Privacy Policy

Home / Privacy Policy

 

Pursuant to Article 13 of Regulation (EU) 2016/679
Last updated: 18 August 2026

1. Purpose of this Privacy Policy

This Privacy Policy describes how Associazione Museo Nicolis processes the personal data of users who visit and use the website www.museonicolis.com, complete the forms available on the website, request information, subscribe to the newsletter, or use the booking, ticketing and other online services connected with the Museum.

This Privacy Policy is provided pursuant to Article 13 of Regulation (EU) 2016/679 (the “GDPR”) and the applicable Italian legislation on the protection of personal data. This Privacy Policy applies exclusively to processing carried out by the Data Controller through this website. Any third-party websites, platforms and services that may be accessed through external links are governed by their respective privacy policies.

2. Data Controller

The Data Controller is:

Associazione Museo Nicolis
Via Lussemburgo 9
37069 Villafranca di Verona (VR), Italy
VAT number: 03062140235
Email: privacy@museonicolis.com

For any request concerning the processing of personal data or the exercise of data protection rights, the Data Controller may be contacted at the email address indicated above.

3. Categories of personal data processed

The following categories of personal data may be processed through the website.

3.1 Browsing data

During their normal operation, the IT systems and software procedures used to operate the website acquire certain data whose transmission is inherent in the use of Internet communication protocols. Such data may include, by way of example:

  • IP address;
  • type of browser and device used;
  • operating system;
  • date and time of the request;
  • pages visited and address of the referring page;
  • outcome of the request;
  • technical and diagnostic information necessary for the operation and security of the website.

This information is used to enable browsing, ensure the proper operation of the website, prevent misuse and cyberattacks, and obtain aggregate statistical information on the use of the services.

3.2 Data provided voluntarily by the user

Sending requests through the forms available on the website, by email or through the other contact details provided entails the processing of data voluntarily supplied by the user. Depending on the service used, such data may include:

  • first name and surname;
  • email address;
  • telephone number;
  • company, body or organisation to which the user belongs;
  • information relating to bookings, visits, events or quotation requests;
  • information required for invoicing;
  • the content of the message and any further information provided by the user.

Users are requested not to submit special categories of personal data, such as information concerning health, religious or philosophical beliefs, political opinions or other particularly sensitive information, unless this is strictly necessary and has been expressly requested by the Museum.

3.3 Booking and purchase data

When a user makes a booking or purchases a ticket, the data necessary for the following purposes may be processed:

  • identifying the purchaser or the person responsible for the booking;
  • managing the visit or requested service;
  • sending confirmations and service-related communications;
  • complying with administrative, accounting and tax obligations;
  • managing any changes, cancellations, refunds or disputes.

Where a booking or payment is made through an external platform, the data are also processed by the relevant provider according to the role it performs and the privacy policy made available during the purchase or booking process. Any complete payment instrument details are processed by the payment service provider and are not used by the Museum for purposes other than managing the transaction and the related obligations.

3.4 Newsletter data

When a user subscribes to the newsletter, the user’s email address and any additional information requested in the subscription form are processed. Subscription is optional, and promotional or informational communications are sent exclusively on the basis of the data subject’s consent. Users may withdraw their consent at any time by using the unsubscribe link included in each communication or by writing to privacy@museonicolis.com.

3.5 Cookies and other tracking technologies

The website uses cookies and similar technologies. Strictly necessary technical cookies may be used without consent to the extent required for the operation and security of the website. Non-essential preference, statistics or marketing cookies and tools are used only after the user has given consent through the cookie management panel.

Detailed information about the cookies used, their providers, purposes and retention periods is available in the Cookie Policy. Users may change or withdraw their cookie preferences at any time by using the cookie settings link or button available on the website.

4. Purposes, legal bases and retention periods

4.1 Operation and security of the website

Browsing data are processed in order to:

  • enable access to and browsing of the website;
  • keep the website operational and secure;
  • identify errors, malfunctions, unusual access or attempted attacks;
  • prevent misuse and fraud;
  • protect the rights of the Data Controller and users.

