookings for visits to exhibitions and/or registration for workshops and events, the data will be retained for up to ten years after the purchase/booking or registration as well as for any further period required by law;
for the management of your registration and participation in events, exhibitions and workshops, the data will be kept for the time strictly necessary to ensure your participation in the event/exhibition/workshop as well as for the further period required by law;
for marketing activities, the data will be kept for 5 years from the date you gave your consent;
your credit card details or the details of the means of payment used by you, will be retainedfor 6 months from the date you gave your consent.

To receive more information, you can write by e-mail to info@gresart671.org.

9. Disclosure of data

In order to fulfil specific legal obligations or for reasons strictly functional to the execution of the relationship with the Data Controller, in relation to the above-mentioned purposes, your personal data may be communicated to the following recipients: external consultants in legal, tax and commercial matters, banking institutions, judicial authorities, public bodies and institutions as well as other third parties, in the capacity of Data Processors or autonomous data controllers, in the event that this is strictly necessary to carry out marketing and information activities or for the proper management of the contractual relationship or to fulfil specific legal obligations.

10. Transfer of data outside the European Economic Area (EEA)

Your personal data will not be transferred outside the European Economic Area (EEA). Should it become necessary to transfer data outside the European Economic Area (EEA), the Data Controller will update this Privacy Policy. In any case, any data transfers will be carried out in accordance with and within the limits provided by the applicable legislation and, in particular, Articles 44 et seq. GDPR.

11. Data Subject’s rights

As provided for in Article 13 of the GDPR, the User may at any time:

request from the Data Controller access to his personal data and their rectification or cancellation, or the restriction of the processing of data concerning her/him;
object to the processing of personal data (see also the next paragraph);
exercise the right to data portability;
withdraw consent at any time without affecting the lawfulness of the processing based on the consent given before the revocation;
lodge a complaint with a supervisory authority.

The rights described above in letters a), b), c) and d) may be exercised by making a request to the Data Controller at the following addresses without any formalities:

by e-mail: info@gresart671.org;
by postal mail: Via San Bernardino, 141, 24126 Bergamo (BG), Italy.

12. Right to object

Pursuant to Art. 21 par. 1 and par 2. of the GDPR for processing for marketing purposes you have the right to object, which can be exercised by writing to info@gresart671.org. By writing to this address, you may no longer receive commercial communications from the Data Controller. Furthermore, to unsubscribe from the newsletter service or stop receiving commercial communications, you may also click at any time on the "unsubscribe" link at the bottom of each communication you receive.

13. Amendments

The Data Controller reserves the right to amend this Privacy Policy at any time, including due to changes in applicable legislation, by updating this page. We therefore invite you to periodically check the Privacy Policy for updates.

This Privacy Policy (Rev.0) was issued and is effective from 15.07.2024.

contact policy

In order to manage your request for information and/or your reservations at the restaurant "Gres Cafè" and/or “Portico”, as well as for any additional purposes for which you may consent, Gres Art s.r.l. Società Benefit processes the personal data that you voluntarily provide by filling in the form on the website www.gresart671.org (hereinafter the “Site”).

This Privacy Notice is provided to the Data Subjects in accordance with Article 13 of EU Reg. 679/2016 ("GDPR") by publication on the "contact" page of the Site. You are required to have read the Privacy Notice in order to submit your data.

1. Data Controller

The Data Controller is Gres Art s.r.l. Società Benefit (hereinafter the “Data Controller”) whit its registered office at Via San Bernardino, 149/A, 24126 Bergamo (BG), Italy, tax identification and VAT no. 04688290164, in the person of the legal representative pro tempore, domiciled at the Data Controller's registered office. You can contact the Data Controller at the following addresses:

by e-mail: info@gresart671.org;
by postal mail: Via San Bernardino, 141, 24126 Bergamo (BG), Italy.

The Data Controller may appoint other entities responsible for processing (hereinafter the "Data Processors"), as well as authorized subjects to carry out processing operations (hereinafter the "Authorized subjects") pursuant to Articles 28 and 29 of the GDPR. A complete and updated list of Data Processors and Authorized subjects is available by contacting the Data Controller at the contact details above.

2. Purpose of processing

The data will be processed in order to reply to your requests for information and manage your reservations at the "Gres Cafè" and/or “Portico” restaurant.

