Privacy Policy

(pursuant to Articles 13 and 14 of EU Regulation 2016/679 – GDPR)

1. Data Controller

The Data Controller for the processing of personal data is Anna Scalfi Eghenter, artist and project director of MyUrbs, reachable via the contact form available in the Contact section of myurbs.org.

2. Nature of the platform and project purpose

MyUrbs is a participatory, open-source, geolocated artistic platform, developed as part of the project Die Komödie! presented at the 13th Berlin Biennale for Contemporary Art. The platform allows registered users to publish independent events, participate in collective actions in person or simultaneously, and view events on a map within their geographic area. It has no commercial purpose, carries no advertising, and does not share data with third parties for marketing purposes.

3. Data collected

During registration and profile setup, the platform collects the following data:

Mandatory data for account creation:

•      Username

•      Email address

•      Password (stored in encrypted form)

Public profile data:

•      Display name

•      Profile description

•      Visible address (optional)

•      JPG image gallery (voluntarily uploaded by the user)

•      Contact and social profiles: phone, website, X (Twitter), Instagram (all optional)

Functional data (not publicly visible):

•      Starting location on the map, used solely to calculate distances

•      Selected interest tags and maximum travel distance for each

•      Notification preferences (channel and frequency)

Technical data (collected automatically):

•      IP address, browser type and operating system, solely for security logs and technical operation of the service

4. Legal basis for processing

Personal data is processed on the following legal bases:

•      Performance of a contract (Art. 6.1.b GDPR): for data necessary to create and manage the account and use the service.

•      Consent of the data subject (Art. 6.1.a GDPR): for optional profile data (visible address, images, social contacts) and for notifications.

•      Legitimate interest of the Controller (Art. 6.1.f GDPR): for technical security logs, to the extent strictly necessary.

5. Purposes of processing

Data is processed exclusively for the following purposes:

•      Creation and management of the user account

•      Publishing and displaying events on the map

•      Calculating distances from the starting location provided by the user

•      Sending notifications about events of interest (if enabled by the user)

•      Aggregated and anonymised analysis of data for artistic and research purposes, to identify convergences of interests as a common good — in line with the nature of the project

•      Technical security of the platform

Data is not used for commercial profiling, behavioural advertising, or automated decisions with legal effects.

6. Cookies and tracking technologies

The platform does not use profiling cookies, marketing tracking tools, or transfer such technologies to third parties. Only technical session cookies strictly necessary for the platform to function (e.g. to keep users logged in) may be present. Consent is not required for purely technical cookies pursuant to Italian Data Protection Authority Resolution No. 229/2014 and the ePrivacy Directive 2002/58/EC.

7. Data retention

Account data is retained for the duration of the user's registration and deleted upon request. Technical logs are retained for the minimum time necessary to ensure the security of the service (normally no longer than 90 days). Aggregated and anonymised data used for artistic purposes may be retained indefinitely, as it does not allow identification of individual users.

8. Disclosure and sharing of data

Personal data is not sold, transferred, or shared with third parties for commercial purposes. Data may be shared only with:

•      Technical service providers strictly necessary for the operation of the platform (e.g. hosting), acting as Data Processors under Art. 28 GDPR

•      Judicial or administrative authorities, in cases required by law

Content published by users (events, descriptions, public profile images) is visible to all visitors of the site, registered or not, as it constitutes the very purpose of the participatory platform.

9. International data transfers

Personal data is processed and stored within the European Economic Area (EEA). Should any technical provider be located outside the EEA, transfers will take place only where adequate safeguards are in place pursuant to Arts. 44-49 GDPR (e.g. standard contractual clauses).

10. Rights of the data subject

As a data subject, the user has the right to:

•      Access their personal data (Art. 15 GDPR)

•      Rectify inaccurate or incomplete data (Art. 16 GDPR)

•      Obtain erasure of their data ("right to be forgotten", Art. 17 GDPR)

•      Restrict processing (Art. 18 GDPR)

•      Receive their data in a structured, machine-readable format (data portability, Art. 20 GDPR)

•      Object to processing (Art. 21 GDPR)

•      Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal

To exercise these rights, users may contact the Data Controller via the contact form in the Contact section of the site. The Controller will respond within 30 days of receiving the request.

Users also have the right to lodge a complaint with the competent data protection authority in their country of residence. In Italy: Garante per la protezione dei dati personali (www.garanteprivacy.it).

11. Data security

The Controller adopts appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure, including password encryption and HTTPS connections. In the event of a data breach posing risks to the rights and freedoms of users, the Controller will notify the supervisory authority within 72 hours and, where required, notify the affected individuals.

12. Minors

The platform is not intended for persons under the age of 16. The Controller does not knowingly collect data from minors. If the Controller becomes aware that data from a person under 16 has been collected, it will be deleted without delay.

13. Updates to this policy

This Privacy Policy may be updated over time to reflect legal or technical changes. Registered users will be informed of material changes via email notification or an in-platform notice. The current version is always available at myurbs.org/privacy.

Cookie and analytics tools

The site uses technical cookies that are necessary for its operation (for example, to manage the login session). In addition, with your consent, we use cookies/identifiers for statistical purposes through Google Analytics 4 (GA4).

Google Analytics 4 (with consent)

If you consent, GA4 helps us understand how the site is used (page views, events, performance). The service is provided by Google. We configured IP anonymization (anonymize_ip).

Consent management

You can accept or reject from the banner. If you reject, GA4 is not loaded. You can also withdraw your consent by clearing the site data (storage/cookies) from your browser and reloading the page.