Video Surveillance Notice

VIDEO SURVEILLANCE NOTICE PURSUANT TO ART. 13 OF THE EU REGULATION 2016/679, THE PRIVACY CODE AS AMENDED BY LEGISLATIVE DECREE 101/2018, ART. 3.1 OF THE DATA PROTECTION AUTHORITY’S MEASURE OF APRIL 8, 2010, AND THE GUIDELINES 3/2019 ON VIDEO SURVEILLANCE ADOPTED BY THE EUROPEAN DATA PROTECTION BOARD (EDPB).

  1. Preamble

For the Bardini & Peyron Monumental Parks Foundation, your privacy and the security of your personal data are particularly important. Therefore, we collect and process them with the utmost care and attention, adopting adequate technical and organizational measures to ensure their full security.

We hereby inform you, pursuant to Art. 13 of the European Regulation 2016/679 (“GDPR” or “Regulation”) and the Privacy Code (“Privacy Code”), as recently amended by Legislative Decree 101/2018, as well as Art. 3.1 of the Data Protection Authority’s measure of April 8, 2010, and the Guidelines No. 3/2019 on video surveillance adopted by the European Data Protection Board (together, “the Legislation”), that the processing of your personal data is carried out in a manner adequate to ensure security and confidentiality, and is performed using paper, electronic and/or telematic supports as detailed in this notice.

  • Data Controller

The processing of your personal data is carried out by the Bardini & Peyron Monumental Parks Foundation (“the Foundation” or “Controller”), with its legal office at 50122 – Florence, Via Bufalini No. 6, and operational office at 50125 – Florence, Costa San Giorgio No. 2, as the Controller pursuant to and for the effects of the Regulation.

The Foundation has not appointed a DPO pursuant to Art. 37 GDPR.

For any questions or requests related to the processing of your personal data, you can contact the Foundation at any time by sending a request to the following contact details:

Data Controller

Corporate Name: Bardini and Peyron Monumental Parks Foundation
Legal Office Address: 50122 Florence, Via M. Bufalini No. 6
Operational Office Address – Villa Bardini: 50125 Florence, Costa San Giorgio No. 2
Operational Office Address – Villa Peyron: 50014 Fiesole (FI), Via di Vincigliata No. 2
Telephone Contact Data: 055 20066233
Email Contact Data: info@bardinipeyron.it

  • Types of Data, Purposes, and Legal Basis of Processing

The personal data processed by the Foundation are exclusively the images of the subjects involved, captured through video recording by specific video surveillance systems installed at the Foundation’s premises and museum spaces.

Your personal data, once collected, are processed for the following purposes:

 PurposeLegal Basis
AProtection of company assets.The legitimate interest of the Data Controller to protect company assets serves as the legal basis for processing.

Your personal data is processed by personnel of the Foundation who are authorized and designated, and adequately trained in accordance with Article 4(10) of the Regulation and Article 2-quaterdecies of the Privacy Code. These personnel process data following specific instructions from the Data Controller.

  • Data Recipients

The Data Controller has appointed in writing a designated person responsible for video surveillance, authorized to access the premises where the control stations are located and to use the systems. This individual may, where necessary for the purposes pursued, view the images and/or make copies, in accordance with Article 3.3.2 of the April 8, 2010, measure by the Data Protection Authority.

Furthermore, your personal data will be transmitted to third parties that the Foundation relies on to provide its services, including through the use of cloud computing resources for data storage and preservation (in such cases, your data will be protected using pseudonymization and encryption techniques). To this end, the Foundation commits to protecting communicated information using physical and management procedures to safeguard collected data, thereby preventing unauthorized access or disclosure, maintaining data accuracy, and ensuring appropriate use.

Entities providing services on behalf of the Foundation and processing data are duly appointed as Data Processors under Article 28 of the GDPR.

Your data may also be transmitted to police forces and judicial and administrative authorities, in accordance with the law, for the investigation and prosecution of crimes, the prevention and protection from public security threats, as well as to enable the Foundation to exercise or protect a right of its own or of third parties before the competent authorities, and for other reasons connected to the protection of the rights and freedoms of others, in accordance with Article 2-sexies of Legislative Decree 101/2018.

