Record of Activities
The Fundación Colección Thyssen-Bornemisza, F.S.P., with Tax Identification Number, G-79015251, is a cultural non-profit entity, owner of the Museo Nacional Thyssen-Bornemisza in Madrid (“Museum”), located in Paseo del Prado no. 8, with the purpose of, among others, managing the Museum and the conservation and dissemination of the works of art housed in its Museum. The Foundation has placed special emphasis on disseminating its collections, with programs aimed at engaging audiences of all kinds in its cultural project.
This objective continues in force as well as the goal of satisfying visitors’ demand and achieving a streamlined administration, striving to maximize revenue generation and control the expenditure necessary for implementing an intensive cultural programme and guaranteeing the upkeep of the rooms, the maintenance of the facilities and the level of services.
We are committed to remaining a benchmark in the Spanish cultural world through transparent and efficient management. In turn, another of our main commitments concerns the protection of the information we manage, and in particular the personal data we handle, both the data provided by our visitors and by the Museum’s collaborators.
This management extends to compliance with current legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 - on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/CE (the “GDPR”), and thus, through this data protection policy we inform you about the way we collect and process the data.
This Privacy Policy establishes the bases on which the Fundación Colección Thyssen-Bornemisza, F.S.P. processes the personal data you provide, either through the Foundation's websites (www.museothyssen.org , www.educathyssen.org, entradas.museothyssen.org and tienda.museothyssen.org - the "Websites") or by any other means, either digital or analogue.
We remind you that whenever you use the Websites and submit any type of information, such as your name, email, billing or shipping address, telephone number, type of device or debit or credit card number, etc. (the "Personal Data") either to browse the Websites, to purchase our products or make use of the services or features accessed through the Websites, this Privacy Policy applies, along with The Terms of Use of each Website, which we invite you to read to verify that you agree to them.
The terms of use of the Websites can be found at the following addresses:
- www.museothyssen.org: Legal Terms
- www.educathyssen.org: Legal Terms
- Tienda.museothyssen.org: https://tienda.museothyssen.org/en/legal
- Entradas.museothyssen.org: General Terms and Conditions of use PDF
Collection of personal data and purposes of processing
We remind you that before you start using any of the services offered by the Foundation, you should carefully read this Policy.
Failure to provide certain information when indicated as compulsory may mean that it will not be possible to manage your registration as a user or the use of certain functionalities or services available through the Websites.
You warrant that the Personal Data you provide to the Foundation is true and accurate and you undertake to notify any changes or modifications thereto. Any loss or damage caused to the Websites, the Data Controller or any third party through the communication of erroneous, inaccurate or incomplete information in the registration forms shall be your sole responsibility.
1. What data are collected?
One of the Foundation's main objectives is to ensure visitor satisfaction, keep the relationship with its collaborators and make sure they feel protected when they provide their data to operate with the Foundation. To this end, there are several ways to share your personal data with the Foundation.
The tables shown at the end of this section contain a summary of the following aspects related to the different personal data processing tasks that the Foundation carries out depending on the purpose for which you have provided the data:
2. Additional information for users on the different data processing activities carried out by the Foundation
The different data processing activities carried out by the Foundation are listed below.