3. Nature of data provision

The provision of data is necessary to enable the Data Controller to reply to your requests and/or to register your reservation at the restaurant.

4. Disclosure of data

Your personal data will not be subject to dissemination but may be shared, for the purposes described above, with the following recipients:

subjects typically acting as data processors, i.e. persons or companies appointed by the Data Controller to manage the restaurant;
Persons authorised to process personal data necessary to carry out activities strictly related to the purposes described above or to exercise your rights according to privacy regulations;
subjects, entities or authorities to whom it is mandatory to communicate your personal data under legal provisions or orders by the authorities.

5. Legal basis for the data processing

The legal basis of the processing for the purpose of managing your requests for information and your reservations at the restaurant is Article 6(b) of the GDPR (execution of pre-contractual and contractual measures taken at the request of the data subject).

6. Data retention

The personal data processed for the management of your requests for information will be kept for the time necessary to process the request, while personal data processed for the management of your restaurant reservation will be kept for the time necessary to process your reservation. At the end of the data processing period, the data will be deleted or permanently anonymised. However, data for which there is a legal obligation will be retained.

7. Transfer of data outside the European Economic Area (EEA)

The Data Subject's personal data will not be transferred outside the European Economic Area (EEA).Should it become necessary to transfer data outside the European Economic Area (EEA), the Data Controller will update this Privacy Notice. In any event, any data transfers will be carried out in compliance with and within the limits provided for by applicable legislation and, in particular, by Art. 44 et seq. GDPR.

8. Data Subject’s rights

The Data Subject is entitled to: the right of access to his/her own data; the right to rectification; the right to erasure; the right to restriction of processing; the right to obtain notification in the event of rectification, erasure or restriction; the right to data portability; the right to object; the right to withdraw consent given; the right not to be subject to a decision based solely on automated processing. The exercise of each of these rights is free of charge.

Should the Data Subject notify the Data Controller of his/her intention to exercise one or more of the rights guaranteed to him/her by the GDPR, the Data Controller will provide, without undue delay and, in any case, within one month of the request, information on the actions taken in this regard.

In order to exercise one or more of the rights provided for by the GDPR, the Data Subject may contact the Data Controller at the above-mentioned addresses.

The Data Subject also has the right to lodge a complaint with the supervisory authority (Italian Data Protection Authority).

9. Amendments

The Data Controller reserves the right to amend this Privacy Notice at any time, including due to changes in applicable legislation, by updating this page. We therefore invite you to periodically check the Privacy Notice for updates.

purchases policy

In order to manage your purchases, exhibition bookings and/or registration and participation in workshops and events, as well as for any additional purposes for which you may consent, Gres Art s.r.l. Società Benefit processes the personal data that you voluntarily provide by filling in the form on the website www.gresart671.org (hereinafter the “Site”).

This Privacy Notice is provided to the Data Subjects in accordance with Article 13 of EU Reg. 679/2016 ("GDPR") by publication on the "ticket" page of the Site. You are required to have read the Privacy Notice in order to submit your data.

1. Data Controller

The Data Controller is Gres Art s.r.l. Società Benefit (hereinafter the “Data Controller”) whit its registered office at Via San Bernardino, 149/A, 24126 Bergamo (BG), Italy tax identification and VAT no. 04688290164, in the person of the legal representative pro tempore, domiciled at the Data Controller's registered office. You can contact the Data Controller at the following addresses:

by e-mail: info@gresart671.org;
by postal mail: Via San Bernardino, 141, 24126 Bergamo (BG), Italy.

manage your purchases and bookings for visits to exhibitions and/or registration for workshops and events, including the administrative management of the contract (even where participation is free of charge), the dispatch of tickets, the management of payments, credits and any disputes and prevention of fraud as well as in fulfilment of all obligations required by applicable laws and regulations;
manage your participation in events, exhibitions and workshops, including the sending of communications and information related to the event/exhibition/workshop, the inclusion of your name in the list of participants, as well as in fulfilment of all obligations required by applicable laws and regulations (e.g., regarding safety).

In addition, with your consent, your personal data may be processed for the purposes of:

marketing, i.e. to contact you by e-mail and/or to send you our newsletter, communications, also of a commercial nature, information and advertising material, invitations to workshops, events and initiatives or to invite you to take part in market research or other surveys and/or activities aimed at detecting your degree of satisfaction with respect to the Data Controller's initiatives. Should you decide not to receive any more marketing communications, you may unsubscribe using the appropriate button at the bottom of the commercial e-mails, or by writing to info@gresart671.org.
save your credit card details or the details of the means of payment used by you, for the sole purpose of facilitating your further purchases.