Except in the above cases or when required for compliance with legal obligations, personal data collected through video surveillance systems will not be communicated to third parties or disseminated.

  • Obligatory or Optional Nature of Providing Data

While the provision of personal data by the data subject is voluntary, please note that you may object, in accordance with Article 21 of the GDPR, before entering, during your stay, or after leaving the video-monitored area, to the processing of data collected by the Data Controller through video surveillance systems and processed based on its legitimate interest. If you do not wish to be filmed by the installed cameras, it is advised not to enter the premises and the museum of the Data Controller under video surveillance.

  • Extra-EU Data Transfer

Your personal data will not be transferred to countries outside the EU.

  • Data Retention

In respect of the principles of proportionality and necessity, data will not be stored for periods longer than those necessary to achieve the purposes outlined above. In particular, acquired data will be displayed and/or viewable exclusively by specific personnel authorized and instructed by the Data Controller, and will be stored for 72 hours.

This data retention period may be extended for additional preservation needs related to holidays and in cases where compliance with a specific investigative request from the judicial or police authorities is necessary, or to possibly exercise the right of access recognized to the data subject under Articles 15 and subsequent of the GDPR (retained for a maximum of 7 days).

At the end of these periods, your data will be permanently deleted or otherwise irreversibly anonymized by the Foundation.

  • Your Rights

We inform you that you have the right to exercise the following rights with respect to the personal data covered by this notice, as provided for and guaranteed by the Regulation:

  • Right of Access and Rectification (Articles 15 and 16 of the Regulation): You have the right to access your personal data and request that it be corrected, amended, or supplemented. If desired, we will provide you with a copy of your data in our possession.
  • Right to Erasure of Data (Article 17 of the Regulation): In cases provided by current legislation, you can request the deletion of your personal data. Once your request is received and analyzed, we will cease processing and delete your personal data if deemed legitimate.
  • Right to Restriction of Processing (Article 18 of the Regulation): You have the right to request the restriction of processing of your personal data in cases of unlawful processing or dispute of the accuracy of the personal data by the data subject.
  • Right to Data Portability (Article 20 of the Regulation): You have the right to request to obtain your personal data from the Data Controller in order to transmit them to another Controller, in cases provided for by the referenced article.
  • Right to Object (Article 21 of the Regulation): You have the right to object at any time to the processing of your personal data based on our legitimate interest, by explaining the reasons justifying your request. Before accepting it, the Foundation will evaluate the reasons for your request.
  • Right to Lodge a Complaint (Article 77 of the Regulation): You have the right to lodge a complaint with the competent Data Protection Authority if you believe there has been, or is currently, a violation of your rights regarding the processing of your personal data.

You may exercise your rights at any time concerning the specific processing of your personal data by the Foundation.

Notwithstanding the foregoing, please remember that the rights mentioned above can also be exercised by anyone who has a personal interest, acts on your behalf as your representative, or for family reasons worthy of protection, as per Article 2-terdecies of Legislative Decree 101/2018.

These rights may be exercised by email at info@bardinipeyron.it.

Further information about the rights of the data subject can be obtained by requesting from the Controller a full excerpt of the aforementioned articles.

  • Technical and Organizational Security Measures

The Foundation adopts adequate technical and organizational security measures to safeguard the confidentiality, integrity, completeness, and availability of the personal data of the data subject. Technical, logistical, and organizational precautions are implemented with the aim of preventing damage, even accidental losses, alterations, improper use, and unauthorized processing of data.

  1. Changes to this Notice

This notice is accessible at the reception of both the legal and operational premises of the Foundation, or upon specific request by the data subject sent by email or registered mail to the addresses listed above. This notice is also available online at https://www.villabardini.it/informativa-videosorveglianza/ and through the QR code located at the bottom left of the brief notice posted near the surveillance cameras. It is specified that individuals affected by the processing are duly notified by signs (brief notices) in the areas and premises subject to video surveillance activities.

We therefore invite you to periodically check the contents of our notice: where possible, we will try to inform you promptly of any changes made and their consequences.

The updated version of the privacy notice can be requested from the Controller at any time.

  1. Place and Date of Last Modification

Firenze, 12/04/2021