INFORMATION ON THE PROCESSING OF PERSONAL DATA
Dear User,
We wish to inform you that the General Regulation on the Protection of Personal Data, promulgated by Decree of the Pontifical Commission for the Vatican City State, No. DCLVII, of 30 April 2024, contains provisions for the protection of natural persons with regard to the Processing of Personal Data, as well as rules relating to the free circulation of such Data.
Pursuant to art. 8 of the aforementioned Regulation, we provide you with the following information.
The Personal Data provided by you will be processed in accordance with the provisions of the aforementioned Regulation and in compliance with the principles of lawfulness, correctness, transparency, good faith and proportionality set forth therein.
1. Data Controller
The Data Controller, pursuant to art. 11 of the aforementioned Regulation, is the Governorate of the Vatican City State, in the person of the Secretary General of the Governorate.
2. Data Processor
The Data Processor, pursuant to art. 12 of the aforementioned Regulation, is the Directorate of the Pontifical Villas of the Governorate of the Vatican City State, reachable for the purposes of this information at the following email address: infopalazzo@scv.va
3. Data Protection Officer (DPO)
The Data Protection Officer (DPO) is the General Counselor of the Vatican City State.
4. Source and Type of Data Processed
The Data subject to processing, collected at the time of your interaction with the “Contacts” form, through the functions of the website www.villepontifice.va (hereinafter “Site”) are:
- personal data, identifying you (name and surname), contact details (email address), internet browsing and operations on internet systems.
5. Purpose and legal basis of the Processing
In compliance with the principles set out in art. 4 of the aforementioned Regulation, your Personal Data will be collected and processed within the scope of the activities of the Data Controller and to the extent strictly necessary to achieve the following purposes:
a. allow the receipt of detailed information requested by you;
b. allow the provision of the requested service (sending postal shipments containing goods);
c. guarantee the conservation, security and custody of the Data;
d. fulfill legal obligations;
e. guarantee the security and prevent fraudulent conduct.
The Governorate will not process the Data provided by you for purposes and purposes other than those explicitly indicated above.
The legal bases that legitimize the Processing functions are:
- the performance of a task of institutional interest or connected to the exercise of institutional functions with which the Data Controller is invested, connected to the provision of the requested service;
- the performance of a contract to which you are a party, the performance of pre-contractual measures, adopted at your request or the fulfillment of a legal obligation according to the legislation of the Vatican City State, to which the Data Controller is subject.
6. Processing Methods
The Processing of your data will take place in electronic and/or paper form, with manual and/or telematic tools for the time strictly necessary to achieve, exclusively, the purposes indicated in this information notice. In any case, the confidentiality and security of your data will be guaranteed, even in the event of the possible use of automated tools, in compliance with the security measures provided for by art. 14 of the aforementioned Regulation.
7. Subjects to whom the data may be communicated or who may become aware of it
Your personal data will not be disclosed (i.e. they will not be disclosed to an indeterminate number of people). They may be shared, within the limits of the purposes and with the methods indicated above, with:
a) subjects who act as Data Processors;
b) subjects who act as a Contact and/or persons expressly authorized to Process Personal Data (example: employees in the Pontifical Villas Management), in order to carry out activities strictly related to the achievement of the purposes for which the data are collected and indicated in this information;
c) subjects, entities or authorities to whom it is mandatory to communicate your Personal Data, by virtue of a legal obligation or an order of the Authority, or in fulfillment of a contractual or pre-contractual obligation, in relation to a business relationship to which you are a party, or third parties to whom the data may be communicated, subject to your express consent or upon your express request.
With reference to the subjects referred to in the previous point c), your Personal Data may also be transferred to recipients based in foreign countries, within the limits of the purposes and with the methods indicated above.
8. Retention period
Your data will be stored at the headquarters of the Data Controller of Processing and, if necessary, at the offices and/or premises of the other parties indicated in the previous point. Your data may be stored for a period not exceeding the achievement of the purposes set out in this information notice. The Data Controller may be required to store your Personal Data for a longer period, for archiving purposes in the public interest (by way of example and not limited to: legal obligation, order of the Authority), scientific or historical research.
9. Your rights
If the conditions are met, you may exercise, pursuant to the provisions of Title VI of the aforementioned Regulation, the following rights:
a) request confirmation as to whether or not your Personal Data is being Processed;
b) obtain information on the purposes of the Processing the categories of Personal Data, the recipients or categories of recipients to whom your Personal Data have been or will be communicated and, where possible, the retention period;
c) obtain the rectification of your Personal Data;
d) obtain the erasure of your Personal Data;
e) obtain the portability of your Personal Data, i.e. receive them from the Data Controller in a structured, commonly used and machine-readable format, and transmit them to another Data Controller, without impediments;
f) objection, at any time, to the Processing of your Personal Data;
g) obtain, where the conditions apply, the limitation of the Processing of your Personal Data;
h) withdraw, at any time, your consent to the Processing of your Personal Data, without prejudice to the lawfulness of the Processing carried out on the basis of the consent given before the withdrawal.
You may exercise the aforementioned rights by means of a written request, in paper or electronic form addressed to the Data Controller, reachable at the following email address: infopalazzo@scv.va
10. Right to lodge a complaint with the Data Protection Officer
Without prejudice to the appeal to the Judicial Authority of the Vatican City State, you have the right to lodge a complaint in writing with the DPO, pursuant to art. 25 of the aforementioned Regulation.
