Privacy policy

This is the data protection policy of the Natural Sciences Museum of Barcelona Consortium. It refers to the data it processes in compliance with the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016) and Organic Law 3/2018, of 5 December, personal data protection and guarantee of digital rights.

Who is responsible for the processing of personal data?

The person responsible for the processing of personal data is the Consortium of the Natural Sciences Museum of Barcelona (from now on, the Museum), CIF Q0801897J,  address at Plaça Leonardo da Vinci, 4-5, Barcelona (CP 08019), tel. 932566002, museuciencies@bcn.cat, https://museuciencies.cat.

Who is the Data Protection Officer?

The Data Protection Officer (DPD) supervises compliance with the Museum’s data protection policy, ensuring that personal data is treated appropriately and that people’s rights are protected. Among its functions is that of attending to any doubt, suggestion, complaint or claim of the people whose data is processed. You can contact the Data Protection Officer by writing to Plaça Leonardo da Vinci, 4-5, Barcelona (CP 08019), tel. 932566002 or the email address dpd_CMCNB@bcn.cat.

For what purpose do we process the data?

At the Museum we process personal data for the following purposes:

• Contact. Respond to inquiries from people who contact us through contact forms on our website or by phone.
• Museum services. Register of people who purchase or reserve tickets to visit the museum rooms, attend events or activities organized by the Museum. During the registration process, essential data such as identification or bank details are requested (in the event that a payment has to be processed).
• Activities. In the organization of cultural and training activities, we receive data from the people who register, for the purpose of organizing the activity. As a general criterion, the data is not communicated to other people without the explicit consent of the person participating in the activity.
• Information about our services. With the explicit authorization of each person, we use the contact details to communicate information about activities, acts or events.
• Data management of our suppliers. We record and process the data of the suppliers from whom we obtain services or goods. It can be the data of people who act as freelancers and also data of representatives of legal entities. We obtain the essential data to maintain the commercial relationship, use it solely for this purpose and use it for this type of relationship.
• Video surveillance When entering our facilities, the presence of video surveillance cameras is indicated by the approved signs. The cameras record images only of the points where it is justified to ensure the safety of goods and people and the images are used solely for this purpose.

What is the legal justification for data processing?

The data processing we carry out have different legal bases, depending on the nature of each processing.

• In compliance with a contractual relationship, in the case of relationships with our suppliers and with people who purchase tickets or hire other services from the Museum.
• In compliance with legal obligations, for example data communications to the tax administration, established in fiscal and regulatory rules for commercial relations.
• Based on consent, we send information about the services, activities, events or events we plan.
• In fulfillment of a public interest mission, we record images with the video surveillance cameras, to preserve the heritage we guard.

To whom is the data communicated?

As a general rule, we only communicate data to administrations or public authorities and always in compliance with legal obligations. When issuing invoices to customers, the data can be communicated to banking entities. In justified cases we will communicate the data to the security bodies and forces or to the competent judicial bodies. No data transfers are made outside the scope of the European Union (international transfer).

How long do we keep the data?

The retention time of the data is determined by different factors, mainly the fact that the data remains necessary to serve the purposes for which they have been collected in each case. Secondly, they are kept to deal with possible responsibilities for the processing of the data by the Data Controller Name and to meet any request from other public administrations or judicial bodies.

Consequently, the data must be kept for the time necessary to preserve its legal or informative value or to certify compliance with legal obligations, but not for a period longer than necessary in accordance with the purposes of the processing.

In certain cases, such as the data appearing in the accounting documentation and invoicing, the fiscal regulations oblige them to be kept until they no longer prescribe the responsibilities in this matter.

In the case of data that are processed exclusively on the basis of the consent of the person concerned, they are kept until this person revokes this consent.

Finally, in the case of images obtained by video surveillance cameras, they are kept for a maximum of one month, although in the case of incidents that justify it, they are kept for the time necessary to facilitate the actions of the bodies and security forces or judicial bodies.

The regulatory regulations for the conservation of public documentation, and the opinions of the National Commission for Access, Evaluation and Documentary Choice are a reference that determine the criteria we follow in the conservation or elimination of data.

What rights do people have in relation to the data we process?

As provided for in the General Data Protection Regulation, the people whose data we process have the following rights:

• To know if they are processed. Anyone has the right to know whether we process their data, regardless of whether there has been a previous relationship.
• To be informed upon collection. When personal data is obtained from the interested party themself, at the time of providing it, they must have clear information about the purposes for which it will be used, who will be responsible for the processing and the other aspects derived from this processing.
• To access it. Right that includes the right to know precisely which personal data are the subject of processing, what is the purpose for which they are processed, the communications to other people (if applicable) or the right to obtain a copy or to know the expected period of conservation.
• To request its rectification. It is the right to have inaccurate data processed by us rectified.
• To request its deletion. In certain circumstances there is the right to request the deletion of the data when, among other reasons, they are no longer necessary for the purposes for which they were collected and justified their processing.
• Ask for the limitation of the processing. Also in certain circumstances the right to request the limitation of data processing is recognized. In this case they will cease to be processed and will only be kept for the exercise or defense against claims.
• To portability. In the cases provided for in the regulations, the right to obtain one’s own personal data in a commonly used, machine-readable, structured format is recognized.
• To oppose the processing. A person can adduce reasons related to their particular situation, reasons that will lead to them ceasing to process their data to the degree or extent that they may be harmed.

How can rights be exercised or defended?

The rights we have just listed can be exercised by sending a written request to the Museum at the postal address Plaça Leonardo da Vinci, 4-5, Barcelona (CP 08019) or by sending an email to museuciencies@bcn.cat, indicating in all cases “Protection of personal data”.

If a satisfactory response has not been obtained in exercising your rights, it is possible to submit a claim to the Catalan Data Protection Authority, through the forms or other channels accessible from its page www.apd.cat.

In all cases, whether to submit complaints, ask for clarifications or make suggestions, it is possible to contact the Data Protection Officer by sending an email to the address dpd_CMCNB@bcn.cat.

Document: Register of processing activities of the Natural Sciences Museum of Barcelona.