ACTIVITIES FOR THE PROCESSING OF DATA

Entrance in the museum’s storerooms
Aim: Control of the people who access the Museum’s storage facilities.
Interested parties: People accessing the storage facilities
Categories of data: Data of identifying nature: name and surname(s), ID document, telephone number, postal and email address.
Legitimation: Consent of the interested party.
Recipients of the communications: Not foreseen
International transfers: Not foreseen
Period of suppression: not defined

Incoming and outgoing register
Aim: Management and control of all the documentation which is received by and sent from the Museum.
Interested parties: People that receive or send documentation of the Museum; Legal representative.
Categories of data: Data of identifying nature: name and surname(s), ID card, telephone, postal and email address.
Legitimation: Legal compliance
Recipients of the communications: Not foreseen
International transfers: Not foreseen
Period of suppression: that which is fixed by the regulations and security policies

Human Resources
Aim: Management and control of the human resources of the Museum (selection, provision and recruitment of staff, management of the payroll, control of presence, follow up of labour activity, control of permits and licences, training and fulfillment of the obligations with the Social Security, etc.).
Interested parties: People who are interested in working in the Museum, people employed or students carrying out internships, high level posts and members of the government organs.
Categories of data: Data of identifying nature: name and surname(s), ID document, telephone number, postal and email address. Data of personal characteristics: health (degree of disability), signature, personal register number, civil status, sex, date and place of birth, nationality, biometric data. Academic and professional data: training and qualifications, professional experience, professional colleges and associations, artistic creation, body and scale, professional and labour experience, non-economic and economic salary data, bank details. Information regarding the committing of criminal or administrative infractions: disciplinary offenses and penalties while they have not been cancelled.
Legitimation: Consent of the interested party. Contractual relationship
Recipients of the communications: The Tax Agency, the Social Security and the
Generalitat de Catalunya, bank entities for payments.
International transfers: Not foreseen
Period of suppression: that which is fixed by the regulations and security policies

Archive
Aim: Management and control of the administrative documentation of the Museu Nacional, as well as the historic collections of artworks, documentary and graphic works, held by the institution and for attending the consultation requests from the users of the service.
Interested parties: legal persons who are the object for the processing of their data in the different administrative documents, as well as the authors of works or of historic documents. Users of the service that carry out consultations from the Archive
Categories of data: Data of identifying nature: name and surname(s), ID document,
telephone number, postal and email address.
Legitimació: Consent of the interested party. Legal compliance
Recipients of the communications: Not foreseen
International transfers: Not foreseen
Period of suppression: that which is fixed by the regulations and security policies

Complaints, consultations and claims
Aim: management and control of all the consultations, claims, complaints, suggestions or denouncements carried out in the museum.
Interested parties: the persons that present the consultation, claim, complaint, suggestion and/or denouncement or their legal representatives.
Categories of data: Data of identifying nature: name and surname(s), ID document,
telephone number, postal and email address, signature.
Legitimation: Consent of the interested party. Legal compliance.
Recipients of the communications: Not foreseen
International transfers: Not foreseen
Period of suppression: 2 years

Image and Sound
Aim: management and control of the images and recordings, both of image and sound, which are carried out by the various departments of the Museum, or for external photographs contracted in the various activities organized by the entity.
Interested parties: people who participate in the activity; Legal representative
Categories of data: Data of identifying nature: name and surname(s), email address.
Data of personal characteristics: Image, voice.
Legitimation: Consent of the interested party.
Recipients of the communications: Not foreseen
International transfers: Not foreseen
Period of suppression: not defined

Economic management
Aim: uses derived from the management and economic, financial, accounting and treasury control of the Museu Nacional. The uses foreseen are the management and processing of the contractual files, the accounting, tax and administrative management, the valuation of the budgets, the follow up of the commissioned works, the management of the payments and the contracts with the suppliers and providers.
Interested parties: Suppliers and providers and people or legal representatives contracted by the Museu Nacional.
Categories of data: Data of identifying nature: name and surname(s), ID document or NIF-Tax Identification Number, telephone number, email address. Economic data: Bank details, goods or services for the affected party, commercial information. Signature
Legitimation: Consent of the interested party. Fulfilment of the legality Recipients of the communications: the Tax Administration, the credit entities that management the payments, the Court of Auditors, the General Intervention of the Administration of the Generalitat de Catalunya.
International transfers: Not foreseen
Period of suppression: that which is fixed by the regulations and security policies

