Privacy Policy

Privacy Policy (Art. 13 GDPR)

Data Controller
Italian & International Patrons of the Arts in the Vatican Museums – Non Profit Organization
Via Francesco Cherubini 4, 00135 Rome – Italy
Email: presidenza@vaticanpatrons.it

1) Types of Data Processed

• Identification and contact data: name, surname, email, telephone number, address (if required for membership or receipts), profession/qualification (if relevant for membership), and any institution/organization of affiliation.
• Data relating to membership: registration date, membership fee paid, participation in activities, events, and initiatives; communication preferences (opt-in/opt-out).
• Browsing data and cookies: as described in the website’s Cookie Policy.
• Any additional data provided voluntarily by the data subject through forms or correspondence.

2) Purposes and Legal Bases of Processing

a) Management of the membership relationship, including: application processing, member registration, collection of membership fees, and operational communications related to association activities (meetings, renewals, minutes, updates on association projects).
Legal basis: performance of the membership relationship (Art. 6.1.b GDPR) and compliance with legal obligations (Art. 6.1.c GDPR: accounting, non-profit taxation).

b) Sending newsletters and communications regarding projects, cultural initiatives, invitations, and events of the association (including updates on becoming a Patron of the Arts and special inaugurations).
Legal basis: consent (Art. 6.1.a GDPR). Consent is optional and may be withdrawn at any time (via unsubscribe link or by emailing the Data Controller).

c) Sharing contact data with the Office for Patron Relations of the Vatican Museums for purposes strictly related to membership or participation in activities/visits/initiatives reserved for Patrons (e.g., invitations to special visits, tour coordination).
Legal basis: specific and separate consent (Art. 6.1.a GDPR). Failure to provide consent does not affect membership or newsletter subscription.

d) Website security, prevention of abuse/SPAM, anonymous statistics, and management of requests sent via forms.
Legal bases: legitimate interest of the Data Controller (Art. 6.1.f GDPR) to ensure the security and proper functioning of the website; alternatively, consent for specific tools (e.g., non-technical cookies) where required.

3) Nature of Data Provision

• Data necessary for managing the membership relationship and fulfilling legal obligations are mandatory: without them, membership cannot be processed or maintained.
• Consent for newsletters and data sharing with the Vatican Museums Office is optional and separate.

4) Recipients and Categories of Recipients

• Individuals authorized to process data by the Data Controller (administrative and communications staff).
• External data processors pursuant to Art. 28 GDPR (e.g., email/newsletter providers, hosting services, CRM/management systems, administrative/accounting consultants, IT and security service providers). The updated list of processors is available upon request.
• The Office for Patron Relations of the Vatican Museums, only if specific consent has been given (see §2c).
• Authorities and public bodies when required by law.

5) Transfers Outside the EU

Data sharing with the Office for Patron Relations of the Vatican Museums may involve a transfer of data to a territory outside the EU (the Vatican City State is not part of the EU).
In the absence of an adequacy decision or appropriate safeguards, such transfer will occur only with your explicit consent (Art. 49.1.a GDPR), provided via a dedicated checkbox.

Certain IT service providers (e.g., email/newsletter, cloud services) may process data in non-EEA countries; in such cases, the Data Controller ensures the presence of adequate safeguards (Arts. 44–49 GDPR), such as Standard Contractual Clauses or supplementary measures.

6) Data Retention Periods

• Membership and administrative/accounting data: retained for the entire duration of the membership and, after termination, for as long as required by law (typically 10 years for fiscal/accounting documentation).
• Newsletter and institutional marketing data: retained until consent is withdrawn (opt-out) or deletion is requested.
• Data collected via contact forms: retained for the time necessary to process the request and ensure any protection (approximately 12–24 months).
• Technical/security log data: retained for proportionate technical cycles (e.g., 6–12 months), unless further retention is required for the detection of unlawful acts.

7) Data Subject Rights

You may exercise at any time the rights provided under Arts. 15–22 GDPR: access, rectification, erasure, restriction, portability, objection (including objection to marketing), and withdrawal of consent, without affecting the lawfulness of processing based on consent prior to withdrawal.

To exercise your rights, please write to presidenza@vaticanpatrons.it
.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali – www.garanteprivacy.it
).

8) Minors

The association’s activities are intended for adults. Any membership or data collection involving minors requires the consent of the holder of parental responsibility.

