Privacy policy
in compliance with art. 13 GDPR and its implementing national legislation

This page informs you of our policies on the collection, use and disclosure of Personal Data you will provide to Fondazione Piccolo Teatro di Milan – Teatro d’Europa (hereinafter, the “Theater”), whose office is based via Rovello 2, 20121, Milan (MI).

This privacy policy exclusively deals with the collection of data when purchasing or reserving a ticket online, or when purchasing a subscription online on Teatro Piccolo website (whose address is https://www.piccoloteatro.org/en/). The Theater (as Data Controller) and/or other subjects identified will treat the information you will provide only for the purposes in this page indicated, in compliance with Regulation (EU) 2016/679 (hereinafter the "GDPR") and the national law implementing the GDPR (hereinafter these laws will be referred to as the “Applicable Privacy Law”).

1. Identity and contact details of the Data Controller and Data Processor

The Data Controller is the Theater. Within the Theater organizational structure, Carmen Spiazzi is the person accountable for the data processing (namely the Data Processor), born in Milan on 12 November 1964, and resident in Milan in via Mecenate, n. 107 (spiazzic@piccoloteatromilano.it; tel.:02.72.333.210)

2. Data Protection Officer (“D.P.O.”)

You can contact the D.P.O. on this e-mail address: dpo@piccoloteatromilano.it

3. Personal Data treated by the Theater

The Theater will only process the categories of data hereinafter mentioned: your personal details, your contact details (such as the e-mail address), and those information about the payment instruments you have used (such as, as a way of example, the credit card identification details or the relative expiration date).
Pursuant to the GDPR, these data are not “sensitive data”, and will be referred to in this page as "Personal Data" (unless otherwise specified).

4. Purposes and legal basis of data processing
    
   1. The Theater will collect and process your personal data for the following purposes without your consent, being such consent unnecessary for these purposes:
      1. to allow you either online ticket purchasing or booking, as well as online subscriptions' purchasing, on the Theater website;
      2. for the Theater to fulfill its legal, administrative and accounting obligations;
      3. for the purposes instrumental to those aforementioned (such as, for example, sending to your e-mail address the receipt of your purchase, when requested)

2. The Theater will collect and process your personal data with your consent for the following purposes:

1. to report to you any disservices about your purchases (such as, for example, changes or cancellations)
2. to send you information or promotions on the Theater’s shows or activities.
    

5. Modalities of data processing

The personal data processing will be carried out the mean of computerized or telematic tools suitable to guarantee the security and confidentiality of these data. The data processing will be performed by a staff duly trained to comply with the applicable Privacy Law.
 

6. Scope of disclosure and physical storage location of personal data

Your Personal Data will be disclosed only to the following categories of third parties and for the finality listed therein:

1. to those companies dealing with payments, to allow you to purchase and book online tickets and to purchase online the subscriptions, on the Theater website;
2. whether the case, to third parties dealing with the detection and prevention of potentially unlawful acts, fraud and security breaches;
3. to judicial authorities or public authorities, on their request.
    

7. Retention period of personal data

According to the criteria set out in recital 39 and article 5, paragraph 1, letter e) of the GDPR, personal data will be retained for a period of time necessary to perform the service you requested, or for a period of time necessary to pursue the purposes described in the privacy policy. In any case, this retention period cannot be extended beyond the period of two years.
Notwithstanding the retention period, you can always exercise the rights provided for you by the applicable privacy law, in the manner specified hereinafter.

The Theater, pursuant to recital 65 of the GDPR, can retain your personal data for longer periods of time under these circumstances:

1. to fulfill its legal administrative and obligations;
2. to assert its rights in judicial proceedings;
3. to pursue other reasons of public interest (such as, as a way of example, to comply with public authorities’ orders).

8. Your rights under the applicable privacy law

Under the applicable privacy law, without any constraint, you have:
 

1. the right to obtain confirmation of your personal data being processed by the Theater;
2. the right to access to your personal data;
3. the right to know the origin and the purposes of the processing of your personal data, as well as their retention period (or at least to know the criteria to determine such period). You also have the right to know whom third parties your personal data are communicated to;
4. the right to withdraw your consent at any time, where the consent is the legal basis for the processing. However, in such a case there will occur no prejudice to the lawfulness of the processing carried out before the withdrawn;
5. the right to have your personal data collected by the Theater updated or rectified, so to be such data always accurate; 
6. the right to obtain by the Theater the erasure of your personal data (“right to be forgotten”) from the Theater databases and / or archives, including backups;
   Such right can only be exercised where one of the following grounds applies:
   1. the personal data are no longer necessary in relation to the purposes which they were collected for;
   2. whether you withdraw the consent which the processing is based on;
   3. whether you exercise the right to object to the processing, in the manners that will be specified hereinafter;
   4. whether the applicable privacy law provides for such erasure;
   5. whether an unlawful data processing have occurred, and you have been successful to demonstrate so;

Nonetheless, the Theater will not carry out the erasure when the processing of your Personal Data is necessary for one of the reasons referred to in article 17, paragraph 3 of the G.D.P.R. (such as, as a way of example, when the law demands such processing, or for the pursuit of public interest needs);

7. the right to have the data processing restricted when it does apply one of the grounds under art. 18, paragraph 1, GDPR;
8. the right to object to your personal data being processed, when the processing is carried out to pursue public interests or the Theater legitimate interests. Nonetheless, the Theater could overcome this objection if succeeding in demonstrating that the processing is necessary to pursue ineludible legitimate interests or to assert its right in judicial proceedings;
9. to receive your personal data, collected by the Theater for the aforementioned purposes, in a structured, commonly used, machine-readable and interoperable format. You also have the right, without any constraint, to provide such data to third parties;
10. the right to be notified about any rectification or erasure of personal data or restriction of processing carried out by the Theater. You also have the right to be notified about any withdrawn of such measures as well as about the reasons why such withdrawn has occurred.

The Theater will process your application without delay and, in any case, at the latest within one month by the submission of this application.
Nonetheless, the deadline could be extended up to two months more on grounds of complexity and overload of the applications received by the Theater. Should such circumstance occur, the Theater will inform you, within one month by the application submission, on the deadline extension and on the reasons of the extension.
You can exercise your rights by written and informal request addressed to the following e-mail address spiazzic@piccoloteatromilano.it;
If you are not satisfied about the way your application has been handled, You can contact and lodge a complaint with the Data Protection Authority (http://www.garanteprivacy.it/en) by the modalities provided for by the applicable Privacy Law.

Updated November 2018