2.1 Friends of the Museum
| Activity: | Friends of the Museum |
|---|---|
| Purpose: | Managing the Friends of the Museum program, making requests for donations and sponsorship for the FOUNDATION’s purposes and informing about the Museum’s activities. No profiles will be prepared of the data subjects nor will automated decisions be taken based on such profiles. |
| Source of data: | The FOUNDATION obtains the personal data from the data subjects directly or through their authorised representative, through the Friends of the Museum program Registration Form. |
| Categories of data: | Name and surnames, Phone, Address, Tax Identification Number, Email, date of birth and account number. |
| Legal grounds: | The legal basis for processing the data from contracts signed by the FOUNDATION and the data subject is found in section 6.1.b) of the GDPR, i.e., the performance of a contract. You must provide your personal information to the FOUNDATION for the correct performance of the contract. Otherwise, you cannot join the Friends of the Museum. |
| Recipients of shared or transferred data: | The data will be communicated to Google LLC, domiciled in the USA, in its capacity as Data Processor, providing information society services to the FOUNDATION (in particular, the GSuite - Google Cloud service). That entity adheres to the "Privacy Shield" agreement between the US and the European Union. You can find more information by clicking on the name of this organization. The data will be communicated to Ipdea Land, S.L. in its capacity as Data Processor, which provides the "Teenvio" service to the FOUNDATION for sending emails to third parties. The FOUNDATION will not transfer your data to any other third party unless legally required. |
| Storage period: | The data will be kept as long as it is necessary for the provision of the services requested and during the legally required term to determine potential liabilities derived from the service provided. |
2.2 Online ticket sales
| Activity: | Online ticket sales |
|---|---|
| Purpose: | Managing the online purchase of tickets on the website entradas.museothyssen.org. We inform you that your data will be used by the FOUNDATION to create profiles for purely statistical purposes on the public visiting the Museum and its shop. |
| Source of data: | The FOUNDATION obtains the personal data from the data subjects, directly or through their authorised representative, through the customer registration form and/or purchase confirmation form. |
| Categories of data: | Name and surnames, Phone, Address, Tax Identification Number and Email. |
| Legal grounds: | The legal basis for processing the data from contracts signed by the FOUNDATION and the data subject is found in section 6.1.b) of the GDPR, i.e., the performance of a contract. You must provide your personal data to the FOUNDATION for the correct performance of the ticket sales contract. Otherwise, the FOUNDATION will not be able to provide the online ticket sales service to you. |
| Recipients of shared or transferred data: | The data will be communicated to the Data Processor companies, currently TIQUETEO SPAIN, S.L., which provides ticketing services to the FOUNDATION. The FOUNDATION will not transfer your data to any other third party unless legally required. |
| Storage period: | The data will be kept as long as it is necessary for the provision of the services requested and during the legally required term to determine potential liabilities derived from the service provided. |
2.3 Online sale of products
| Activity: | Online sale of products |
|---|---|
| Purpose: | Managing the online purchase of products and print on demand on the website tienda.museothyssen.org and customer service arising from such transaction. The FOUNDATION will use your data to develop profiles of data subjects in order to inform them about offers, discounts, activities or products of the FOUNDATION similar to those in which the data subject has previously shown interest. The data subject has the right to object this processing at any time, by sending an email to rgpd@museothyssen.org as detailed in the "Rights" section. In addition, the FOUNDATION will use your data for statistical purposes regarding the public that visits the Museum shop. |
| Source of data: | The FOUNDATION obtains the personal data of the data subject, through themselves or their authorized representative, by means of the Form of sale of products online. |
| Categories of data: | Name, surname, telephone, address, ID card or tax identification number, email. |
| Legal grounds: | The legal basis for processing the data from contracts signed by the FOUNDATION and the data subject is found in section 6.1.b) of the GDPR, i.e., the performance of a contract. You must provide your personal data to the FOUNDATION for the correct performance of the online product sales contract. Otherwise, the FOUNDATION will not be able to provide the online product sales service to you. |
| Recipients of shared or transferred data: | The data will be communicated to the Data Processor companies, currently La Museoteca, S.L., which provides custom printing services to the FOUNDATION, and companies that provide transport and logistics services, in general, FEDEX SPAIN, S.L. and G.M.S., S.L. The FOUNDATION will not transfer your data to any other third party unless legally required. |
| Storage period: | The data will be kept as long as it is necessary for the provision of the services requested and during the legally required term to determine potential liabilities derived from the service provided. |
2.4 Register as a user in the online shop
| Activity: | Register as a user in the online shop. |
|---|---|
| Purpose: | Managing the user's access to the website of the FOUNDATION's online shop. The FOUNDATION will use the data to create profiles of data subjects in order to inform them about FOUNDATION offers, discounts, activities and products similar to those in which they have previously shown an interest. The data subject has the right to object at any time to this processing, by sending an email to rgpd@museothyssen.org as detailed in the section "Rights". |
| Source of data: | The FOUNDATION obtains the personal data of the data subjects through their registration in the different forms available on the Website of the FOUNDATION Shop. |
| Categories of data: | Name, surname, email, address, telephone. |
| Legal grounds: | The legal basis for the processing of personal data is based on the consent of the data subject, according to article 6.1.a) of the RGPD. |
| Recipients of shared or transferred data: | The FOUNDATION will not transfer your data to any third party, except under legal obligation. |
| Storage period: | The processing of data will continue until the user requests the deletion of the account. |
