Comune di Cremona
Piazza del Comune, 8
Cremona
Tax code - VAT no. 00297960197
T. +39 0372 4071
F.
W. https://www.comune.cremona.it/
spaziocomune@comune.cremona.it
Personal Data Processing Notice
TICKETING SYSTEMof CREMONA CIVIC MUSEUMS
pursuant to EU Regulation 2016/679
This document is updated as of 26/08/2026. It is intended to inform the Data Subject about how data concerning them is used within the following processing activity/activities:
| Processing activities |
|---|
| INTEGRATED TICKETING SYSTEM of CREMONA CIVIC MUSEUMS |
Pursuant to Articles 13 and 14 of EU Regulation 2016/679, the Data Subject is informed that their data will be processed by the Data Controller defined in the Parties section, who processes the data for the purposes mentioned in the Purposes section, for a specific period of time defined in the Retention Period section, and the data may be disclosed to parties defined in the Disclosure section.
The Data Subject is also informed that they may exercise various rights with respect to their personal data; a list of these rights is provided at the end of this notice, in the Rights of the Data Subject section. The Data Subject's rights may be exercised at any time by contacting the Data Protection Officer (DPO) or, in their absence, the Data Controller.
Purpose of processing
Why is my data processed?
Processing of personal data is necessary to purchase a ticket for admission to the Cremona Civic Museums.
Legal bases legitimizing the processing
Which legal basis legitimizes the processing of my data?
- Article 6(b) EU Reg. 679/2016. Processing is necessary for the performance of a contract to which the Data Subject is party, or in order to take steps at the request of the Data Subject prior to entering into a contract.
Source of the data
Where does the processed data come from?
- Collected from the Data Subject
Categories of data processed
What data is processed?
| Category | Type |
|---|---|
| Data suitable for revealing geographic location | |
| Contact data | Email address |
| Telephone contact | |
Data Controller
Who is the Data Controller?
| Name | Contact details |
|---|---|
| Comune di Cremona (Municipality of Cremona) | Phone: +39 0372 4071 Email: spaziocomune@comune.cremona.it Address: Piazza del Comune, 8, Cremona Website: https://www.comune.cremona.it/ |
Data Protection Officer (DPO)
Who is the Data Protection Officer?
| Name | Contact details |
|---|---|
| EMPATHIA SRL | Phone: +39 0522 1606969 Email: dpo@empathia.it Address: Via Georgi Dimitrov n.42, 42123 Reggio Emilia Certified email (PEC): empathia@legalmail.it |
Disclosure and communication of data
Is the data disclosed or communicated to third parties?
No dissemination of the data takes place.
| Category of recipients | Geographic location | Legal basis for extra-EU transfer | Notes on transfers or communications |
|---|---|---|---|
| Disclosure to My Domnia and to Stripe for payment processing of the ticket. Disclosure of data necessary for the provision of the service to third parties appointed by the Municipality as data processors. | Intra-EU | — | — |
Whether providing the data is optional or mandatory
Is providing my data optional or mandatory?
Providing personal data as specified in this notice is optional.
Possible consequences of failure to provide data
What consequences may there be if the data is not provided?
Failure to provide all requested data prevents the purchase of the ticket.
Data retention period
For how long will my data be kept?
- Data is retained until the purposes have been achieved.
Data is retained in aggregate form for statistical purposes.
Rights of the Data Subject
The Data Subject has the right to exercise, where applicable, the rights set out in Articles 15–21 of EU Regulation 2016/679, by contacting the Data Controller or the Data Protection Officer directly, using the contact details provided in this notice, to request access, rectification, erasure, restriction of processing, portability, and objection to the processing of personal data.
Access
The Data Subject has the right to obtain access to data concerning them, for example to obtain confirmation of whether or not such data exists, even if not yet recorded, and to have it communicated in an intelligible form.
Portability
The Data Subject has the right to receive the personal data concerning them, which they have provided to a Data Controller, in a structured, commonly used, machine-readable format, and to transmit that data to another Data Controller without hindrance from the controller to whom it was originally provided.
Rectification
The Data Subject has the right to obtain from the Data Controller, without undue delay, the rectification of inaccurate personal data concerning them. Considering the purposes of this processing, the Data Subject has the right to have incomplete personal data completed, including by means of a supplementary statement.
Erasure
The Data Subject has the right to obtain from the Data Controller the erasure of personal data concerning them without undue delay, and the Data Controller is obliged to erase personal data without undue delay.
Restriction
The Data Subject has the right to obtain restriction of processing from the Data Controller where the accuracy of the personal data is contested (for the period necessary to verify accuracy), where the processing is unlawful and the Data Subject requests restriction, where the Data Controller no longer needs the data for the purposes of processing but the Data Subject needs it to establish, exercise or defend legal claims; or pending verification regarding the possible prevalence of the Data Controller's legitimate grounds, when the Data Subject has objected to the processing.
Right to object
The Data Subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them pursuant to Article 6(1) (e) (performance of a task carried out in the public interest) or (f) (pursuit of the legitimate interests of the controller or a third party), including profiling based on those provisions.
Withdrawal of consent
The Data Subject has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent given before withdrawal.
Lodging a complaint with a supervisory authority
The Data Subject may also withdraw consent previously given at any time, without affecting the lawfulness of processing based on consent given before withdrawal.
To exercise the above rights, the Data Subject may contact the Data Protection Officer or the Data Controller.
The Data Subject has the right to lodge a complaint with a supervisory authority by writing to garante@gpdp.it, or by certified email (PEC) to protocollo@pec.gpdp.it.