Privacy Policy

The Antequera Museum has placed special emphasis on its goal of disseminating its collections, with programs aimed at involving all types of audiences in its cultural project. This objective continues to be in force, as well as that of satisfying visitor demand and achieving a streamlined administrative management, which entails carrying out an intense cultural program, as well as guaranteeing the conditions of the halls, the maintenance of the facilities and the level of services.

The commitment is to be a reference of quality in the Spanish cultural offer through transparent and efficient management. In turn, another of our main commitments is related to the protection of the information managed, and specifically of the personal data we process, both those provided by our visitors and users, as well as by the museum’s collaborators.

Such management extends to compliance with current legislation, specifically the European Regulation on data protection (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC) (General Data Protection Regulation), therefore, through this data protection policy and in compliance with the aforementioned regulation we inform you of the following:

Responsible for the treatment
This Privacy Policy establishes the basis on which the Museo de Antequera (hereinafter, “Museum”), in its capacity as Data Controller, with registered office at Pl. Coso Viejo,
s/n, 29200 Antequera, Málaga, an organization operating in Spain, processes the personal data of its visitors and users provided through the website www.museoantequera.es (hereinafter, the Website).

For any additional information you can make any inquiry through the following means:

• Phone: +34 952 70 83 00
• Contact e-mail: museo@antequera.es

We remind you that every time you provide us with or it is necessary for us to access any type of information that due to its characteristics allows us to identify you, such as your name and surname, e-mail, billing or shipping addresses, telephone number, type of device or debit or credit card number, etc. (hereinafter, “Personal Data”), either to browse the same, buy our products or make use of its services or features, will be under the application of this Privacy Policy, along with the Terms of Use of the Web, as well as other referenced documents in force at all times, and you should review these texts to verify that you are in accordance with them.

This Privacy Policy and our Terms of Use may be modified. It is your responsibility to read them periodically, since those that are in force at the time of use of the Web will be applicable.

Our commitment to privacy

• We respect the user’s privacy and choices.
• We ensure that privacy and security are built into all activities carried out by the Museum.
• We do not send marketing communications unless requested by the user. Upon request, he/she is entitled to change his/her mind at any time.
• We do not offer or sell user data to third parties.
• We are committed to keeping your data safe and secure, which means that we only work with trusted suppliers with whom we have regulated the processing of data that they may carry out in connection with the provision of a service, if any.
• Transparency data is available for consultation on our website.
• We do not use your data for purposes other than those we have informed you about.
• We respect your rights and always try to accommodate your requests in accordance with our own legal responsibilities.

For more information about our privacy practices, we set out below what types of personal data we may collect, how we may use it, with whom we may share it, how we protect it, and how you can exercise your rights with respect to that data, at all times in accordance with the Privacy Policy.

Please read this information carefully. If you have any questions or concerns about your personal data, please contact us at museo@antequera.es .

Collection of personal data and purposes of processing
We remind you that before you begin using any of the services offered by the Museum, you should carefully read this Policy.

Failure to provide certain information marked as mandatory may result in the impossibility to manage your registration as a user or the use of certain features or services available through www.museoantequera.es.

The user guarantees that the Personal Data provided are true and accurate and undertakes to notify any change or modification thereof. Any loss or damage caused to the Website, the Data Controllers or any third party through the communication of erroneous, inaccurate or incomplete information in the registration forms shall be the sole responsibility of the user.

What data is collected?
Among the main objectives of the Antequera Museum is to ensure the satisfaction of visitors, to maintain relations with its collaborators and that they feel protected when they provide their data to operate with the Museum. To do so, there are several ways to share your personal information with the Museum.

The tables at the end of this chapter summarize the following aspects of the processing of personal data:

• Processing activity and the purpose for which the data were collected.
• Who are the interested parties of the data collection.
  Categories of data collected such as identification data, employment and academic details, financial data, among others.
• Basis of legitimacy. That is, the legal basis for the collection of the data such as the fulfillment of a contract, consent of the data subject or a legal obligation.
• The recipients of the communications, which are those persons or entities to whom the personal data are to be sent.
• If international transfers of data to third countries are foreseen.
• The deletion period for which the collected data must be deleted is regulated. Deadlines are established based on the legal obligations scattered throughout the legal system depending on the subject matter.

