Privacy policy for the processing of personal data for video surveillance systems

FOREWORD

Pursuant to art. 13 of EU Regulation 679/2016 (the GDPR), OPERA DEL DUOMO DI ORVIETO-FABBRICERIA, tax code 81000670554, represented by its pro-tempore legal representative and headquartered at 26 Piazza del Duomo, Orvieto, 05018, would like to inform you that a video surveillance system (hereinafter referred to as the "system") has been installed at the Orvieto Cathedral. This system operates from 12:00 a.m. to 11:59 p.m. every day, including holidays and workdays, and records footage in the following areas: the perimeter and interior of the Orvieto Cathedral, the Opera del Duomo di Orvieto Museum, the Emilio Greco Museum, and the Cathedral Crypt.

All areas monitored by the system are marked with brief notice signs.

DATA CONTROLLER

The data controller is OPERA DEL DUOMO DI ORVIETO - FABBRICERIA, tax code 81000670554, with registered offices at no. 26 Piazza del Duomo, Orvieto, Italy – postal code 05018.

Certified e-mail: opsm@pec.it

Telephone number: +39 0763 342477

E-mail: info@duomodiorvieto.it

Data subjects may exercise their rights by contacting the data controller as follows: by writing to the following address: 26 Piazza del Duomo, Orvieto, Italy, postal code 05018, or by writing to the following certified email / email addresses: opsm@pec.it / info@duomodiorvieto.it

NATURE AND PROVISION OF THE DATA, PURPOSE, AND LEGAL BASIS FOR PROCESSING

The personal data collected and processed through the video surveillance system consist of images of individuals and objects within the systems' range. The cameras are positioned both inside and outside the monitored facilities. These data are processed exclusively to protect individuals and property from potential threats such as assault, theft, robbery, property damage, and vandalism. This processing is conducted in accordance with GDPR article 6, which does not require consent for lawful processing.

METHODS, DURATION OF PROCESSING, AND DATA RETENTION

Data collection takes place in compliance with the principles of relevance and completeness, and within the limitations of the purposes for which they are processed. The recorded images are processed lawfully, fairly, and transparently as required by law, using computer and telecommunication tools designed to store and manage the data securely while ensuring the utmost confidentiality of the data subjects. The data are stored on computer systems within the EU and retained for a maximum period of 5 days, after which they are automatically deleted.

CATEGORIES OF PERSONS TO WHOM THE DATA MAY BE DISCLOSED AND WHO MAY COME TO HAVE KNOWLEDGE OF THEM IN THEIR CAPACITIES AS DATA PROCESSORS OR DATA HANDLERS

The images collected and recorded will be processed in compliance with the applicable legislation, and only by authorised personnel trained in data processing and bound by confidentiality obligations. The recorded images may be disclosed to authorities and/or institutions as required by legal obligations or in response to specific orders issued by the Judicial Authorities or Judicial Police.

RIGHTS OF THE DATA SUBJECT

The data subject has the right to request access to their data pursuant to art. 15 of the GDPR; request the rectification of inaccurate data pursuant to art. 16 of the GDPR; request the deletion of their data (right to be forgotten) pursuant to art. 17 of the GDPR; request the restriction of the processing of their data pursuant to art. 18 of the GDPR; object to the processing of their data pursuant to art. 21 of the GDPR; exercise the right to data portability pursuant to art. 20 of the GDPR, by writing to the addresses indicated above, or to lodge a complaint with the supervisory authority by sending a registered letter with acknowledgement of receipt to the following address: 121 Piazza Monte Citorio, ROME, ITALY – 00186; or else by sending a certified e-mail message to protocollo@pec.gpdp.it .