2.5 Contact form and cancellation of orders from the online shop for products and publications.
| Activity: | Contact with the Museum’s store and technical support. |
|---|---|
| Purpose: | Managing any incident, request for information, cancellation of an order or any need for contact that has the data subject relating to the operation of the Museum’s online shop. No profiles of the data subject will be elaborated and no automated decisions will be taken based on this profile. |
| Source of data: | The FOUNDATION obtains the personal data of the data subject, through themselves or their authorized representative, by means of the Online Store Contact Form and/or the Help and Support form. |
| Categories of data: | Name, telephone and email. |
| Legal grounds: | The legal basis for the processing of personal data of the data subject by the FOUNDATION is found in article 6.1.a) of the RGPD, that is, the consent of the data subject. |
| Recipients of shared and transferred data: | The data will be communicated to the company in charge of the online customer and user service management platform, currently Freshworks Inc., which provides the FOUNDATION with the "Freshdesk" service for managing incidents, requests and other communications with users and customers of the Museum's online shop. The FOUNDATION will not transfer the data to any third party, except under legal obligation. |
| Storage period: | The FOUNDATION will store the data for one year from the time of the consultation, to be able to follow-up the request. |
2.6 Subscription to e-mails from the online shop for products and publications
| Activity: | Information and promotion of the activities of the Museum shop. |
|---|---|
| Purpose: | To inform about the Museum's shop, its activities, products, offers, promotional and marketing activities. The FOUNDATION will use the data to create profiles of data subject in order to inform them about offers, discounts, activities or products of the FOUNDATION similar to those in which they have previously shown interest. The data subject has the right to object this processing at any time, by sending an email to rgpd@museothyssen.org as detailed in the "Rights" section. |
| Source of data: | The FOUNDATION obtains the personal data of the data subject by registering on the different forms available on the FOUNDATION's Websites or at the Museum's customer service points. |
| Categories of data: | Name, surname, email. |
| Legal grounds: | The legal basis for the processing of personal data of the data subject by the FOUNDATION is found in article 6.1.a) of the RGPD, that is, the consent of the data subject. |
| Recipients of shared and transferred data: | The data will be communicated to the Data Processors companies, currently Ipdea Land, S.L. which provides the FOUNDATION with the "Teenvío" service for sending e-mails to third parties. The FOUNDATION will not transfer its data to any other third party, except under a legal obligation. |
| Storage period: | The processing of data will continue until the request for removal by the data subject. |
2.7 Management of users of the website Museothyssen.org
| Activity: | Management of users of the website Museothyssen.org |
|---|---|
| Purpose: | Offering access to non-public content channels: press channel, tourism professionals channel and the Friends of the Museum channel called "Friends Area". No profiles will be prepared of the data subjects nor will automated decisions be taken based on such profiles. |
| Source of data: | The FOUNDATION obtains the personal data from the data subjects, directly or through their authorised representative, through the online user registration form of the website museothyssen.org |
| Categories of data: | Name and surnames, Phone, Address, Tax Identification Number and Email. |
| Legal grounds: | The legal basis for processing the data subject’s data by the FOUNDATION is found in section 6.1.a) of the GDPR, i.e., the consent of the data subject. |
| Recipients of shared or transferred data: | The FOUNDATION will not transfer your data to any other third party unless legally required. |
| Storage period: | The processing of data will continue until the user requests the deletion of the account. |
2.8 Management of users of Educathyssen.org
| Activity: | Management of users of Educathyssen.org |
|---|---|
| Purpose: | Offering access to non-public content channels where users can participate in online projects and upload content and comments. No profiles will be prepared of the data subjects nor will automated decisions be taken based on such profiles. |
| Source of data: | The FOUNDATION obtains the personal data from the data subjects, directly or through their authorised representative, through the online user registration form of the website educathyssen.org. |
| Categories of data: | Name and surnames, Phone, Address, Tax Identification Number and Email. |
| Legal grounds: | The legal basis for processing the data subject’s data by the FOUNDATION is found in section 6.1.b) of the GDPR, i.e., the performance of a contract. |
| Recipients of shared or transferred data: | The FOUNDATION will not transfer your data to any other third party unless legally required. For those actions carried out through Thinkific.com, international transfers of data will be made to Canada, the location of infraestructure supporting the platform. This transfer has been declared to have an adequate level of protection by the European Commission Decision 2002/2/EC of 20 December 2001. |
