Privacy Policy
This privacy policy explains how Fondazione Museion processes the personal data of people who visit the website www.museion.it, under Article 13 of Regulation (EU) 2016/679 and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018. It does not cover third-party websites that may be reached through links on these pages.
1. Data controller
The data controller is Fondazione Museion. Museo di arte moderna e contemporanea (Museion, museum of modern and contemporary art), Piazza Piero Siena 1, 39100 Bolzano, Italy, telephone +39 0471 223413, email info@museion.it, in the person of its legal representative.
2. Data Protection Officer
The Foundation has appointed a Data Protection Officer under Article 37 of the Regulation, who can be contacted at rpd@museion.it for any matter concerning the processing of personal data and the exercise of the rights granted by the Regulation.
3. Data processed through the website
The IT systems and software that run the website acquire, during normal operation, certain data whose transmission is inherent in the use of internet communication protocols: IP addresses, browser and operating system type, addresses of the resources requested, time of the request, status code of the reply. This data is not collected to be linked to identified users, but it could allow identification through processing and combination with data held by third parties. It is used only to obtain statistical information on the use of the website and to check that it is working properly.
Sending messages to the addresses published on the website involves acquiring the sender’s address and the other personal data contained in the message, which are needed to reply to the request. Providing the data is optional, but without it no reply can be given.
Those who subscribe to the newsletter provide their email address and the other details requested by the form. Providing the data is optional, but without it the service cannot be delivered. The service is run through Brevo, a platform supplied by Brevo SAS (106 boulevard Haussmann, 75008 Paris, France), appointed as a processor under Article 28 of the Regulation, with servers located in the European Union. The sign-up form does not set cookies: data is transmitted only when the form is submitted.
Besides sending the content, the service records whether messages are opened, to measure how effective the communications are. This measurement is based on a separate consent, requested at sign-up, which can be withdrawn without ending the subscription. The subscription itself can be withdrawn at any time through the link included in every message.
The purchase functions of the Museion Shop are provided through the Shopify platform, supplied by Shopify International Ltd (Dublin, Ireland), appointed as a processor. The data provided is used to manage the order, the payment, the delivery and the related tax obligations. Providing the data is optional, but without it the order cannot be completed.
4. Purposes, legal bases and retention periods
For each processing operation carried out through the website, the table gives the purpose pursued, the legal basis and how long the data is kept.
Operation and security of the website
Legal basis: Legitimate interest of the controller, Article 6(1)(f) of the Regulation.
Retention: Log files are kept for as long as technically necessary and in any case no longer than seven days, unless computer offences have to be investigated.
Replying to messages sent to the addresses published on the website
Legal basis: Legitimate interest in replying to the requests received, Article 6(1)(f).
Retention: Two years from the last contact.
Sending the newsletter
Legal basis: Consent of the data subject, Article 6(1)(a).
Retention: Until the subscriber unsubscribes.
Measuring whether newsletter messages are opened
Legal basis: Consent of the data subject, Article 6(1)(a) and Article 122 of Legislative Decree 196/2003.
Retention: Until the subscriber unsubscribes.
Handling orders placed in the online shop
Legal basis: Performance of the contract, Article 6(1)(b), and legal obligations, Article 6(1)(c).
Retention: Ten years from completion of the transaction, for tax and civil law obligations.
Visit statistics
Legal basis: Legitimate interest in measuring the use of the website, Article 6(1)(f).
Retention: Detailed data for 180 days; aggregate reports kept in anonymous form.
Measuring advertising campaigns, retargeting and online shop functions
Legal basis: Consent of the data subject, Article 6(1)(a) and Article 122 of Legislative Decree 196/2003.
Retention: As set out in the list of cookies, with withdrawal always possible.
5. Cookies and other tracking technologies
Cookies are small text files that a website sends to the user’s device, where they are stored and sent back to the same website on the next visit. Alongside cookies there are other technologies with a similar effect, such as tracking pixels, third-party scripts and the browser’s local storage. In this section the word cookie also covers these technologies. First-party cookies are those stored on the domain of the website being visited, even where the information collected feeds the processing of another party; third-party cookies are those stored on the domain of a different provider.
With the exception of technical cookies, the tools described below are loaded only after the user has given consent, under Article 122 of Legislative Decree 196/2003 and Article 6(1)(a) of the Regulation. Consent is collected through the banner shown on the first visit.
These cookies are necessary for the website to work and for the user to access the content requested. They include the session cookie, which allows navigation between pages, and the cookie that stores the choices made on the banner, without which those choices would have to be requested on every page load. No consent is required for these cookies, only this information.
The website uses Matomo, statistical analysis software installed on the Foundation’s own servers. The data collected covers the pages visited, where the visit came from, the type of device and the browser used, and stays exclusively with the Foundation. The IP address is anonymised at the point of collection, the data is not combined with other databases or shared with third parties, and it is used only to measure how the website is performing.
Measurement is carried out without cookies and without any other form of storage of, or access to, information on the user’s device: for this reason Article 122 of Legislative Decree 196/2003 does not apply and no consent is required. Even if the tool were treated as an analytics cookie, it would fall among those that the Italian Data Protection Authority, in its cookie guidelines of 10 June 2021, treats in the same way as technical cookies.
Once the user has given consent, the website activates the Meta Pixel, a tool provided by Meta Platforms Ireland Ltd (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). It allows the Foundation to measure how its advertising campaigns perform on Facebook and Instagram and to reach again, with advertising messages, users who have already visited the website. The Pixel collects data about the visit: pages viewed, actions taken on the website, IP address and browser identifier. If the user has an account on a Meta platform and is logged in on the same browser, this information can be linked to that account.