The legal basis is the Data Controller’s legitimate interest in ensuring the security, integrity and proper operation of its systems, pursuant to Article 6(1)(f) of the GDPR. Technical and security logs are retained for a maximum period of 180 days, unless a longer retention period is necessary to investigate malfunctions, security incidents or fraud, or to comply with requests from public authorities.

4.2 Managing contact and information requests

The data provided by the user are processed to respond to requests for information, availability, quotations, visits, events, conferences, collaborations or other Museum services. The legal basis is the performance of pre-contractual measures taken at the data subject’s request or the performance of a contract, pursuant to Article 6(1)(b) of the GDPR.

Where the request is not of a pre-contractual nature, processing is based on the Data Controller’s legitimate interest in responding to communications received and managing its relationships with the public, pursuant to Article 6(1)(f) of the GDPR. The data are retained for the time required to manage the request and, as a rule, for no longer than 24 months after the relevant communication has been concluded, unless a contractual relationship is established or further retention is required to comply with legal obligations or protect a right.

4.3 Bookings, ticketing and requested services

Data are processed to manage bookings, purchases, visits, services and any subsequent requests. The legal basis is the performance of a contract or pre-contractual measures taken at the data subject’s request, pursuant to Article 6(1)(b) of the GDPR. Data required for administrative, accounting and tax purposes are also processed to comply with legal obligations, pursuant to Article 6(1)(c) of the GDPR. Data relating to the contractual relationship are retained for the duration of that relationship and thereafter for the period required by applicable legislation. Administrative, accounting and tax documents may be retained for ten years, unless a longer period is required by law or is necessary for the protection of a right.

4.4 Newsletter and promotional communications

Data are processed to send newsletters, updates about the Museum’s activities, invitations, cultural initiatives and other informational or promotional communications. The legal basis is the data subject’s consent, pursuant to Article 6(1)(a) of the GDPR. Providing data for this purpose is optional, and refusing consent does not prevent the use of the Museum’s other services. The data are retained until consent is withdrawn or an unsubscribe request is received. Following unsubscription, the email address may be retained on a suppression list for the period necessary to ensure that no further communications are sent. Information required to demonstrate the consent previously given may be retained to the extent necessary to comply with legal obligations and protect the Data Controller’s rights.

4.5 Statistics cookies, external content and marketing

Data collected through non-essential statistics cookies, embedded content, advertising tools or marketing technologies are processed exclusively on the basis of the user’s consent, pursuant to Article 6(1)(a) of the GDPR. Consent may be refused or withdrawn at any time without affecting the user’s ability to use the website’s essential features. The relevant retention periods are specified in the Cookie Policy and in the dynamic cookie declaration available on the website.

4.6 Legal obligations and protection of rights

Data may be processed in order to:

  • comply with obligations imposed by laws, regulations or decisions of public authorities;
  • respond to requests from competent authorities;
  • establish, exercise or defend a right in judicial or out-of-court proceedings;
  • prevent and combat unlawful or fraudulent activities.

The legal basis is compliance with a legal obligation, pursuant to Article 6(1)(c) of the GDPR, or the Data Controller’s legitimate interest in protecting its rights, pursuant to Article 6(1)(f) of the GDPR. Data are retained for the period required by applicable legislation or for the time necessary to manage and settle the dispute, taking into account the statutory limitation periods.

5. Nature of the provision of data

Providing the data marked as mandatory in the forms is necessary to enable the Museum to manage the request or provide the service. Failure to provide mandatory data may make it impossible to respond to the request, complete a booking or perform the requested service. Providing data for newsletter or marketing purposes is optional. Refusing or withdrawing consent does not affect the use of the other services.