9) Cookies and Third-Party Services

The website uses technical cookies and, upon consent, may also use analytics or profiling cookies and third-party services (e.g., reCAPTCHA, maps, fonts, social widgets).
Usage methods, types, and preferences are described in the Cookie Policy (banner and dedicated page), where you may modify your choices at any time.

10) Amendments to this Policy

The Data Controller may update this Privacy Policy to reflect regulatory or organizational changes. Please check the date of the latest revision.

Last updated: [October 2025]

---

 

 

Italian & International Patrons of the Arts in the Vatican Museums – Non Profit Organization

Via Francesco Cherubini 4, 00135 Roma – Italia

Email: presidenza@vaticanpatrons.it

 

 

a) Gestione del rapporto associativo, incluse: istruttoria di adesione, registrazione soci, riscossione quota, invio di comunicazioni operative legate alla vita associativa (convocazioni, rinnovi, verbali, aggiornamenti su progetti dell’associazione).

Base giuridica: esecuzione del rapporto associativo (art. 6.1.b GDPR) e adempimento di obblighi di legge (art. 6.1.c GDPR: contabilità, fiscalità del non-profit).

b) Invio di newsletter e comunicazioni su progetti, iniziative culturali, inviti ed eventi dell’associazione (inclusi aggiornamenti sul diventare Patron of the Arts e su inaugurazioni speciali).

Base giuridica: consenso (art. 6.1.a GDPR). Il consenso è facoltativo e revocabile in ogni momento (link di disiscrizione o email al Titolare).

c) Condivisione dei dati di contatto con l’Ufficio Relazioni con i Patrons delle Arti dei Musei Vaticani per finalità strettamente collegate all’adesione o alla partecipazione ad attività/visite/iniziative riservate ai Patrons (es. inviti a visite speciali, coordinamento tour).

Base giuridica: consenso specifico e separato (art. 6.1.a GDPR). Il mancato consenso non pregiudica l’adesione all’associazione o la ricezione della newsletter.

d) Sicurezza del sito, prevenzione abusi/SPAM, statistica anonima, gestione richieste inviate tramite form.

Basi giuridiche: legittimo interesse del Titolare (art. 6.1.f GDPR) a garantire sicurezza e buon funzionamento del sito; in alternativa consenso per specifici strumenti (es. cookie non tecnici) ove richiesto.

 

 

 

La condivisione con l’Ufficio Relazioni con i Patrons delle Arti dei Musei Vaticani può comportare un trasferimento di dati verso un territorio fuori dall’UE (Stato della Città del Vaticano non è nell’UE). In assenza di una decisione di adeguatezza o di garanzie adeguate, tale trasferimento avverrà solo sulla base del tuo consenso esplicito (art. 49.1.a GDPR) prestato tramite apposita casella separata.

Alcuni fornitori IT (es. email/newsletter, cloud) potrebbero trattare dati in Paesi extra-SEE: in tal caso il Titolare verifica l’esistenza di garanzie adeguate (artt. 44-49 GDPR), come Clausole Contrattuali Standard o misure supplementari.

 

 

Puoi esercitare in qualsiasi momento i diritti previsti dagli artt. 15–22 GDPR: accesso, rettifica, cancellazione, limitazione, portabilità, opposizione (inclusa l’opposizione al marketing), nonché revoca del consenso senza pregiudicare la liceità del trattamento basata sul consenso prima della revoca.

Per esercitare i diritti: scrivi a presidenza@vaticanpatrons.it.

Hai inoltre diritto a proporre reclamo al Garante per la protezione dei dati personali (www.garanteprivacy.it).

 

Le attività dell’associazione sono rivolte ad adulti. L’eventuale adesione o raccolta dati di minori richiede il consenso del titolare della responsabilità genitoriale.

 

Il sito utilizza cookie tecnici e, previo consenso, eventuali cookie di misurazione o profilazione e servizi terzi (es. reCAPTCHA, mappe, font, social widget). Le modalità d’uso, le tipologie e le preferenze sono descritte nella Cookie Policy (banner e pagina dedicata), dove puoi modificare in ogni momento le scelte.

 

Il Titolare può aggiornare la presente informativa per adeguarla a evoluzioni normative o organizzative. Ti invitiamo a verificare la data di ultima modifica.