Last updated: October 18, 2026
This notice explains how the personal data of users visiting the website
www.virtualartweek.com (the "Website") is processed, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679
("GDPR") and applicable Italian law (Legislative Decree 196/2003, as amended).
1. Data Controller
Make Art Gallery by Stefano Fiore
Via Cairoli, 18 – 03020 Giuliano di Roma (FR), Italy
Contact email: info@makeartgallery.com
2. Types of data processed
a) Browsing data. The IT systems and software that run the Website collect, during normal operation, certain data whose transmission is inherent in the use of Internet communication protocols: IP address, browser type and operating system, date and time of access, pages visited, referring address (referrer) and the outcome of the request. This data is used only to obtain anonymous statistics on use of the Website, to ensure it works properly, and to identify responsibility in the event of computer crimes.
b) Data provided voluntarily. Optionally sending emails to the addresses shown on the Website, or contacting Make Art Gallery through its social media channels, involves the collection of the sender's data (for example name, email address and the content of the message) needed to reply to requests.
The Website does not require registration and does not process special categories of data (Art. 9 GDPR).
3. Purposes and legal basis
- Ensuring the operation and security of the Website and obtaining aggregated statistics – legitimate interest of the Controller (Art. 6(1)(f) GDPR).
- Replying to requests sent by users and handling contacts relating to artistic projects – performance of pre-contractual or contractual measures at the data subject's request (Art. 6(1)(b) GDPR).
- Complying with legal obligations, where applicable – Art. 6(1)(c) GDPR.
4. Cookies and similar technologies
The Website may use technical cookies, necessary for the pages to work properly and for content to be viewed; consent is not required for these. Any analytics or profiling cookies will be installed only with the user's prior consent, where required by law.
The Website does not embed third-party content, but it contains buttons and links that, when clicked, direct the user to other services, which may set their own cookies and collect browsing data (for example IP address and device information) in accordance with their own policies, for which the Controller is not responsible. In particular:
- Make Art Gallery (www.makeartgallery.com): the website hosting the online exhibition "JustArt X", which is subject to its own privacy policy.
- Matterport (my.matterport.com): 360° virtual tours of international galleries.
- Google Arts & Culture, Google Street View and Google Maps: virtual tours of some museums.
- Vatican Museums (museivaticani.va) and Hermitage Museum (pano.hermitagemuseum.org): virtual tours on their official websites.
- Second Life (Linden Research, Inc.): the virtual world hosting the Patrick Moya museum complex.
By clicking the "visit" buttons, users leave the Website; the services listed above process data as independent controllers. Users can manage or disable cookies from their browser settings.
5. Links to external websites
The Website contains links to the websites of galleries, museums, foundations, artists and other third parties (for example Make Art Gallery, Nadine Fayad Art Gallery, DM-LAB, Mosman Art Gallery, Yellowstone Art Museum, Galleria Civica Zlatý býk, Partners Gallery, GraffitiStreet, BOZAR, Victoria Art Gallery, Opera Gallery and others). The Controller has no control over their content or their data processing policies; users are encouraged to read the privacy notices of those sites.
6. Processing methods and recipients
Data is processed using IT and electronic tools, with technical and organisational measures suited to preventing loss, unlawful use or unauthorised access. Data is not disseminated. It may be disclosed to technical service providers (for example Website hosting and maintenance) acting as data processors, and to the competent authorities in the cases provided for by law.
7. Transfers of data outside the EU
Where the use of third-party services involves transferring data to countries outside the European Economic Area, this will take place in compliance with Chapter V of the GDPR (adequacy decisions or standard contractual clauses).
8. Retention period
Browsing data is kept for the time strictly necessary for the purposes indicated and, as a rule, no longer than 12 months. Data provided voluntarily is kept for the time needed to handle the request and, afterwards, for the period required by legal obligations or for the protection of the Controller's rights.
9. Data subject rights
Users may at any time exercise the rights set out in Articles 15-22 GDPR, in particular:
- access to their personal data;
- rectification or completion of data;
- erasure ("right to be forgotten");
- restriction of processing;
- data portability;
- objection to processing based on legitimate interest;
- withdrawal of consent, where given, without affecting the lawfulness of prior processing.
Requests should be sent to the Controller at the contact details in section 1. Users also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of their country of residence.
10. Provision of data
Browsing the Website does not require providing personal data, apart from browsing data processed automatically. Providing data to send requests is optional, but failure to do so may make it impossible to reply.
11. Changes to this notice
The Controller may amend this notice at any time, for example to reflect legal changes or changes to the Website. The updated version will always be available in this window, with the date of the last update shown.
