NOTICE REGARDING THE PROCESSING OF PERSONAL DATA

 

Dear User,

We wish to inform you that the General Regulation on the Protection of Personal Data, promulgated by Decree of the Pontifical Commission for Vatican City State (No. DCLVII, dated 30 April 2024), sets forth provisions for the protection of natural persons with regard to the processing of personal data, as well as rules concerning the free movement of such data.

Pursuant to Article 8 of the aforementioned Regulation, we provide you with the following information.

The personal data provided by you will be processed in accordance with the provisions of the aforementioned Regulation and in compliance with the principles of lawfulness, fairness, transparency, good faith, and proportionality set forth therein.

 

1.    Data Controller

The Data Controller, pursuant to Article 11 of the aforementioned Regulation, is the Governorate of Vatican City State, represented by the Secretary General of the Governorate.

 

2.   Data Processor

The Data Processor, pursuant to Article 12 of the aforementioned Regulation, is the Directorate of the Pontifical Villas of the Governorate of Vatican City State; for the purposes of this notice, it may be contacted at the following email address: [email protected]

 

3.   Data Protection Officer (DPO)

The Data Protection Officer (DPO) is the General Counsellor of Vatican City State. 

 

4.   Source and Type of Data Processed

The data subject to processing, collected at the time of your interaction with the “Contact” form via the functions of the website www.vaticanstate.va (hereinafter the “Site”), are:

- personal details identifying you (first name and surname), contact details (email address), and data regarding internet browsing and operations on internet systems.

 

5.   Purposes and legal basis for Processing

In compliance with the principles set forth in Art. 4 of the aforementioned Regulation, your personal data will be collected and processed within the scope of the Data Controller’s activities and to the extent strictly necessary to achieve the following purposes:

a. to enable the receipt of detailed information requested by you;

b. to enable the provision of the requested service (dispatch of postal items containing goods);

c. to ensure the preservation, security, and safekeeping of the Data;

d. to comply with legal obligations;

e. to ensure security and prevent fraudulent conduct.

The Governatorate will not process the Data provided by you for purposes other than those explicitly indicated above.

The legal bases legitimizing the Processing are:

-    the performance of a task of institutional interest or connected to the exercise of institutional functions vested in the Data Controller, linked to the provision of the requested service;

-    the performance of a contract to which you are a party, the implementation of pre-contractual measures adopted at your request, or compliance with a legal obligation under the laws of Vatican City State, to which the Data Controller is subject.

 

6.   Processing methods

The Processing of your Data will be carried out in electronic and/or paper form, using manual and/or electronic tools, for the time strictly necessary to achieve exclusively the purposes indicated in this notice. In any event, the confidentiality and security of your Data will be guaranteed—including where automated tools are used—in compliance with the security measures provided for in Art. 14 of the aforementioned Regulation.

 

7.   Parties to whom the Data may be disclosed or who may become aware of them

Your personal data are not subject to dissemination (i.e., they are not made known to an indeterminate number of persons). They may be shared, within the limits of the purposes and in the manner indicated above, with:

a) parties acting as Data Processors;

b) parties acting as designated contacts and/or persons expressly authorized to process personal data (e.g., employees of the Governorate of Vatican City State), in order to carry out activities strictly related to achieving the purposes for which the Data are collected and as indicated in this notice;

c) parties, entities, or authorities to whom your personal data must be disclosed pursuant to a legal obligation or an order from an Authority, or in fulfillment of a contractual or pre-contractual obligation regarding a contractual relationship to which you are a party, or third parties to whom the Data may be disclosed subject to your express consent or upon your express request.

With regard to the parties referred to in point (c) above, your personal data may also be transferred to recipients based in foreign countries, within the limits of the purposes and in the manner indicated above.

 

8.   Retention period

Your Data will be stored at the premises of the Data Controller and, where necessary, at the premises and/or offices of the other parties indicated in the previous point. Your Data may be stored for a period not exceeding the time required to achieve the purposes set out in this notice. The Data Controller may be required to store your personal data for a longer period for archiving purposes in the public interest (including, but not limited to: legal obligations, orders from an Authority) or for scientific or historical research purposes.

 

9.   Your rights

Subject to the applicable conditions, you may exercise the following rights pursuant to the provisions of Title VI of the aforementioned Regulation:

a)   request confirmation as to whether or not the processing of your personal data is taking place;

b)   obtain information regarding the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom your personal data have been or will be disclosed, and, where possible, the storage period;

c)   obtain the rectification of your personal data;

d)   obtain the erasure of your personal data;

e)   obtain the portability of your personal data—i.e., receive them from the Data Controller in a structured, commonly used, and machine-readable format and transmit them to another Data Controller without hindrance;

f)    object, at any time, to the processing of your personal data;

g)   obtain, where the conditions are met, the restriction of the processing of your personal data;

h)   withdraw, at any time, your consent to the processing of your personal data, without affecting the lawfulness of processing based on consent given prior to such withdrawal. You may exercise the aforementioned rights by submitting a written request—in paper or electronic format—to the Data Controller at the following email address: [email protected]

 

10. Right to lodge a complaint with the Data Protection Officer

Without prejudice to the right to seek recourse before the judicial authorities of Vatican City State, you have the right to lodge a complaint in writing with the Data Protection Officer (DPO), pursuant to Art. 25 of the aforementioned Regulation.