The different data processing activities carried out by the Museum are listed below.

Activity	Visitor service
Purpose	General management of visitor services at the Museum.
Stakeholders	Clients and users; Legal Representative
Categories of data	Identification data: DNI/NIF, name and surname, telephone, postal address and e-mail address.
Legitimation	Execution of an agreement, consent of the interested party. Legal representative
Recipients of communications	The following are not foreseen
International transfers	Not foreseen
Period of suppression	Minimum 6 years

Activity	Educational activities
Purpose	Management of the data of participants in the museum’s educational and cultural activities, as well as of persons interested in receiving information about the museum’s educational and cultural activities.
Interested parties	Clients and users; Legal Representative
Data categories	Identification data: DNI/NIF, name and surname, telephone, address, e-mail address
Legitimation	Execution of an agreement, consent of the data subject
Communication recipients	The following are not foreseen
International transfers	The following are not foreseen
Time limit for deletion	Minimum 6 years from issuance

Activity	Web users
Purpose	Management of authorized users to access the restricted contents of the Museo Nacional del Prado website.
Interested parties	Customers and users
Data categories	Identification data: DNI/NIF, name and surname, telephone, address, e-mail address
Legitimation	Execution of a contract, consent of the data subject
Communication recipients	The following are not foreseen
International transfers	The following are not foreseen
Time limit for deletion	Cessation of activity. Petition of the interested party

Activity	Press room users
Purpose	Management of authorized users to access restricted content for journalists. Sending of information and press releases of the Museum.
Interested parties	Customers and users
Data categories	Identifying data: name and surname, address, professional position/position, media, e-mail address
Legitimation	Execution of a contract, consent of the data subject
Communication recipients	The following are not foreseen
International transfers	The following are not foreseen
Time limit for deletion	Cessation of activity. Petition of the interested party

Activity	Access control
Purpose	Control and monitoring of security at the facilities
Interested parties	Employees; Customers and users; Legal representative
Data categories	Identification data: DNI/NIF, name and surname, address, signature, image/voice.
Legitimation	Legitimate interest of the Responsible for ensuring the security of the facilities, execution of a contract (employment relationship).
Communication recipients	Security Forces and Corps
International transfers	The following are not foreseen
Time limit for deletion	30 days

Activity	Video surveillance
Purpose	Management of the Museum’s security maintenance.
Interested parties	Employees; Customers and users; Legal representative
Data categories	Identifying data: image / voice
Legitimation	Public interest, legitimate interest of the stakeholder in protecting the museum’s assets.
Communication recipients	Security Forces and Corps
International transfers	The following are not foreseen
Time limit for deletion	30 days

Activity	Lost and found
Purpose	Security and control of pick-up and delivery of lost or forgotten objects in the museum
Interested parties	Employees; Customers and users; Legal representative
Data categories	Identification data: DNI/NIF, name and surname, address, telephone, fax, e-mail, etc.
Communication recipients	The following are not foreseen
International transfers	The following are not foreseen
Time limit for deletion	1 year

Activity	Program for people with special needs
Purpose	Data management of people with special needs participating in museum activities, understanding “people with special needs” as people with some type of physical or mental disability.
Interested parties	Customers and users
Data categories	Identification data: name and surname, telephone, fax, e-mail. Personal characteristics; physical or anthropometric characteristics. Social circumstances: membership in clubs or associations, licenses, permits and authorizations
Legitimation	Consent of the data subject, execution of a contract.
Communication recipients	The following are not foreseen
International transfers	The following are not foreseen
Time limit for deletion	Minimum: termination of activity

Who can access your personal data?
Your data will not be disclosed to third parties, unless required by law. In particular, they may be communicated to the State Agency of Tax Administration and to banks and financial institutions for the collection of the services rendered or products purchased, as the case may be. In case of purchase or payment, if you choose any application, web, platform, bank card, or any other online service, your data will be communicated to that platform or processed in its environment, always with maximum security.

