Privacy Policy

You are here:

Informativa sul trattamento e sulla protezione dei dati personali (Art. 13 GDPR)

GARDA MUSEI informs on how it processes and protects the personal data that it may process and acquire through the website.

Art. 1. Data controller: who collects the data and decides the purposes / methods of processing


Via del Vittoriale n. 12, 25083 Gardone Riviera (BS), Italy

VAT number: 04101050989

Cod. Fiscal: 96038330179

Telephone: [email protected]

The data controller is also known as “GARDA MUSEI” and resells its attractions and routes through the site:

Art. 2. Purpose and legal basis of the processing: Why the data is processed and what justifies the processing

GARDA MUSEI processes data for the following purposes.

Purpose a) – Registration on the portal

  • – Registration is done via the e-mail address.

Legal basis: execution of a contract.

The refusal to provide the e-mail address prevents registration to the portal.

Purpose b) – Purchase of routes and experiences

  • – At the time of purchase, you are asked to confirm your billing data (name, surname, address).

Legal basis: execution of a contract.

The refusal to provide the e-mail address prevents registration to the portal.

Purpose c) – Right of defence

  • – Exercise the rights of the Data Controller, for example any right of defence (judicial and extrajudicial).

Legal basis: legitimate interest of the owner.

The Data Controller does not carry out data profiling.

Art. 3. Data processed and processing methods

To achieve the purposes of Art. 2 GARDA MUSEI processes the following data: e-mail address, name, surname and address of the person making the purchase. The telephone number can also be provided optionally.

All data communicated to GARDA MUSEI are processed within the limits strictly necessary to achieve the purposes referred to in Article 2 above, with the aid of paper and computer tools.

Art. 4. Data retention

The data are processed and stored at the offices of the Data Controller and on the company tools used (e.g. computers, servers, smartphones, etc.).

The processing of data (paper and digital) is carried out with appropriate measures to guarantee the security and confidentiality of personal data, in particular in compliance with appropriate security measures and according to the principles of lawfulness, necessity and proportionality.

The data collected and processed are kept for the following periods:

Purpose a): 10 years from the end of the execution of the contract.

Purpose b): 10 years from purchase.

Purpose c): duration necessary to exercise the rights of the owner

Art. 5. Communication and transmission of data

The employees and / or collaborators of the Data Controller, in carrying out their normal work and / or collaboration activities, have access to the data as persons authorized to process.

Personal data may be transmitted to third parties who carry out the processing on behalf of the Data Controller, for example the structures that manage the attractions / routes purchased.

Payment data are managed by independent systems not attributable to GARDA MUSEI (payment by credit card and / or PayPal).

No data is resold to third parties.

Art. 6. Extra-EU data transmission

The transmission of extra-EU data is not foreseen.

Art. 7. Rights of the interested parties

Art. 7 n. 3 The data subject has the right to withdraw his or her consent at any time; Art. 15 Right of access, including the right to obtain an indication of the retention period of personal data. Right to obtain information on the origin of the data collected, as well as the purposes and methods of processing. Right to lodge a complaint with the Supervisory Authority at any time (Guarantor for the Protection of Personal Data); Art. 16 Right of the interested party to obtain the updating, rectification, integration of personal data; Art. 17 Right to erasure / right to be forgotten (when expected); Art. 18 Right to restriction of processing (when expected); Art. 20 Right to data portability (if the existing technology allows it); Art. 21 Right to object to processing; Art. 22 Right not to be subjected to a decision based solely on automated processing, including profiling.

In addition, Art. 19 obliges the Data Controller to notify the correction, cancellation and / or limitation of processing requested by the interested parties.

Art. 8. Requests of interested parties: How rights can be exercised

Requests relating to the exercise of the rights referred to in Article 7 above may be submitted by the interested parties to the Data Controller by registered letter or e-mail to the addresses listed in Article 1 above.

In all cases, interested parties must attach a valid identity document to the request.

Art. 9. Updates to this policy

This information may be subject to changes and additions, also as a consequence of any changes and / or regulatory additions. Any changes will be communicated to the interested parties.

Please note that the interested party can obtain the text of the constantly updated information by sending a request to the email: [email protected]