Agreements and contracts signed between the Museu Nacional and other entities
Aim: To compile data of agreements and contracts that the Museu Nacional signs.
Interested parties: individuals and the legal representatives of the entities or companies sign an agreement and/or a contract with the Museu Nacional.
Categories of data: Data of identifying nature: Name of signatory of the agreement or
contract, NIF-Tax Identification Number, postal and email address, name of the legal
representative, post, telephone number. Economic data: bank details.
Legitimation: Consent of the interested party. Legal compliance
Recipients of the communications: institutions or organisations of the Public Administration
International transfers: Not foreseen
Period of suppression: not defined

Library management
Aim: General management of the Library of the Museu Nacional d’Art de Catalunya, management and control of the requests for consultations of material held by the Museum as well as the management of acquisitions.
Interested parties: Readers, users of the Library, researchers, as well as donors and suppliers of the Museu Nacional.
Categories of data: Data of identifying nature: Name and surname(s), ID document /
NIF-Tax Identification Number, postal and email address, telephone number.
Legitimation: Consent of the interested party.
Recipients of the communications: Not foreseen
International transfers: Not foreseen
Period of suppression: not defined

Management of acquisitions, donations, purchases, exchanges or loans of collections
Aim: integral management of the museum acquisitions, by donation, purchase, exchange and other modalities of loans. Control and archive of the various works, pieces, and assets that make up the patrimony of the Museu Nacional.
Interested parties: all the individual persons, who supply works for deposit, purchasing, donation or other modalities of loans. Legal representative
Categories of data: Data of identifying nature: Name and surname(s), ID document/NIF-Tax Identification Number/Passport, postal and email address, telephone number. Data related to the works: Conditions of acquisition, donation, purchase, exchange or other modality of loan.
Legitimation: Consent of the interested party. Fulfilment of the legality
Recipients of the communications: institutions or organisations of the Public Administration
International transfers: Not foreseen
Period of suppression: not defined

Management of collections and exhibitions
Aim: general management of the permanent collection and of the temporary exhibitions of the Museu Nacional, as well we the control of the movements of the works within the museum premises.
Interested parties: people who loan works of art (private collectors, contact people from other museums or institutions), the person designated to be responsible for the movement of the works. Legal representative
Categories of data: Data of identifying nature: Name and surname(s), ID document/NIF-Tax Identification Number/Passport, postal and email address, telephone number.
Legitimation: Consent of the interested party. Legal compliance
Recipients of the communications: institutions or organisations of the Public Administration
International transfers: Not foreseen
Period of suppression: not defined

Web users
Aim: To manage the data of the users that access the various sections of the website of the Museu Nacional, as well as the subscribers to the newsletters and digital publications published by the Museu Nacional. Management of the sending of information, newsletters and other digital publications produced
Interested parties: individual persons subscribed to the newsletters or other digital publications produced, users that access the website to carry out procedures and consultations.
Categories of data: Data of identifying nature: Name and surname(s), ID document/NIF-Tax Identification Number/Passport, postal and email address, telephone number. Data of personal nature: date of birth
Legitimation: Consent of the interested party.
Recipients of the communications: Not foreseen
International transfers: Not foreseen
Period of suppression: Termination of activity. Request of the interested party

Control of accesses and visits
Aim: Management of the security of the Museu Nacional, by means of the control and surveillance of the accesses to the premises joining the Museum
Interested parties: Staff; Customers and users; Legal representative.
Categories of data: Data of identifying nature: Name and surname(s), ID document/NIF-Tax Identification Number/Passport, postal and email address, image/voice
Legitimation: Compliance of a legal obligation
Recipients of the communications: Police and security forces. Courts and tribunals.
International transfers: Not foreseen
Period of suppression: 30 days

Video surveillance
Aim: Management of the maintenance of the security of the Museu Nacional through systems of video surveillance
Interested parties: Employees; Clients and users; Legal representative
Categories of data: Data of identifying nature: image / voice. Circumstantial data of the date and time related to the images captured.
Legitimation: Compliance of a legal obligation
Recipients of the communications: Police and security forces. Courts and tribunals.
International transfers: Not foreseen
Period of suppression: 30 days

