This notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) to those browsing the website www.arnaldopomodoro.it (the “Website”).
This policy describes how the Website is managed with regard to the processing of personal data relating to users who browse it. Please note that this policy does not apply to third-party websites accessible to visitors via links that may be available on the Website; in such cases, users are advised to refer to the privacy policies on the processing of personal data available on those third-party sites.
The Arnaldo Pomodoro Foundation, with its registered office at Vicolo Lavandai 2a - Milan, Tax Code 97163270156, VAT No. 12775620151, in the person of its current legal representative, is the data controller (hereinafter, the “Foundation” or the “Data Controller”).
The Data Controller may be contacted by sending an email to info@fondazionearnaldopomodoro.it, or by writing to the following address:
Arnaldo Pomodoro Foundation
Vicolo Lavandai 2a, 20144 – Milan
‘Personal data’ means any information capable of identifying, directly or indirectly, a natural person (‘Data’) and, in this case, the user browsing the Website (the ‘User’).
In particular, the Data Controller processes the following categories of Data:
| Category | Data processed |
|---|---|
| Browsing data | IP address, domain name and URL of the device used; browsing data |
| Personal and contact details, data relating to the use of the services available on the Website | First name and surname; email address; user type (e.g., private individual, professional); any additional data provided voluntarily to follow up on a request to consult the Archive or the Catalogue Raisonné, or to use other services available on the Website (e.g., use of the ‘Bookmark’ feature) |
| Data collected via the questionnaire | Nationality; how you became aware of the Catalogue Raisonné; type of user (e.g., student, professional); level of satisfaction with the resources made available |
In any event, the Data Controller undertakes to collect only information that is adequate, relevant and limited to what is strictly necessary for the purposes pursued in each case.
The table below sets out, for each purpose of processing, the Data processed, the relevant legal basis under the GDPR and the corresponding retention period.
| Purpose of processing | Data processed | Legal basis | Retention period |
|---|---|---|---|
| Website management – to enable the use of the Website and to monitor its proper functioning |
Browsing data (e.g., IP address, URL) | Article 6(1)(b) of the GDPR – performance of a contract or pre-contractual measures taken at the User’s request | For as long as is necessary to enable browsing of the Website; regarding the retention of data collected via cookies, please see the Cookie Policy available at the following link: https://arnaldopomodoro.it/cookie-policy/ |
| Registration and access to the Online Archive and the Catalogue Raisonné – to enable the User to register and access the Foundation’s archive material and the Catalogue Raisonné, as well as to use the features provided therein |
Personal details (first name, surname), contact details (email) Any further data voluntarily shared by the User whilst using the services (e.g., information relating to works saved or notes added whilst using the ‘Bookmark’ feature) |
Article 6(1)(b) of the GDPR – performance of the contract or of pre-contractual measures taken at the User’s request | Until the User’s account is deleted. |
| Sending the newsletter – to send periodic information regarding exhibitions, events, cultural initiatives, exhibition activities and the Foundation’s projects |
Personal details (first name and surname), contact details ( nd email address ) | Article 6(1)(b) of the GDPR – performance of a contract or pre-contractual measures | Until you request to unsubscribe from the newsletter or two years after your last interaction (e.g., opening the email). |
| Sending the questionnaire to Users registered with the Catalogue Raisonné, for statistical purposes and to improve the service. | Email address; nationality; how the user became aware of the Catalogue Raisonné; type of user (e.g., student, professional); level of satisfaction with the resources made available | Article 6(1)(f) of the GDPR – the Foundation’s legitimate interest in improving its services and understanding the profile of its user base | For the time strictly necessary to achieve the purposes of analysis and statistics and, in any event, in aggregated and anonymous form once the analysis of the results has been completed. |
| Exercise or defence of a right and management of any disputes – the establishment, exercise and defence in court of the Foundation’s rights |
Data relevant to the dispute | Article 6(1)(f) of the GDPR – the Foundation’s legitimate interest in safeguarding its rights | 10 years from the date the judgment becomes final or from the settlement of the dispute by mutual agreement, in accordance with the applicable limitation period. |
| Compliance with legal obligations, including those relating to administrative, accounting and tax matters – to comply with obligations laid down by EU legislation, laws, regulations and provisions issued by competent authorities |
Data relevant by virtue of a specific legal obligation | Article 6(1)(c) of the GDPR – compliance with a legal obligation | For the time strictly necessary, in accordance with the retention periods set out in the applicable legislation |
| Protection of IT and network security | Browsing data, log files. | Article 6(1)(f) of the GDPR – the Foundation’s legitimate interest in the security of the website | Up to 6 months, unless further use is required to safeguard rights |
Cookies are packets of information sent by a server (e.g. the Website) to the User’s web browser, which are automatically stored on the User’s device and automatically sent back to the server each time the User visits the site.
The Foundation uses cookies to provide contextualised information to Website Users, to obtain statistics on visits to and use of the portal and – subject to the User’s consent – to carry out analysis and digital marketing activities.
For further information on the characteristics, types, use and methods for removing, deleting or disabling cookies on the Website, please consult the relevant Cookie Policy available at the following link: https://arnaldopomodoro.it/cookie-policy/.
The Data is processed by the departments responsible for managing the Website and the Foundation’s activities and may be disclosed, for the purposes described in this notice, to third parties who process the Data as data processors pursuant to Article 28, GDPR, such as IT and application service providers, contractors and collaborators, as well as — with specific reference to the questionnaire — to Google LLC, as the provider of the Google Forms platform.
Furthermore, the Data may be disclosed to banks, professionals and advisers (including solicitors, accountants and auditors), as well as to public bodies or authorities, where required by applicable legislation or by an order from the authority itself. These parties will process the Data as independent data controllers
As a general rule, the Data Controller does not transfer the Data to countries outside the European Economic Area (EEA). However, the use of the Google Forms platform to administer the questionnaire may involve the transfer of the Data to countries outside the EEA, including the United States of America. In such cases, the Data Controller ensures that such transfers take place in accordance with applicable data protection legislation and on the basis of adequate safeguards, including, where applicable, the standard contractual clauses approved by the European Commission pursuant to Article 46(2)(c) of the GDPR and/or the European Commission’s adequacy decision applicable to the country of destination.
Whilst the Data Controller is processing the Data, the User, as a data subject, may at any time exercise the following rights:
The exercise of some of the rights set out above may be restricted in the cases provided for by applicable legislation.
The above rights may be exercised by writing to info@fondazionearnaldopomodoro.it
Without prejudice to any other administrative or judicial remedy, the User has the right to lodge a complaint with the competent supervisory authority in the Member State in which they habitually reside, in which they work, or in which the alleged infringement occurred (for Italy: the Garante per la protezione dei dati personali) where they consider that their rights in relation to the protection of personal data have been infringed. Further information is available at the following address: https://www.garanteprivacy.it/diritti/come-agire-per-tutelare-i-tuoi-dati-personali/reclamo.
[version updated on October, 2026]