| Storage period: | The processing of data will continue until the user requests the deletion of the account. |
2.9 Online information request
| Activity: | Online information request |
|---|---|
| Purpose: | Processing requests for information about exhibitions, activities, corporate events, collaboration and sponsorship options, purchases of tickets and products. No profiles will be prepared of the data subjects nor will automated decisions be taken based on such profiles. |
| Source of data: | The FOUNDATION obtains the personal data from the data subjects, directly or through their authorised representative, through the Information Request Forms and Help Forms of the FOUNDATION’s Websites. |
| Categories of data: | Name and surnames, email address, phone and, if applicable, name of the company the user belongs to. |
| Legal grounds: | The legal basis for processing the data subject’s data by the FOUNDATION is the FOUNDATION’s legitimate interest, provided for in section 6.1.f) of the GDPR. |
| Recipients of shared or transferred data: | The FOUNDATION will not transfer your data to any other third party unless legally required. |
| Storage period: | The FOUNDATION will store the data for one year from the time of the consultation, to be able to follow-up the request. The processing of data will continue until the request for removal. |
2.10 Wi-Fi service
| Activity: | Wi-Fi service |
|---|---|
| Purpose: | Offering free Wi-Fi in the Museum’s rooms and other spaces. No profiles will be prepared of the data subjects nor will automated decisions be taken based on such profiles. |
| Source of data: | The FOUNDATION obtains the personal data directly from the data subject via an internet login form when a user accesses internet through the free Wi-Fi of the FOUNDATION in the Museum. |
| Categories of data: | Email Address. |
| Legal grounds: | The legal basis for processing the data subject’s data by the FOUNDATION is the FOUNDATION’s legitimate interest, provided for in section 6.1.f) of the GDPR. |
| Recipients of shared or transferred data: | The FOUNDATION will not transfer your data to any other third party unless legally required. |
| Storage period: | 1 year |
2.11 Sending digital postcards
| Activity: | Sending digital postcards |
|---|---|
| Purpose: | Sending of digital postcards by visitors or users of the website to third parties. No profiles will be prepared of the data subjects nor will automated decisions be taken based on such profiles. |
| Source of data: | The FOUNDATION obtains the personal data of the postcard's sender by means of the form provided to send digital postcards. The FOUNDATION does not incorporate the personal data of postcard senders in its databases. |
| Categories of data: | Name and surnames and email. |
| Legal grounds: | The legal basis for processing the data from contracts signed by the FOUNDATION and the data subject is found in section 6.1.b) of the GDPR, i.e., the performance of a contract. The sender of a digital postcard must provide their personal data to the FOUNDATION to allow the FOUNDATION to provide the service of sending digital postcards to a third party on their behalf, through the Websites of the FOUNDATION. |
| Recipients of shared or transferred data: | The FOUNDATION will not transfer your data to any third party unless legally required. |
| Storage period: | The data will be kept as long as it is necessary for the provision of the requested services. |
2.12 Crowdfunding
| Activity: | Crowdfunding |
|---|---|
| Purpose: | Participating in Crowdfunding campaigns promoted by the FOUNDATION to finance its own projects. No profiles will be prepared of the data subjects nor will automated decisions be taken based on such profiles. |
| Source of data: | The FOUNDATION obtains the personal data directly from the data subject by means of a form provided to make the donations. |
| Categories of data: | Name and surnames, email, Tax Identification Number, or alternative identification document and address. |
| Legal grounds: | The legal basis for processing the data from contracts signed by the FOUNDATION and the data subject is found in section 6.1.b) of the GDPR, i.e., the performance of a contract. |
| Recipients of shared or transferred data: | The data will be communicated to the Data Processor company, currently Stockcrowd S.L., which provides services to the FOUNDATION to carry out crowdfunding campaigns. The FOUNDATION will not transfer your data to any third party unless legally required. |
| Storage period: | The data will be kept as long as it is necessary for the provision of the requested services. |
2.13 Recruitment processes
| Activity: | Recruitment processes |
|---|---|
| Purpose: | Managing candidates in public recruitment processes. No profiles will be prepared of the data subjects nor will automated decisions be taken based on such profiles. |
| Source of data: | The FOUNDATION obtains the personal data directly from the data subjects through the channels provided to send CVs, or through their authorised legal representatives. |
| Categories of data: | Name and surnames, Phone, Address, Tax Identification Number, Photograph, Academic data, Professional data and other data included on the CV. |
| Legal grounds: | The legal basis for processing the data subject’s data by the FOUNDATION is the FOUNDATION’s legitimate interest, provided for in section 6.1.f) of the GDPR. |
