Processing of Personal Data
Information on the Processing of Personal Data
Article 13 of the New European Regulation 2016/679 on the protection of individuals with regard to the processing of personal data (GDPR).
1. Data Controller
The Controller of the processing of personal data is the Dicastery for Evangelization (Section for the Fundamental Questions Regarding Evangelization in the World), located at Via della Conciliazione, 5 - 00120 Vatican City.
The personal data being processed are collected directly by the Data Controller, who guarantees the utmost confidentiality in the processing of personal data in accordance with the provisions of the current legislation on the protection of personal data, undertaking to carry out the processing of personal data in accordance with the principles of fairness, lawfulness, transparency and in accordance with the intended purpose, to collect personal data to the necessary and exact extent, and to use it solely for the authorized purpose.
For clarifications and questions regarding the processing of personal data, you can contact the following e-mail address:
For more information regarding the rights of the Data Subject, please refer to Section 9 called "Rights of the Data Subject."
2. Purpose of Processing and Legal Basis
Personal data will be processed for the purposes set out below and in accordance with current regulations. The processing is necessary for the pursuit of the interest in participating in the event at hand and the performance of the related activities.
Only with the explicit consent of the Data Subject, can the Data Controller use the personal data for the following purposes:
a) Participation in the International Exhibition "100 PRESEPI IN VATICANO": the Controller collects and processes personal data:
· in order to enable the proper participation of the Data Subject in the International Exhibition;
· in order to display the identifying data of the artist/exhibitor of the work (first name, last name, nationality, Company/Entity/Institution/Embassy) on a special tag;
· in order to receive electronically and/or by telephone, communications from the Controller pertaining to the event in question.
b) The electronic sending of informative communications by the Controller pertaining to initiatives and events promoted by itself or by third parties.
3. Nature of Data Provision
Please note that, in relation to the purpose mentioned in point 2a), the provision of personal data is mandatory and any refusal to provide the requested personal data or the incorrect communication of any of the necessary information will result in a lack of confirmation of participation, as well as being unable to exhibit one's work at the International Exhibition "100 PRESEPI IN VATICANO".
4. Processing Methods
The processing of the Data Subject's data will be carried out in an automated manner through computer and telematic tools, with logistics of organization and processing of data, related to the purposes indicated above and in such a way as to ensure the security and confidentiality of data and communications. The data may also be processed in paper form.
5. Data Processing Duration.
Personal data will be processed and stored electronically by the Data Controller strictly for the time necessary to carry out the aforementioned purposes. With regard to the purpose stated in 2(b), personal data will be kept for a period not exceeding 5 years at the end of which time the data will be, in whole or in part, automatically deleted or permanently anonymized.
6. Recipients of the Data Processing
The personal data collected will not be disclosed, but may be known, within the limits and for the purposes indicated above, by employees and collaborators of the Data Controller, as well as communicated to the Public Security Authorities, both Vatican and Italian, and external parties for organizational needs only.
7. Cookie Policy
The Data Subject is required to read the information on cookies and give specific consent.
8. Transfer of Data Abroad
Personal data will be managed and stored on servers belonging to the Data Controller and/or third party companies entrusted and duly appointed as External Data Processors located within the European Union. However, the Data Controller reserves the right to transfer personal data to a Third Country in accordance with the European Commission's adequacy decisions, i.e. according to the adequate safeguards provided by the current legislation.
9. Rights of the Data Subject.
As a Data Subject, the persons to whom the data refer, may exercise, at any time, the rights provided in the European Regulation 2016/679, namely:
- the right to access the data concerning them, in accordance with Article 15 of the GDPR;
- the right to rectification of inaccurate data and to supplement incomplete data, pursuant to Article 16 of the GDPR;
- the right to erasure ("right to be forgotten"), pursuant to Article 17 of the GDPR;
- the right to restriction in the cases provided for in Article 18 of the GDPR;
- the right to data portability, in accordance with Article 20 of the GDPR, i.e., to receive in a structured, commonly used and machine-readable format personal data concerning him or her, as well as the right to transmit such data to another Data Controller without hindrance, for legitimate reasons in the processing of personal data concerning him or her even if relevant to the purpose of collection;
- the right to object to the data processing, for reasons related to one's particular situation, as set forth in Article 21 of the GDPR.
For the purpose of exercising these rights, the Data Subject may submit their requests by contacting the "Dicastery" at the following e-mail address:
Alternatively, the request can be sent by registered mail with return receipt directly to the office of the Data Controller:
Dicastery for Evangelization (Section for the Fundamental Questions Regarding Evangelization in the World)
Via Conciliazione, 5
00120 Vatican City
The Data Controller undertakes to respond to the Data Subject's requests within a period of one month, except in cases of particular complexity, for which it may take a period of time not exceeding three months. In any case, the Data Controller will provide evidence to the Data Subject of the reason for the wait within one month of their request. The outcome of the request will be provided in electronic format.
The Data Controller specifies that a possible contribution may be requested from the Data Subject if the requests are found to be manifestly unfounded, excessive or repetitive. To this end, the Data Controller will set up a registry to track requests for action.