Agenda of communications and institutional relations
Aim: management and control of the personal data of the contacts of the agendas both of personal or of representatives of entities, public and private organisations, companies or public administration that have a relation with the Museum. Processing information with organisational and protocol goals.
Interested parties: Clients and users.
Categories of data: Data of identifying nature: Name and surname(s), postal and email address, telephone number. Other data: place of work, post, activity
Legitimation: Consent of the interested party. Legitimate interest
Recipients of the communications: Not foreseen
International transfers: Not foreseen
Period of suppression: not defined

Management of activities
Aim: management of the activities organised by the Museu Nacional. Maintainingcommunications and managing the data of the people who participate in both the training and diffusion activities.
Interested parties: Persons that participate in the activities carried out by the Museu Nacional (students, attendees, conference delegates, etc,); Legal representative.
Categories of data: Data of identifying nature: Name and surname(s), ID document / NIF-Tax Identification Number / Passport, postal and email address, telephone number.
Data of personal nature: Date of birth, language of preference. Academic and professional data: place of work, post, activity, training, qualifications.
Legitimation: Consent of the interested party
Recipients of the communications: Not foreseen
International transfers: Not foreseen
Period of suppression: Minimum of 6 years from the date of its issuance.

Promotion and diffusion
Aim: Management of the institutional and administrative activities of promotion and diffusion related to the competences of the Museu Nacional and the corresponding functions of their areas. Provision of services and carrying out activities and actions by the administrative organs and units of the Museu Nacional in exercising its functions derived from the attributed competences.
Interested parties: Public positions, staff at the service of other administrations, users of activities.
Categories of data: Data of identifying nature: Name and surname(s), postal and email address, telephone number. Academic and professional data: member of professional associations or colleges. Detailed data of employment: post.
Legitimation: Consent of the interested party. Legitimate interest.
Recipients of the communications: Not foreseen
International transfers: Not foreseen
Period of suppression: not defined

Visitor Attention
Aim: integral management of the attention to the visitors of the Museu Nacional d’Art de Catalunya.
Interested parties: Customers and users; Legal representative
Categories of data: Data of identifying nature: ID document / NIF-Tax Identification Number, name and surname(s), postal and email address, telephone number.
Legitimation: Consent of the interested party
Recipients of the communications: Not foreseen
International transfers: Not foreseen
Period of suppression: Termination of the activity. Request of the interested party

Ticket sales in advance
Aim: management of data of the visitors to the museum who have obtained their admission tickets in advance through online services or by means of email.
Interested parties: Customers and users; Legal representative
Categories of data: Data of identifying nature: Name and surname(s), ID document /
NIF-Tax Identification Number / Passport, postal and email address. Economic data:
credit cards.
Legitimation: Consent of the interested party
Recipients of the communications: Not foreseen
International transfers: Not foreseen
Period of suppression: Minimum 6 years after its issuance

Copies and reproductions of the artworks of the collections
Aim: to manage the data collected from the people that request authorisation to make copies or reproductions of the artworks that form part of the collection of the Museum.
Interested parties: persons that request authorisation for making a copy or
reproduction. Legal representative.
Categories of data: Data of identifying nature: Name and surname(s), ID document /
NIF-Tax Identification Number / Passport, email address, telephone number.
Legitimation: Consent of the interested party
Recipients of the communications: Not foreseen
International transfers: Not foreseen
Period of suppression: not defined

Exercising rights of interested parties in the field of personal data protection
Aim: Management of the applications for exercising the rights of access, rectification, suppression, opposition, limitation of processing and to not be the object of automated individual decisions that the regulations, in matters of data protection, recognise the interested parties.
Interested parties: persons for whom the legal data has undergone data processing and apply for the exercising of the rights foreseen in the regulations regarding data
protection; Legal representative
Categories of data: Data of identifying nature: Name and surname(s), ID document,
postal and email address, telephone number.
Legitimation: Compliance of a legal obligation
Recipients of the communications: Not foreseen. Only those foreseen by the law
International transfers: Not foreseen
Period of suppression: Not defined

To these activities of data processing will be applied the security measures determined by the Framework of Cybersecurity for the Protection of Data of the Centre of Security of Information of Catalonia (CESICAT) of the Generalitat de Catalunya.