During the event, photos and videos may be taken in areas appropriately marked by signs with specific information on the processing of personal data. Where required, participants will be provided with release forms to be signed, also pursuant to Article 10 of the Italian Civil Code and Articles 96 and 97 of the Italian Copyright Law.

3. Nature of data provision

The provision of data for the management of the contractual relationship and to enable you to participate in the event/exhibition/workshop is necessary, while the provision of data to inform you by e-mail for marketing purposes or to save your credit card data to facilitate your further purchases is always optional.

4. Disclosure of data

Your personal data will not be subject to dissemination but may be shared, for the purposes described above, with the following recipients:

subjects typically acting as data processors i.e. persons or companies appointed by the Controller to manage ticketing and services related to events/exhibitions/workshops;
subjects typically acting as data processors, i.e. persons or companies appointed by the Data Controller to manage the processing and sending of commercial communications and to carry out marketing activities;
Persons authorised to process personal data necessary to carry out activities strictly related to the purposes described above or to exercise your rights according to privacy regulations;
subjects, entities or authorities to whom it is mandatory to communicate your personal data under legal provisions or orders by the authorities.

5. Legal basis for the data processing

The legal basis for the processing of data to manage your purchases and your bookings for visits to exhibitions and/or registration and participation in workshops and events is Article 6 letter b) of the GDPR (execution of pre-contractual and contractual measures taken at the request of the data subject) and Article 6 letter c) of the GDPR (fulfilment of legal obligations to which the Data Controller is subject). The legal basis of data processing for marketing purposes is Article 6 letter a) of the GDPR (consent). The legal basis for the processing of your credit card’s data to facilitate your further purchases is Art. 6 letter a) of the GDPR (consent).

6. Data retention

Personal data are kept for the time strictly necessary to achieve the purposes for which they were collected. In particular:

for the management of your purchases and bookings for visits to exhibitions and/or registration for workshops and events, the data will be retained for up to ten years after the purchase/booking or registration as well as for any further period required by law;
for the management of your registration and participation in events, exhibitions and workshops, the data will be kept for the time strictly necessary to ensure your participation in the event/exhibition/workshop as well as for the further period required by law;
for marketing purposes, the data will be kept for 5 years from the date you gave your consent;
your credit card details or the details of the means of payment used by you, will be retainedfor 6 months from the date you gave your consent.

At the end of the data processing period, the data will be deleted or permanently anonymised.

7. Transfer of data outside the European Economic Area (EEA)

The Data Subject's personal data will not be transferred outside the European Economic Area (EEA).Should it become necessary to transfer data outside the European Economic Area (EEA), the Data Controller will update this Privacy Notice. In any event, any data transfers will be carried out in compliance with and within the limits provided for by applicable legislation and, in particular, by Art. 44 et seq. GDPR.

8. Data Subject’s rights

The Data Subject is entitled to: the right of access to his/her own data; the right to rectification; the right to erasure; the right to restriction of processing; the right to obtain notification in the event of rectification, erasure or restriction; the right to data portability; the right to object; the right to withdraw consent given; the right not to be subject to a decision based solely on automated processing. The exercise of each of these rights is free of charge.

In order to exercise one or more of the rights provided for by the GDPR, the Data Subject may contact the Data Controller at the above-mentioned addresses.

The Data Subject also has the right to lodge a complaint with the supervisory authority (Italian Data Protection Authority).

9. Right to object

Pursuant to Art. 21 par. 1 and par 2. of the GDPR for the purposes of marketing and sending commercial communications you have the right to object, which can be exercised by writing to info@gresart671.org. By writing to this address, you may no longer receive commercial communications from the Controller. In addition, to unsubscribe from the newsletter service or stop receiving commercial communications, you may also click at any time on the 'unsubscribe' link at the bottom of each communication you receive.

10. Amendments

The Data Controller reserves the right to amend this Privacy Notice at any time, including due to changes in applicable legislation, by updating this page. We therefore invite you to periodically check the Privacy Notice for updates.

privacy policy

privacy policy

privacy policy

newsletter policy

newsletter policy

contact policy

contact policy

purchases policy

purchases policy