PRIVACY POLICY AND LEGAL NOTES
Information on the processing of personal data
This Privacy Policy describes how I BUONI S.r.l.s., acting as the data controller, collects and processes the personal data of users who visit and use the website www.banksymuseo.it.
This information is provided pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) and current Italian legislation on the protection of personal data.
The use of the website implies the acknowledgment of this Privacy Policy and the related applicable provisions.
1. DATA CONTROLLER
The Controller of the personal data collected through the website is:
I BUONI S.r.l.s.
Via Emilia 80
27058 Voghera (PV)
Italy
VAT Number and Fiscal Code: 03048920189
E-mail: info@ibuonisiamonoi.it
For any request regarding the processing of personal data or to exercise your rights, you may contact the Data Controller using the e-mail address indicated above.
2. PERSONAL DATA COLLECTED
Browsing and using the website may involve the collection and processing of certain categories of personal data.
2.1 Browsing Data
During the normal operation of the website, the computer systems and software procedures used to operate the website may acquire certain personal data, the transmission of which is implicit in the use of Internet communication protocols.
This category may include, by way of example:
- IP address;
- Domain name of the device used;
- Addresses of the requested resources;
- Time of the request;
- Method used to submit the request to the server;
- Status code of the server’s response;
- Information about the browser used;
- Information about the operating system and device;
- Other parameters relating to the user’s IT environment.
This data is processed mainly to allow the proper functioning of the website, ensure system security, and obtain aggregated statistical information on its use.
3. DATA PROVIDED VOLUNTARILY BY THE USER
The voluntary sending of personal data through the website, for example via the contact form, involves the acquisition of the data provided by the user.
Depending on the request, the following may be collected:
- First name and last name;
- E-mail address;
- Telephone number, if provided;
- Subject of the request;
- Message content;
- Any other information voluntarily entered by the user.
The processing of such data is necessary to respond to received requests and provide the requested information.
Users are kindly invited not to include unnecessary personal data or data belonging to special categories pursuant to Article 9 of the GDPR in the form, unless strictly necessary and required by law.
4. CONTACT FORM
The website www.banksymuseo.it provides users with a contact form through which requests for information regarding the museum, the exhibition, opening hours, visiting procedures, events, and other activities communicated through the website can be sent.
The data entered in the form is used exclusively to:
- Receive and manage the request;
- Contact the user in response to the request;
- Provide the requested information;
- Manage any subsequent communications related to the same request.
The legal basis for the processing is the performance of pre-contractual measures or the management of the data subject’s request pursuant to Art. 6, par. 1, lett. b) of the GDPR, or the legitimate interest of the Data Controller to manage received requests pursuant to Art. 6, par. 1, lett. f), where applicable.
Providing the data marked as mandatory is necessary to manage the request. Failure to provide such data may prevent the Data Controller from responding to the user’s request.
Data sent via the form is not used for marketing purposes unless the user has given specific consent where required by law.
5. PURPOSES OF PROCESSING
Personal data collected through the website may be processed for the following purposes:
- To enable navigation and the proper functioning of the website;
- To respond to requests sent via the contact form;
- To provide information regarding the museum, the exhibition, visits, and events;
- To manage any pre-contractual or contractual relationships;
- To guarantee the security of the website and IT systems;
- To prevent or detect any illicit use of the website;
- To perform statistical analysis, where applicable;
- To comply with legal obligations;
- To exercise or defend a legal right of the Data Controller;
- To manage any informative or promotional communications, exclusively in the cases and methods provided by applicable law.
6. LEGAL BASIS FOR PROCESSING
The processing of personal data may be based on:
- The performance of a contract or pre-contractual measures;
- Compliance with legal obligations;
- The legitimate interest of the Data Controller;
- The consent of the data subject, when required by law.
When processing is based on consent, the user may revoke it at any time without affecting the lawfulness of the processing carried out before the revocation.
7. LINKS TO EXTERNAL SITES AND TICKET PURCHASING PLATFORMS
The website www.banksymuseo.it does not directly sell tickets.
The website may contain links, buttons, or references to websites and online ticketing platforms managed by third parties, through which users may purchase tickets to visit the museum or attend events.
When the user selects one of these links, they are directed to an external site or platform.
From that moment on, the processing of personal data carried out by the external platform is governed by the respective privacy policy and terms of use of the platform operator.
I BUONI S.r.l.s. is not the entity that carries out online ticket sales through such platforms, unless otherwise specifically indicated on the relevant page.
The Data Controller is therefore not responsible for how external platforms process users’ personal data after accessing their services.
Before proceeding with the purchase, users are invited to consult the privacy policy and terms of sale of the ticketing platform used.
8. COOKIES AND SIMILAR TECHNOLOGIES
The website may use cookies and similar technologies to ensure the proper functioning of its pages, improve the browsing experience, perform statistical analysis, and, where applicable, provide third-party content or features.
Depending on their purpose, cookies can be classified as:
- Technical or Necessary Cookies: Essential for the proper functioning of the website and to allow users to use core features.
- Analytical Cookies: Used to collect statistical information regarding website usage, such as the number of visitors, pages viewed, and browsing patterns. When required by law, these cookies are used only with the user’s prior consent.
- Third-Party Cookies: Some features or services on the website may be provided by third parties who may use cookies or similar technologies.
Users can manage their preferences through the cookie management panel on the website or by modifying their browser settings.
For detailed information on the cookies actually used by the website, please refer to the relative Cookie Policy.
9. THIRD-PARTY SERVICES
The website may use services provided by third parties for the operation, security, analysis, and technical management of the website.