6. Processing methods and security measures

Processing is carried out using electronic and, where necessary, paper-based tools, in accordance with the principles of lawfulness, fairness, transparency, data minimisation and storage limitation. The Data Controller adopts technical and organisational measures appropriate to the risk in order to protect personal data against loss, destruction, alteration, unauthorised access, disclosure or unlawful use. Access to data is permitted only to authorised personnel and providers who need it to perform the services entrusted to them.

7. Recipients of personal data

To the extent necessary for the stated purposes, personal data may be disclosed to the following categories of recipients:

  • personnel and collaborators authorised by the Data Controller;
  • providers of hosting, technical support, maintenance and IT security services;
  • email and newsletter management service providers;
  • providers of booking, ticketing and payment platforms;
  • providers of consent management, statistical analysis and multimedia content services;
  • administrative, tax, accounting, legal or IT advisers;
  • banks and payment service providers;
  • public, judicial or supervisory authorities, where required by law.

Where they process data on behalf of the Museum, these parties are appointed as processors pursuant to Article 28 of the GDPR. In other cases, they may act as independent data controllers in accordance with their respective privacy policies. Personal data are not made publicly available unless disclosure is required by law or expressly authorised by the data subject. An up-to-date list of processors may be requested by writing to privacy@museonicolis.com.

8. Third-party services and content

The website may contain links, maps, videos, social media buttons, anti-spam systems, booking systems or other content provided by third parties. Where such services are not strictly necessary, they are activated only after the user has given consent through the cookie management system. By clicking an external link or using a third-party platform, the user may be directed to a service that is not managed by the Museum. Processing carried out by that third party is governed by its own privacy policy, which users are invited to read.

9. Transfers of personal data outside the European Economic Area

Some providers of IT, cloud, newsletter, analytics, multimedia content, booking or payment services may process personal data in countries outside the European Economic Area. In such cases, transfers take place in accordance with Articles 44 et seq. of the GDPR and, depending on the recipient and the country concerned, on the basis of:

  • an adequacy decision adopted by the European Commission;
  • the EU-U.S. Data Privacy Framework, where applicable to validly certified recipients in the United States;
  • standard contractual clauses adopted by the European Commission;
  • other appropriate safeguards provided for by the GDPR.

Where necessary, supplementary technical, organisational or contractual measures are also assessed and adopted. Further information about the safeguards used may be requested by writing to privacy@museonicolis.com.

10. Automated decision-making and profiling

The Data Controller does not use data collected directly through the website to make decisions based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect the data subject. Any analytics, personalisation or profiling activities carried out through cookies or marketing technologies take place only after the user has given consent and are described in the Cookie Policy.

11. Data subject rights

Where provided for by the GDPR, data subjects may exercise the following rights:

  • obtain confirmation as to whether or not their personal data are being processed;
  • obtain access to their data and information concerning the processing;
  • request the rectification of inaccurate data or completion of incomplete data;
  • request the erasure of their data;
  • request restriction of processing;
  • where applicable, receive their data in a structured, commonly used and machine-readable format and transmit those data to another controller;
  • object to processing based on the Data Controller’s legitimate interests;
  • object at any time to processing for direct marketing purposes;
  • withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
  • where applicable, not be subject to a decision based solely on automated processing;
  • lodge a complaint with the competent supervisory authority.

Requests may be sent to: privacy@museonicolis.com

The Data Controller will respond without undue delay and, as a rule, within one month of receiving the request. Where permitted by the GDPR, this period may be extended by a further two months, taking into account the complexity and number of requests. Before responding, the Data Controller may request the information strictly necessary to verify the identity of the person making the request.

12. Complaint to the supervisory authority

Data subjects who believe that their personal data are being processed in breach of the applicable legislation have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali). Information and contact details are available at: www.garanteprivacy.it

This is without prejudice to the right to seek a judicial remedy before the competent courts.

13. Changes to this Privacy Policy

The Data Controller may amend or update this Privacy Policy to reflect changes in legislation, technology or organisational arrangements, or the introduction of new services. The updated version will be published on this page together with the date of the latest update. In the event of material changes, users will be informed by appropriate means.