For the collection and transmission of data to Meta, Fondazione Museion and Meta Platforms Ireland Ltd are joint controllers under Article 26 of the Regulation. The allocation of responsibilities is governed by Meta’s Controller Addendum, whose essential content is available at www.facebook.com/legal/controller_addendum. Any further processing that Meta carries out for its own purposes takes place with Meta acting as sole controller, as described in the privacy policy published at www.facebook.com/privacy/policy.
The components of the Shopify platform are loaded only after consent and set the cookies listed below, which identify the purchase session, manage the cart and produce the sales statistics.
For each cookie, the information below indicates its type, purpose, retention period and provider. Marketing cookies and online shop cookies are set only after express consent through the banner.
•session
Type: Technical, first-party
Function: Keeps the browsing session active and allows the user to move between pages.
Retention on the device: Session, deleted when the browser is closed.
Provider: Fondazione Museion.
•klaro
Type: Technical, first-party
Function: Stores the choices made on the banner so that it is not shown again on every page.
Retention on the device: 180 days.
Provider: Fondazione Museion.
•Matomo
Type: Statistical, first-party
Function: Counts visits and page views in aggregate form with an anonymised IP address; measurement is carried out without cookies.
Retention on the device: No identifier stored on the device.
Provider: Fondazione Museion.
•_fbp
Type: Marketing, first-party cookie set by the Meta script.
Function: Creates a browser identifier that links the visit to advertising campaigns.
Retention on the device: 3 months.
Provider: Meta Platforms Ireland Ltd.
•_fbc
Type: Marketing, first-party cookie set by the Meta script.
Function: Stores the parameter of the advert from which the user arrived, allowing the visit to be attributed to the campaign.
Retention on the device: 3 months.
Provider: Meta Platforms Ireland Ltd.
•_shopify_y
Type: Statistical, third-party.
Function: Identifies the visitor within the online shop and supports sales statistics.
Retention on the device: 1 year.
Provider: Shopify International Ltd.
•_shopify_s
Type: Technical for the online shop, third-party.
Function: Identifies the current purchase session.
Retention on the device: 30 minutes.
Provider: Shopify International Ltd.
•_secure_session_id
Type: Technical for the online shop, third-party.
Function: Manages the secure purchase session and shopping cart.
Retention on the device: 24 hours.
Provider: Shopify International Ltd.
The privacy policies of the third-party providers are available at www.facebook.com/privacy/policy for Meta Platforms Ireland Ltd and www.shopify.com/legal/privacy for Shopify International Ltd. The Foundation has no access to the data those parties process for their own purposes.
Users can change or withdraw their choices at any time through the Cookie settings link at the bottom of every page. Withdrawal is as easy as giving consent and takes effect immediately: services that have been switched off are no longer loaded on later visits. Choices are stored for 180 days, whether consent was given or refused: only once that period has expired is the request shown again, unless the conditions of the processing change significantly or the choices already made can no longer be read. Cookies can also be blocked through the browser settings, which also allow cookies already stored to be deleted: disabling technical cookies may stop the website from working properly.
6. Recipients of the data
Data collected through the website is processed by the Foundation’s authorised staff. The following act as processors under an appointment made in accordance with Article 28 of the Regulation: the IT suppliers responsible for developing and maintaining the website, the providers of the newsletter and e-commerce platforms, the agencies appointed to run communication and marketing campaigns, and the professionals who assist the Foundation in accounting and legal matters.
Meta Platforms Ireland Ltd holds a different position: it is joint controller with the Foundation for the collection and transmission of data through the Pixel, and sole controller for the further processing it carries out for its own purposes, as described in the relevant section. An up-to-date list of processors can be requested by writing to rpd@museion.it. Data may also be disclosed to public authorities in the cases provided for by law. No automated decision-making takes place and the data is not disseminated.
7. Transfers of data outside the European Union
Data collected through the Meta Pixel may be transferred to the United States. The transfer is based on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, which recognises an adequate level of protection for United States organisations certified under the EU-US Data Privacy Framework, among them Meta Platforms Inc. For any flows not covered by that certification, the standard contractual clauses set out in Implementing Decision (EU) 2021/914 apply in the alternative.
The provider of the e-commerce platform may also process data in Canada, covered by Decision 2002/2/EC as regards recipients subject to PIPEDA, and in the United States on the basis of the safeguards described above. A copy of the safeguards adopted can be requested by writing to rpd@museion.it. No transfers outside the European Economic Area are envisaged for the other processing operations described in this policy.
8. Rights of data subjects
In relation to the data processed through the website, data subjects may ask the Foundation for access to their data and to information about the processing, for rectification of inaccurate or incomplete data, for erasure of data that is no longer necessary or has been processed unlawfully, and for restriction of processing in the cases provided for in Article 18 of the Regulation. They may also exercise the right to data portability for data processed on the basis of consent or of a contract, receiving it in a structured, commonly used and machine-readable format or asking for it to be transmitted directly to another controller where technically feasible.
Data subjects may object at any time, on grounds relating to their particular situation, to processing based on legitimate interest, and may object in any case, without giving reasons, to processing for direct marketing purposes. Where processing is based on consent, that consent may be withdrawn at any time under Article 7(3) of the Regulation, without affecting the lawfulness of processing carried out before the withdrawal.
Requests should be sent to rpd@museion.it or to info@museion.it. The Foundation replies within one month of receipt, a period that may be extended by two months where requests are complex or numerous, in which case the data subject is informed.
9. Complaint to the supervisory authority
Anyone who considers that the processing of their data infringes data protection law may lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, protocollo@gpdp.it, certified email protocollo@pec.gpdp.it, or bring the matter before the courts.
10. Changes to this policy
This policy may be updated to reflect changes in the law or new services on the website. The version published on this page is the one in force. Changes affecting processing based on consent are brought to the user’s attention through the banner.
Last updated: 4 September 2026.