| Recipients of shared or transferred data: | The FOUNDATION will not transfer your data to any third party unless legally required. |
| Storage period: | 1 year from receipt or until the selection process is completed, whichever is later. |
2.14 Media communications
| Activity: | Media communications |
|---|---|
| Purpose: | Informing interested media about the cultural activities organised by the FOUNDATION as well as sending invitations to exhibitions and events. No profiles will be prepared of the data subjects nor will automated decisions be taken based on such profiles. |
| Source of data: | The FOUNDATION obtains the personal data from the data subjects themselves. |
| Categories of data: | Name and surnames, Telephone, Address, Email. Name of the media organisation to which the data subject belongs. |
| Legal grounds: | The legal basis for processing the data subject’s data by the FOUNDATION is the FOUNDATION’s legitimate interest, provided for in section 6.1.f) of the GDPR. |
| Recipients of shared or transferred data: | The data will be communicated to Ipdea Land, S.L. in its capacity as Data Processor, which provides the "Teenvio" service to the FOUNDATION for sending emails to third parties. The FOUNDATION will not transfer your data to any other third party unless legally required. |
| Storage period: | The processing of data will continue until the request for removal by the data subject. |
2.15 Institutional communications
| Activity: | Institutional communication |
|---|---|
| Purpose: | Informing interested parties about the cultural activities organised by the FOUNDATION as well as sending invitations to exhibitions and events. No profiles will be prepared of the data subjects nor will automated decisions be taken based on such profiles. |
| Source of data: | The FOUNDATION obtains the personal data from the data subjects themselves. |
| Categories of data: | Name and surnames, Telephone, Address, Tax Identification Number, Email and Occupation Position. |
| Legal grounds: | The legal basis for processing the data subject’s data by the FOUNDATION is the FOUNDATION’s legitimate interest, provided for in section 6.1.f) of the GDPR. |
| Recipients of shared or transferred data: | The data will be communicated to Ipdea Land, S.L. in its capacity as Data Processor, which provides the "Teenvio" service to the FOUNDATION for sending emails to third parties. The FOUNDATION will not transfer your data to any other third party unless legally required. |
| Storage period: | The processing of data will continue until the request for removal by the data subject. |
2.16 Communication with professionals
| Activity: | Communication with professionals |
|---|---|
| Purpose: | Informing about the Museum’s activities, products and exhibitions for professionals, in the context of the contractual and pre-contractual relationships established with each professional. No profiles will be prepared of the data subjects nor will automated decisions be taken based on such profiles. |
| Source of data: | The FOUNDATION obtains the personal data from the data subjects themselves. |
| Categories of data: | Name and surnames, Telephone, Address, Tax Identification Number, Email and Occupation Position. |
| Legal grounds: | The legal basis for processing the data subject’s data by the FOUNDATION is the FOUNDATION’s legitimate interest, provided for in section 6.1.f) of the GDPR. |
| Recipients of shared or transferred data: | The data will be communicated to Google LLC, domiciled in the USA, in its capacity as Data Processor, providing information society services to the FOUNDATION (in particular, the GSuite - Google Cloud service). That entity adheres to the "Privacy Shield" agreement between the US and the European Union. You can find more information by clicking on the name of this organization. The data will be communicated to Ipdea Land, S.L. in its capacity as Data Processor, which provides the "Teenvio" service to the FOUNDATION for sending emails to third parties. The FOUNDATION will not transfer your data to any other third party unless legally required. |
| Storage period: | The processing of data will continue until the request for removal by the data subject. |
2.17 Sending commercial and promotional communications
| Activity: | Sending commercial and promotional communications |
|---|---|
| Purpose: | Informing about the Museum, its activities, products, exhibitions, promotional and marketing actions. The FOUNDATION will use the data to prepare profiles of the data subjects for the purpose of informing them about the FOUNDATION's activities and products similar to those they have previously expressed an interest in. |
| Source of data: | The FOUNDATION obtains the personal data from the data subjects through their registration in the different forms available on the FOUNDATION’S Websites or the Museum's customer service points. |
| Categories of data: | Name and surnames and Email. |
| Legal grounds: | The legal basis for processing the data subject’s data by the FOUNDATION is found in section 6.1.a) of the GDPR, i.e., the consent of the data subject. |
| Recipients of shared or transferred data: | The data will be communicated to Ipdea Land, S.L. in its capacity as Data Processor, which provides the "Teenvio" service to the FOUNDATION for sending emails to third parties. The FOUNDATION will not transfer your data to any other third party unless legally required. |
| Storage period: | The processing of data will continue until the request for removal by the data subject. |
