Pursuant to the provisions of current legislation on the protection of personal data, with particular reference to Article 13 and 14 of EU Regulation 2016/679 (hereinafter ‘GDPR’) Orbital Cultura Srl, (hereinafter also ‘Orbital Cultura’) as autonomous data controller inform you of the following:

1. Data controller

The data controllers is:
Orbital Cultura Srl. (C.F. 04766270484 e P.Iva 10542790968), with registered office in Florence, Via Policarpo Petrocchi 24. The designated Data Protection Officer is the head of the ‘Compliance & AML’ function of the Nexi Group, whom you can contact via the following email address: dpo@nexigroup.com.

2. Purposes of data processing and data processed

Orbital Cultura srl will process the acquired data with manual and automated tools for the following purposes:

• registration on the gifts.labiennale.org website, necessary in order to use the services of the sites, including any requests for assistance and submission of complaints;
• administrative and accounting purposes;
• to correctly fulfil obligations arising from the law or regulations in force (e.g. in the field of taxation).

The legal basis of the processing is, therefore, identified in the fulfilment of legal obligations to Orbital Cultura srl is subject and in the need to implement the contractual relationship.
The data acquired may also be processed by Orbital Cultura srl for the following additional purposes:

• sending communications (newsletters), including commercial communications to promote our activities

Each of these activities and communications may only be carried out with your specific consent. This consent is optional and revocable at any time.

The fulfilment of the above-mentioned purposes implies the processing of the following personal data:

• personal data (name, surname, address, date of birth, nationality, gender, tax code, VAT number);
• contact details (email address, telephone number, postal address);

3. Categories of persons to whom the data may be communicated

The data may be processed by the employees and/or collaborators of Orbital Cultura srl allotted to the pursuit of the above-mentioned purposes, who have been expressly authorised to carry out such processing and who have received adequate operating instructions pursuant to Articles 29 of the GDPR and 2-quaterdecies of Legislative Decree 196/2003, as amended and adapted to the GDPR by Legislative Decree 101/2018.

The data may be communicated to subjects acting as independent data controllers, including, by way of example, authorities and supervisory and control bodies and, in general, public or private subjects entitled to make such data requests.

The data may also be processed, on behalf of Orbital Cultura srl, by parties appointed as data processors pursuant to Article 28 of the GDPR. The full list of data processors will be made available to the data subject upon request.

4. Data transfer abroad

The data acquired will not be transferred outside the European Union.

5. Period of data conservation

Your personal data will only be stored for the time necessary to ensure the correct provision of the services offered and, where applicable, until such time as legal obligations and contractual obligations entered into between you and Orbital Cultura srl have been fulfilled.

6. Rights of the persons concerned

Any customers concerned may request access to the data concerning them, their rectification, integration or deletion, the restriction of processing in the cases provided for by Article 18 of the GDPR, as well as opposition to processing pursuant to Article 21 of the GDPR in cases of legitimate interest.

Data subjects also have the right to the portability of their data pursuant to Article 20 of the GDPR, i.e. the right to receive their data in a structured, commonly used and machine-readable format and, if technically feasible, to transmit it to another data controller without hindrance.

Finally, data subjects have the right to lodge a complaint with the Data Protection Authority.

The above-mentioned rights may be exercised by sending a written communication to:
Orbital Cultura srl, DPO@nexigroup.com, or by sending a written request to the Parent Company Nexi SpA, office of the Data Protection Officer, Corso Sempione 55, 20149 Milan.