By way of example, the following may be used:
- Hosting services;
- Security services;
- Statistical analysis services;
- Form management services;
- Content management services;
- External content integration services;
- Cookie management services.
The actual list of services used and their relative cookies must be verified on the final technical configuration of the website before the publication of this notice.
10. PROCESSING METHODS
Personal data is processed using electronic and IT tools and, where necessary, paper-based tools.
Processing is carried out by adopting appropriate technical and organizational measures to guarantee a level of security appropriate to the risk.
Personal data is processed according to the principles of:
- Lawfulness, fairness, and transparency;
- Purpose limitation;
- Data minimization;
- Accuracy;
- Storage limitation;
- Integrity and confidentiality.
11. RECIPIENTS OF THE DATA
Personal data may be communicated, within the strictly necessary limits, to subjects who collaborate with the Data Controller for the management of the website and related activities.
This category may include:
- IT service providers;
- Hosting providers;
- Website technicians and maintenance personnel;
- Cybersecurity service providers;
- Consultants and professionals;
- Communication service providers;
- Providers of services used for website management;
- Public authorities and entities to whom communication is required by law.
Subjects who process data on behalf of the Data Controller are, where necessary, formally appointed as data processors pursuant to Art. 28 of the GDPR.
Personal data is not disseminated indiscriminately.
12. TRANSFER OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA
If any suppliers used by the website process personal data in countries located outside the European Economic Area, the Data Controller will adopt the guarantees provided by the GDPR for such transfers, where applicable.
These guarantees may include adequacy decisions by the European Commission, standard contractual clauses, or other tools provided by current legislation.
13. DATA RETENTION
Personal data is kept for the period necessary to pursue the purposes for which it was collected.
In particular:
- Data sent via the contact form is kept for the time necessary to manage and respond to the request and, subsequently, for the period necessary to protect the rights of the Data Controller or comply with legal obligations;
- Data processed within contractual relationships is kept for the duration of the relationship and for the subsequent period provided by applicable regulations;
- Data processed on the basis of consent is kept until its revocation, subject to further legitimate storage needs;
- Technical and browsing data is kept for the period necessary for the purposes for which it was collected.
At the end of the retention period, data is deleted or anonymized, unless its retention is necessary to comply with legal obligations or to protect the rights of the Data Controller.
14. RIGHTS OF THE DATA SUBJECT
Pursuant to Articles 15 et seq. of the GDPR, data subjects may exercise the following rights, in the cases provided for by law:
- Obtain confirmation of the existence or otherwise of personal data concerning them;
- Obtain access to their personal data;
- Know the origin of the data;
- Obtain the rectification of inaccurate data;
- Obtain the integration of incomplete data;
- Obtain the erasure of data in the provided cases;
- Obtain the restriction of processing;
- Object to processing;
- Obtain data portability in the cases provided for by Art. 20 of the GDPR;
- Revoke previously given consent;
- Lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
To exercise your rights, you can write to:
I BUONI S.r.l.s.
Via Emilia 80
27058 Voghera (PV) – Italy
E-mail: info@ibuonisiamonoi.it
The Data Controller will respond to the request within the terms established by current regulations.
15. MINORS
The website is not specifically intended for the collection of personal data from minors.
If the Data Controller becomes aware of the involuntary collection of personal data from a minor in violation of applicable regulations, they will proceed to delete it where necessary.
16. INTELLECTUAL PROPERTY
All content on the website www.banksymuseo.it, unless otherwise indicated, including texts, images, photographs, graphics, logos, audiovisual elements, layouts, distinctive elements, and editorial materials, is protected by applicable copyright and intellectual property laws.
The reproduction, distribution, modification, publication, communication to the public, or any other use of the website content, total or partial, not expressly authorized by the holder of the relative rights is prohibited.
Any third-party content present on the website remains the property of their respective owners.
17. LINKS TO EXTERNAL SITES
The website may contain links to websites, platforms, and services managed by third parties.
I BUONI S.r.l.s. does not necessarily control the content, terms of use, privacy policies, or data processing methods adopted by such subjects.
Access to external sites is at the user’s own risk.
In particular, regarding platforms used for ticket purchases, users are invited to directly consult the terms of sale and privacy policies of the respective operators.
18. LIABILITY AND WEBSITE AVAILABILITY
I BUONI S.r.l.s. is committed to keeping the information published on the website updated and correct, without however being able to guarantee at all times the complete absence of errors, omissions, or service interruptions.
The website may be temporarily unavailable for maintenance, updates, technical interventions, or for causes beyond the Data Controller’s control.
The Data Controller cannot be held responsible for any malfunctions deriving from causes outside their reasonable control.
19. CHANGES TO THE PRIVACY POLICY
This Privacy Policy may be modified or updated at any time, including as a result of regulatory, technical, or organizational changes.
Users are invited to periodically check this page.
The updated version of the Privacy Policy will be published on the website with the indication of the date of the last update.
Last updated: September 2026.
LEGAL NOTES
- Website: www.banksymuseo.it
- Controller / Publisher: I BUONI S.r.l.s.
- Registered Office: Via Emilia 80, 27058 Voghera (PV), Italy
- VAT Number & Fiscal Code: 03048920189
- E-mail: info@banksymuseo.it
The website is dedicated to the communication and promotion of the exhibition project and related activities.
The website does not directly sell tickets. Any purchases are made through external ticketing platforms to which the website may provide links.
Banksy Museum / Banksy Museo is not affiliated, endorsed, sponsored, or officially connected to the artist Banksy, unless otherwise explicitly indicated.
Any rights relating to works, trademarks, images, or third-party content belong to their respective owners.
COOKIE POLICY
For specific information on cookies and similar technologies used by the website, please consult the relative Cookie Policy.