Privacy policy

VIC BARCELONA MUSEUM, SL (Tax ID B70908389).

[If the museum appoints a Data Protection Officer (DPO), include their contact details here.]

“Request a loan” form: institution, full name, position, email, telephone, exhibition title, venues and dates, requested works and message. Purpose: to manage and respond to the artwork loan request and, where applicable, process the loan agreement.

Newsletter: name and email address, together with the website language and the date and page of sign-up. Purpose: to send you news about the museum, its exhibitions and touring shows.

Contact by email or telephone: the data you provide in your communication. Purpose: to handle your enquiry.

Press: contact details of journalists and media outlets requesting information or materials. Purpose: to manage media relations.

Browsing: the Website does not use analytics or tracking cookies. The hosting provider records technical data (IP address, browser type, pages visited) in server logs for security and service maintenance purposes.

Loan requests: steps taken at the data subject’s request prior to entering into a contract (Art. 6(1)(b) GDPR). Enquiries and press: legitimate interest in handling communications received (Art. 6(1)(f) GDPR) and, where applicable, consent (Art. 6(1)(a)). Technical logs: legitimate interest in ensuring the security of the service (Art. 6(1)(f)).

Newsletter: your consent, given by ticking the box when subscribing (Art. 6(1)(a) GDPR), which you may withdraw at any time.

We do not disclose data to third parties unless legally required. To provide the service we use providers acting as data processors: web hosting on Amazon Web Services (Europe – Ireland region) and, where applicable, the email service provider. [If the form is sent through an external service, name it here.] Where international transfers occur, the safeguards provided for in the GDPR apply (standard contractual clauses).

Newsletter sign-ups are stored in a museum database hosted on Amazon Web Services (Europe – Ireland region). [Once the email sending tool is chosen, name it here as a data processor.]

Loan request data is kept while the request is being processed and, if it leads to a loan, for the duration of the agreement and the applicable statutory limitation periods. Enquiries are kept for as long as necessary to deal with them. Technical server logs are kept for a maximum of twelve months.

Newsletter data is kept until you unsubscribe.

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw consent at any time, by writing to redes@museucarmenthyssen.com and stating the right you wish to exercise, with a copy of your ID if needed to verify your identity.

You can unsubscribe from the newsletter at any time via the unsubscribe link included in every mailing.

If you believe the processing does not comply with the law, you may lodge a complaint with the Catalan Data Protection Authority (apdcat.gencat.cat) or the Spanish Data Protection Agency (www.aepd.es).

We apply appropriate technical and organisational measures to protect data (HTTPS-encrypted communications, restricted access, providers with guarantees). We may update this policy to reflect regulatory or service changes; the current version is always the one published on this page, with its update date.