2.18 'Perspectivas' Newsletter
| Activity: | |
|---|---|
| Purpose: | Periodically informing about the Museum’s news, programme and promotional actions. No profiles will be prepared of the data subjects nor will automated decisions be taken based on such profiles. |
| Source of data: | The FOUNDATION obtains the personal data from the data subject through the “Perspectivas” subscription form. |
| Categories of data: | Name and surnames, Telephone, Address, Tax Identification Number and Email. |
| Legal grounds: | The legal basis for processing the data subject’s data by the FOUNDATION is found in section 6.1.a) of the GDPR, i.e., the consent of the data subject. |
| Recipients of shared or transferred data: | The data will be communicated to Ipdea Land, S.L. in its capacity as Data Processor, which provides the "Teenvio" service to the FOUNDATION for sending emails to third parties. The FOUNDATION will not transfer your data to any other third party unless legally required. |
| Storage period: | The processing of data will continue until the request for removal by the data subject. |
2.19 Right of access to information
| Activity: | Right of access to information |
|---|---|
| Purpose: | Process the request for public information, under the terms provided in Article 105.b) of the Spanish Constitution, developed by the Transparency Act. Profiles of the interested parties will not be drawn up, nor will automated decisions be made on the basis of said profile. |
| Source of data: | The FOUNDATION obtains the personal data of interested parties, through themselves or their authorized representative, by means of the information request form on the Transparency Portal of the website www.museothyssen.org or by addressed to @email. |
| Categories of data: | Name and surname, email, telephone, NIF or passport. |
| Legal grounds: | The legal basis for the processing of personal data of the data subject by the FOUNDATION lies in the legitimate interest of the FOUNDATION, provided for in Article 6.1.f) of the GDPR. |
| Recipients of shared or transferred data: | The FOUNDATION will not transfer your data to any other third party, unless legally required to do so. |
| Storage period: | 1 year from the date of sending or until the end of the current selection process, whichever comes later. |
2.20 Participation in activities
| Activity: | Participation in activities |
|---|---|
| Purpose: | Managing the participation in activities, both online and in person, organized by the Museum. No profiling of data subjects or automated decisions will be made on the basis of such profiling. |
| Source of data: | The FOUNDATION obtains the personal data of the interested parties through themselves or their authorized representative, by means of online forms associated with each activity. |
| Categories of data: | Name, surname, age range, email, social network user. |
| Legal grounds: | The legal basis for the processing of personal data from contracts signed by the FOUNDATION and the data subject is found in Article 6.1.b) of the GDPR, i.e. the performance of a contract. You must provide your personal data to the FOUNDATION for the proper performance of the contract. If you do not do so, you will not be able to participate in the activity organized by the Museum. |
| Recipients of shared or transferred data: | The data will be communicated to Google LLC, domiciled in the USA, in its capacity as Data Processor, which provides information society services to the FOUNDATION (in particular, the GSuite - Google Cloud service). This entity is adhered to the “Privacy Shield” agreement between the USA and the European Union. You can find more information by clicking on the name of this entity. The data will be communicated to Ipdea Land, S.L. in its capacity as Data Processor, which provides the FOUNDATION with the “Teenvio” service for sending e-mails to third parties. The FOUNDATION will not transfer your data to any other third party, except under legal obligation. |
| Storage period: | The data will be retained as long as necessary for the provision of the requested services and for the legally required periods to determine any possible liabilities arising from the service provided. |
2.21 Visitor services
| Activity: | Visitor services |
|---|---|
| Purpose: | Comprehensive management of the relationship with museum visitors, including the resolution of queries and incidents, the handling of requests for information and the management of communications, both in person and online. |
| Legal grounds: | GDPR: 6.1.a) Consent of the data subject for dealing with queries, resolving incidents and requests for information. GDPR: 6.1.b) TProcessing necessary for the performance of a contract to which the data subject is a party or for the implementation at the request of the data subject of pre-contractual measures. |
| Categories of data: | full name, contact address, email address, telephone number. |
| Recipients of shared or transferred data: | Companies in charge of processing personal data: HubSpot Ireland Ltd. |
| Storage period: | The data will be retained for the time necessary to manage and resolve the query, request or incident, and thereafter for the applicable legal periods to address possible liabilities arising from the processing. |
Contact
For any questions or queries about the processing and use of your data or the exercise of your lawful rights, please contact @email.