In addition, your personal data may be processed on our behalf by our trusted third party providers. We enter into contracts with them to perform a variety of business transactions on our behalf. They are only provided with the information they need to perform the service.

We always do our best to ensure that all third parties we work with maintain the security of your personal data.

International transfers
No international data transfers to countries outside the European Economic Area are foreseen.

How long do we keep your personal data?
The retention periods are indicated in each treatment, however, in general, we only keep the Personal Data provided for the period established by law in order to meet the needs of users or to comply with legal obligations.

To determine the data retention period of your Personal Data, we use the following criteria:

• For the duration of our contractual relationship.
• When contacting the Museum for an inquiry: for as long as it takes to respond to your inquiry.
• Cookies that are installed on your computer: they are stored for the time necessary to achieve their purposes and for a maximum of 365 days.

As we have already made clear, one of the purposes of data retention is to comply with legal and regulatory obligations. The data will be automatically cancelled when they are no longer necessary for the purpose for which they were collected, and will be automatically deleted from our systems when this is possible.

Is my personal data stored securely?
The Museum undertakes to store your personal data securely, taking into account all the precautions established by the European Regulation and the Law.

Links to third party sites and social login
Our websites and applications may contain links to and from the websites of our partner networks and sponsors. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we are not responsible for these policies. Please review these policies before submitting personal data to these websites.

Social media and user-generated content
Some of our websites and applications allow users to submit their own content. Remember that any content submitted to one of our social media platforms may be viewed by the public, so you should be careful when providing certain personal data (e.g., financial information or address details). We are not responsible for any actions taken by others if you post personal data on one of our social media platforms and recommend that you do not share such information.

Do we use cookies?
Yes, our website uses cookies, so we put at your disposal our Cookies Policy for you to consult in case you want more information about these devices.

Your rights and options
The Museum, in compliance with the European Regulation and the Law on the Protection of Personal Data, facilitates users to exercise their rights under the respective rules mentioned.

Such rights are as follows:

• Right to information: the right to obtain clear, transparent and easy-to-understand information about how we use your personal data and about your rights.
• Right of access: the right to access personal data held by the Museum about the data subject.
• Right of rectification: the right to have your personal data rectified when it is inaccurate or no longer valid or to have it completed when it is incomplete.
• Right to erasure / right to be forgotten: The right to have your personal data erased or deleted.
• Right of opposition: the right not to carry out the processing or to stop the processing when the consent of the data subject is not necessary for the processing, due to the existence of a legitimate and well-founded reason.
• Right to portability: the right to move, copy or transfer data from our database to another database. It is only possible to exercise this right with respect to data you have provided, when the processing is based on the performance of a contract or on your consent and the processing is carried out by automated means.
• Right to limitation of processing: the right to request the limitation of the processing of your data.

Any person has the right to obtain confirmation as to whether or not the Museum is processing personal data concerning them, and if so, to access it, as well as to request the rectification of inaccurate data or, where appropriate, to request its deletion when, among other reasons, the data is no longer necessary for the fulfillment of the purposes for which it was collected and in compliance with current legislation.

In certain circumstances, the interested parties may request the limitation of the processing of their data, in which case, they will only be kept for the exercise or defense of claims.

In specific cases and for reasons related to their particular situation, data subjects may object to the processing of their data. The Museum will stop processing the data, except for compelling legitimate reasons or in the exercise or defense of possible claims.

The data subject also has the right to receive the personal data he or she has provided to the Museum in a structured, commonly used, machine-readable format. This last right is limited by the following exceptions: the data to which this right applies must have been provided by the person concerned; the data must be processed by the Museum by automated means (computerized means).

To exercise the aforementioned rights, you may request a form from us, or use the forms developed by the Spanish Data Protection Agency or third parties. These forms must be signed electronically or be accompanied by a photocopy of the DNI; in case of representation, a copy of the user’s DNI must be attached, or the user must sign it with his/her electronic signature. Forms can be submitted in person, sent by letter or by mail to the Data Protection contact address museo@antequera.es.

We will give you an answer as soon as possible, and at the most within one month from the reception of the request. If the issue is very complex and we need more time, we will notify you about it and explain the reasons.