Data Controller
[TO BE COMPLETED: registered company name] – [TO BE COMPLETED: registered office] – VAT no. [TO BE COMPLETED: VAT number]
Museum address: Via Fillungo 118, 55100 Lucca (LU), Italy
Email: info@blurredartmuseum.com
This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the «GDPR») and to Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018. It describes how we process the personal data of visitors to blurredartmuseum.com.
Last updated: 22 September 2026
1. What data we collect
a) Browsing data. The computer systems and software procedures that operate this website acquire, during normal operation, certain data whose transmission is inherent in the use of Internet communication protocols: IP address, browser type and operating system, date and time of the visit, pages requested. This data is used solely to ensure the correct functioning and security of the site and is not used to identify users.
b) Data you send us voluntarily. This website contains no contact forms and collects no data directly through any form. If you choose to write to the email address shown, we will process the data contained in your message (name, email address, and any other data you choose to share) solely in order to respond to your request.
c) Messages via Instagram. The site contains a link that opens a conversation with our Instagram profile. If you choose to contact us this way, the conversation takes place on Meta’s platform and your data is also processed by Meta Platforms Ireland Ltd. as an independent controller, under its own privacy policy. We process the content of your message in order to reply to you.
2. Purposes and legal bases
| Purpose | Legal basis |
|---|
| Delivering the website, keeping it secure and diagnosing faults | Legitimate interest of the controller in providing a secure, working service (Art. 6.1.f GDPR) |
| Replying to enquiries and visit bookings | Pre-contractual measures taken at the data subject’s request (Art. 6.1.b GDPR) |
| Storing technical cookies | No consent required (Art. 122, Legislative Decree 196/2003) |
| Loading the Google map, only at the user’s request | Loading is not automatic: it happens only when the user voluntarily selects «Show the map», after being informed that this action establishes a connection with Google (cf. Art. 6.1.a GDPR) |
3. Whether providing data is mandatory
Providing your data is always optional. If you do not provide it, the only consequence is that we will be unable to answer your request. There is no legal or contractual obligation to give us any data in order to browse the site.
4. Who we share data with
Your data is never disseminated and is not sold or transferred to third parties for commercial purposes. It may be accessed by:
• authorised staff of the controller, within the limits of their duties;
• our hosting and email provider, Aruba S.p.A., appointed as a data processor under Art. 28 GDPR;
• the third-party service providers listed in the Cookie Policy, acting as independent controllers;
• competent authorities, where required by law.
5. Transfers outside the European Economic Area
The Google and Meta services described in the Cookie Policy are contacted only after an explicit action on your part (clicking the map button or the Instagram link). When that happens, their use may involve transfers of data to the United States. Such transfers take place on the basis of the European Commission’s adequacy decision of 10 July 2023 concerning the EU-U.S. Data Privacy Framework, to which both companies adhere, and secondarily on the basis of the Standard Contractual Clauses adopted by the Commission.
6. How long we keep data
• Server logs: no longer than 30 days, except where it becomes necessary to establish liability in the event of computer crime.
• Email correspondence and Instagram messages: for as long as needed to handle the request and, afterwards, for the period useful to demonstrate that we acted properly, ordinarily no longer than 24 months.
• Cookies: for the durations stated in the Cookie Policy.
7. Your rights
As a data subject you may exercise at any time the rights set out in Articles 15-22 GDPR:
• access to your personal data and to information about the processing (Art. 15);
• rectification of inaccurate or incomplete data (Art. 16);
• erasure of your data, where applicable (Art. 17);
• restriction of processing (Art. 18);
• data portability (Art. 20);
• objection to processing based on legitimate interest (Art. 21).
Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7.3 GDPR).
To exercise these rights, write to info@blurredartmuseum.com. We will reply within one month of receiving your request.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Art. 77 GDPR) – Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy – www.garanteprivacy.it – or with the supervisory authority of the EU country where you reside.
8. Security
We apply technical and organisational measures appropriate to protect data against destruction, loss, unauthorised access or unlawful processing, pursuant to Art. 32 GDPR. The site is served over an encrypted HTTPS connection.
9. Children
This site is not directed at children under 14 and does not knowingly collect their data. If you believe a child has provided us with personal data, please write to us and we will delete it.
10. Automated decision-making
We carry out no profiling and no automated decision-making within the meaning of Art. 22 GDPR.
11. Changes
This notice may be updated. The version in force is always the one published at this address, showing the date it was last updated.
What cookies are
Cookies are small text files that the sites you visit send to your device, where they are stored so they can be sent back to those same sites on your next visit. Alongside cookies there are other tracking technologies with similar functions.
Cookies used by this site
This site uses no profiling cookies and no analytics or statistics cookies. Google Analytics, advertising pixels and audience measurement tools are not installed. We do not track your browsing for commercial purposes.
The site sets no first-party cookies of its own beyond those strictly technical ones required to deliver it.
Typefaces are hosted on our own servers and are no longer fetched from Google Fonts, so simply visiting a page involves no communication with Google. Likewise, no external content delivery network (CDN) is used for libraries or stylesheets.
Third-party services
On first load, the pages contact no third-party service at all. There are, however, items and links which, if you activate them, cause a connection to an external provider, which then receives your IP address and may set its own cookies. These are:
| Service | Provider | Where | What it involves | Privacy policy |
|---|
| Google Maps | Google Ireland Ltd. | Home page, on request only |
The map is not loaded automatically: a placeholder with a «Show the map» button appears instead. Until you press it, no request reaches Google. After the click a connection to the Google services is established; they may receive your IP address and other technical data attached to the request, and may use their own cookies or other tools, under their own terms and privacy notices. |
policies.google.com/privacy |
| Instagram | Meta Platforms Ireland Ltd. | Link in the contact section |
A link only: no Instagram content is embedded in the pages and the site sets no Meta cookies. Processing occurs if you choose to open the conversation. |
privacycenter.instagram.com/policy |
How to manage cookies in your browser
You can block or delete cookies, including third-party ones, directly from your browser settings. Disabling technical cookies may impair some features of the site. Instructions:
Legal references
Regulation (EU) 2016/679 (GDPR); Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, in particular Art. 122; Guidelines of the Italian Data Protection Authority on cookies and other tracking tools of 10 June 2021.
This page is reachable through a link in the footer of every page of the site.
