Version July 23, 2026. This information is provided pursuant to articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”).
1. Data controller
The data controller and manager of the site is Carlo Oppo, Via Alghero 18, 07100 Sassari (SS), Italy. For requests relating to personal data:
2. Data processed
The site may process technical navigation data transmitted by systems and internet protocols, such as IP address, date and time, requested address, user agent and outcome of the request. In application systems, the IP address used to limit abuse is transformed into a value that is not directly readable.
Through Contact name, email, telephone, subject, message and reference to a work may be collected. Through Contribute contact data, information on the work, declared provenance, photographs of the work, the back, the signature, labels, details and documents in image format may be collected.
Images may contain technical metadata embedded by your device. Please do not send images showing people, identity documents, addresses, home interiors or other unnecessary data.
3. Purpose and legal bases
- Operation and safety: provide the website, prevent abuse, diagnose errors and protect systems and archives; legal basis: the data controller’s legitimate interest.
- Contacts: respond to requests and take pre-contractual steps requested by the data subject; legal basis: steps taken at the data subject’s request and, where necessary, consent.
- Archival submissions: receive, organise, examine and compare materials relating to works attributed to Augusto Oppo, confirm receipt by email and notify the contributor if a record is published; legal basis: handling the request, consent and a legitimate cultural and documentary interest, with due regard for the data subject’s rights.
- Publication: publish a record, image or owner’s name only after verification and on the basis of separate, optional permissions.
- Loans and expressions of interest: contact the contributor again only if they selected the relevant option; legal basis: consent.
- Newsletter: send the Archive Journal after the address has been confirmed; legal basis: consent, which may be withdrawn at any time.
- Obligations and protection: comply with legal obligations and establish, exercise or defend rights.
4. Provision of data and consequences
The data marked as mandatory are required to handle the request or submission. Without them, the submission cannot be completed. Permission to publish, to name the owner, to make further contact and to send the newsletter is optional; withholding it does not prevent archival review.
5. Photographs, originals and review materials
The original photograph is kept in a private area; the browser also generates a square derivative for review. During assessment, the Archive may produce further previews or working descriptions. Materials do not become public automatically. Only files selected by the Archive may be copied to the public area, after permissions and rights have been verified.
6. Recipients of the data
The data are processed by the data controller and authorised persons solely for the purposes set out in this notice and subject to appropriate confidentiality obligations. Data are disclosed to third parties only where necessary to provide the requested services, comply with legal obligations or protect the rights of the Archive and the data subjects.
Authorities and other entities may receive data when required by law. The owners' contact details are not communicated to potential buyers or gallery owners: the Archive forwards any request to the owner.
7. Transfers outside the European Economic Area
Some technology providers may process data outside the European Economic Area. In such cases, transfers rely on the safeguards provided for by the GDPR, such as adequacy decisions or standard contractual clauses, under the terms applied by the relevant provider.
8. Retention
Messages and submissions are retained for as long as necessary for administration, archival research and the protection of rights, with their usefulness reviewed periodically. Materials with no documentary value or legal basis are deleted or anonymised. Published records and images may be retained as part of the cultural archive for as long as their purpose and the relevant rights remain in force.
Unconfirmed newsletter requests expire after 48 hours. The data of confirmed subscribers are retained until unsubscription; minimum revocation information may be maintained to document compliance with the request. Technical logs are kept for the time necessary for security and diagnosis.
9. Publication and anonymity
The name of the owner remains confidential unless specific consent is given. The revocation of consent does not affect the lawfulness of previous processing; for images or data already included in publications, catalogs or historical documentation, the Archive will evaluate the request taking into account the applicable rights and archival interest.
10. Rights of the data subject
Where applicable, the data subject may request access, rectification, erasure, restriction or portability, object to processing and withdraw consent. The data subject may also lodge a complaint with the Garante per la protezione dei dati personali. Requests may be sent to the address given in section 1; the data controller may request only the information needed to verify the applicant’s identity.
11. Minors
The forms are not intended for independent use by children under 14. A parent or guardian must assist a minor with any submission.
12. Security
Proportionate organizational and technical measures are adopted, including separation between public and private archives, temporary URLs for confidential files, administrative access controls, format validation and frequency limits. However, no system can guarantee absolute security.
13. Updates
The information may be updated when features, suppliers or applicable rules change. The date and version are indicated at the top of the page. Relevant changes will be made visible on the site.