Information on the right to protection of personal data

pursuant to EU Regulation 2016/679

Dear user,

We inform you that your personal data will be processed, in compliance with EU Regulation 2016/679, by’Carmelite Institute, via Sforza Pallavicini 10 – Rome.

Data controller

The Data Controller is the’Carmelite Institute, in the person of its General Archivist.

Data controller

The personal data provided by you are acquired by the Head of the’Carmelite Institute, as “Data Controller”, pursuant to art. 28 of the EU Regulation.

Purpose of processing and veracity of the data communicated

The personal data provided by you are necessary for the fulfillment of legal obligations and for the performance of the activities of the’Carmelite Institute, in relation to access to the consultation and photocopying service of the documents stored therein, and are processed for purposes related to the management of the institution-user relationship.

Without prejudice to the fact that the communication of false data will result in the imposition of administrative sanctions, without prejudice to the possible criminal relevance of the related conduct, pursuant to art. 76 of Presidential Decree no. 445 of 28 December 2000, the communication of your personal data is necessary for the purposes of accessing the’Carmelite Institute and its services, under penalty of exclusion from the same.

Processing and storage methods

Your personal data will be processed, including with the aid of computerised tools, to achieve the purposes for which they were collected.. Please note that unless a deadline for data deletion is set, the data will remain available for judicial authorities and/or for historical, cultural, and statistical purposes.

The Data Controller, in compliance with Article 32 of GDPR 2016/679, implements appropriate measures to ensure that users' personal data is processed appropriately and in accordance with the purposes for which it is processed. The Data Controller employs appropriate organizational and technical security measures to protect your personal data from alteration, destruction, loss, theft, or improper or unlawful use.

Scope of communication and dissemination

Your personal data will not be disclosed without your explicit consent. However, if necessary, it may be disclosed:

1. to the subjects to whom the communication must be made in compliance with an obligation established by national and/or EU legislation or to comply with an order of the Judicial Authority;
2. to the persons designated by the Data Controller as Data Processors. The Data Processors are required by the Data Controller to ensure appropriate organizational and technical measures to protect the personal data processed;
3. to persons authorized to process personal data directly by the Data Controller or the Data Processor, who may not delegate data processing to third parties without prior written authorization from the Data Controller;
4. to any other third parties, in compliance with the current provisions regarding the protection of personal data, in the cases expressly provided for by law or when communication is necessary for the protection of the’Carmelite Institute in court.

Transfer of personal data

The Data Controller may transfer your personal data to public or private entities outside of Italy only for purposes related to accessing and consulting the documents owned by the Carmelite Order.

Special categories of personal data

Pursuant to Articles 9 and 10 of EU Regulation No. 2016/679, you may confer to the’Carmelite Institute data that can be classified as “special categories of personal data” and that is, data that reveal “racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation”" These categories of data may be processed by the’Carmelite Institute only with your free and explicit consent, expressed in writing at the bottom of this information notice.

At any time, you may exercise, pursuant to Articles 15 to 22 of EU Regulation no. 2016/679, the right to:

1. ask for confirmation of whether or not personal data concerning you exists;
2. obtain information regarding the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed and, where possible, the retention period;
3. obtain the rectification and deletion of data;
4. obtain restriction of processing;
5. obtain data portability, i.e. receive data from a data controller, in a structured, commonly used and machine-readable format, and transmit them to another data controller without hindrance;
6. object to the processing at any time;
7. ask the data controller for access to personal data and to rectify or erase it or to limit or object to the processing of the data, in addition to the right to data portability;
8. withdraw consent at any time without prejudice to the lawfulness of the processing based on the consent given before the withdrawal, without prejudice to the consequences of the withdrawal on ongoing proceedings;
9. lodge a complaint with a supervisory authority.

You can exercise your rights by sending a written request to’Carmelite Institute via the following email address: institutumcarmelitanum7@gmail.com.

If you believe that the processing of your personal data has not complied with the Regulation, you have the right to lodge a complaint with the competent supervisory authority (Italian Data Protection Authority) pursuant to Article 77 of the EU Regulation.