This notice is provided, pursuant to Article 13 of Regulation (EU) 2016/679 on the protection of personal data, to individuals who purchase the “Armonia” pass.
Data Controllers
The responsibility for processing the personal data provided for the purchase of the “Armonia” pass is attributed to:
- Turismo Torino Provincia s.c.r.l., with registered office at Via Maria Vittoria 19, Torino (TO), contactable at: [email protected]
- Data Protection Officer (DPO): [email protected]
- Associazione Sistema Musica, with registered office at Via Meucci 4, Torino (TO), contactable at: [email protected]
The two entities have entered into a joint controllership agreement pursuant to Article 26 GDPR, in which their respective responsibilities regarding the obligations arising from the processing of personal data of data subjects have been jointly defined. An extract of this agreement may be requested by contacting the Joint Controllers at the addresses indicated above.
Please note that for some of the purposes described below, Turismo Torino Provincia s.c.r.l. acts as an independent data controller.
Purposes and Legal Bases of Processing as Joint Controllers
a) Managing the purchase request of the pass, including assistance and communications following the purchase.
Legal basis: performance of a contract (Art. 6, lett. b GDPR 2016/679)
b) Carrying out activities necessary for managing reservations (e.g. sharing data with entities participating in the initiative), providing assistance during the experience, and sending organisational communications.
Legal basis: performance of a contract (Art. 6, lett. b GDPR 2016/679)
c) Conducting surveys, customer satisfaction activities, and follow-ups aimed at improving the user experience, the quality of the initiative, and the planning of future editions.
Legal basis: performance of a task carried out in the public interest (Art. 6, lett. e GDPR)
Purposes and Legal Bases of Processing by Turismo Torino as Independent Data Controller
The personal data collected may also be processed by Turismo Torino, as an independent Data Controller, for the following purposes:
- Management of payments, invoicing, and reporting related to the sale of the product.
Legal basis: legal obligation (Art. 6, lett. c GDPR) - Sending informational, institutional, and promotional communications, including newsletters, regarding initiatives, events, activities, and services promoted or independently organised by Turismo Torino.
Legal basis: consent (Art. 6, lett. a GDPR)
Data Recipients
Personal data will be processed by duly authorised, trained, and instructed personnel of Turismo Torino.
They may also be processed by external entities, formally appointed as Data Processors pursuant to Article 28 GDPR, belonging to the following categories:
- companies providing IT systems management and maintenance services;
- companies specialising in digital services (e.g. website management, promotional campaigns, online surveys);
- companies tasked with organising the initiative.
In addition, data will be shared with participating entities hosting the performances, which will act as independent Data Controllers.
Data Retention Period
Personal data will be processed for the duration of the Initiative, as well as for the time necessary to fulfil administrative and reporting obligations in compliance with applicable regulations.
For the sending of informational and promotional communications by Turismo Torino, data will be processed until consent is withdrawn or until the data subject exercises their right to object.
Nature of Data Provision and Consequences of Failure to Provide Data
The provision of personal data is mandatory for the purposes outlined under letters a) and b), as well as for compliance with legal obligations. For all other purposes, data provision is optional.
Transfer of Data to Non-EU Countries
As stated above, the Joint Controllers, also through their Data Processors, may rely on IT and electronic communication service providers which, in the context of their activities, may transfer personal data to countries outside the European Economic Area (EEA).
Such providers are selected on the basis of strict criteria, including certifications, compliance statements, and guarantees of security, reliability, and adherence to European and national data protection laws.
In any case, the transfer of personal data outside the EEA will take place exclusively to countries recognised by the European Commission as providing an adequate level of protection, or will be regulated through Standard Contractual Clauses approved by the European Commission, pursuant to Article 46 GDPR, to ensure an adequate level of personal data protection.
Rights of the Data Subject
The data subject may exercise the rights provided under Articles 15–22 GDPR 2016/679. Specifically, they may request:
- confirmation of whether personal data concerning them is being processed and, if so, obtain a copy (“right of access”);
- rectification of inaccurate data and integration of incomplete data (“right to rectification”);
- erasure of personal data (“right to erasure”), unless retention obligations or legitimate interests of the Controllers exist;
- restriction of processing (“right to restriction”);
- transfer of the data provided to another controller (“right to data portability”), only for processing based on consent or contract.
The Controllers also remind data subjects that they have the right to object to processing carried out on the basis of public interest or legitimate interest.
Requests to exercise these rights may be addressed to Turismo Torino Provincia s.c.r.l. at [email protected], specifying the subject of the request, the right being exercised, and any information useful to verify the legitimacy of the request.
Furthermore, the data subject has the right to lodge a formal complaint with the Italian Data Protection Authority, according to the procedures available at: https://www.garanteprivacy.it/