Privacy Policy
Information on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 [“GDPR”] and Legislative Decree 30.6.2003 n. 196 [“Privacy Code”]
This privacy notice aims to provide maximum transparency on how the personal data of those requesting registration for event or training course services, online donations, job applications, volunteer activities, requests for information on institutional activities, or purchases of solidarity products [“the Services”] are processed.
Data Controller
The Data Controller is the Fondazione Patrizio Paoletti per lo Sviluppo e la Comunicazione (tax ID: 94092660540), based in Rome, Via Nazionale 230; email [fondazione@fondazionepatriziopaoletti.org](mailto:fondazione@fondazionepatriziopaoletti.org); certified email [fondazionepatriziopaoletti@pec.it](mailto:fondazionepatriziopaoletti@pec.it); phone 06 8082599 [“the Controller”].
The Data Controller has appointed a Data Protection Officer (DPO) pursuant to art. 37 of the GDPR, Dr. Ilaria Sterpa. You can contact the DPO at any time and send any questions or requests regarding your personal data and privacy by writing to [privacy@fondazionepatriziopaoletti.org](mailto:privacy@fondazionepatriziopaoletti.org).
Personal data processed
At the time of registration for the Services, we will ask you to provide your contact information, such as name, surname, email address, phone number, and optionally, social media contact.
Purposes of personal data processing, legal basis, and retention periods
- Use of the Services and Controller obligations
Where processing is necessary for:
- your use of the Services, the legal basis is the necessity for the performance of the contract to which the data subject is a party (art. 6, par. 1, lett. b) – GDPR;
- analysis of Service quality and your satisfaction, including for Service improvement, the legal basis is the legitimate interest of the Controller (art. 6, par. 1, lett. f) – GDPR;
- fulfillment of legal obligations by the Controller, the legal basis is the fulfillment of a legal obligation of the Controller (art. 6, par. 1, lett. c) – GDPR;
- protection of a right of the Controller, the legal basis is the legitimate interest of the Controller (art. 6, par. 1, lett. f) – GDPR.
Retention period: once the needs related to the use of the Services and analysis of Service quality and user satisfaction have ceased, the personal data provided will be used and stored for the time necessary to fulfill the Controller’s legal obligations and to ensure protection of its rights within the statute of limitations.
- Sending communications regarding Controller initiatives
The Controller may use your email address to send informational messages, including via automated tools, about its initiatives similar to those of the Services: in this case, the legal basis is art. 130, paragraph 4, of the Privacy Code. You are always free to notify us of your decision not to receive further communications of this type.
The Controller may also use your email address, phone number, and social media contact to send informational and promotional messages about its initiatives, even if different from the Services, including newsletters and market surveys, via automated tools (email, SMS, fax, MMS, social media messages, WhatsApp, Messenger, online instant messaging apps) and non-automated methods (postal mail, phone with operator): in this case, the legal basis is always represented by your consent, which you are asked to freely provide at the time of registration for the Services.
Retention period: regarding these purposes, unless consent is revoked, the data provided will be retained for a maximum of 36 months, determined by the Controller considering that planning and implementation of projects and initiatives refer to periods no shorter than this.
- Sharing of personal data
If you wish, the Controller may share your personal data, including email, phone number, and social media contact, with its Partners performing related activities, even if in different fields, with whom it has partnership agreements to develop significant synergies and optimizations for achieving respective social purposes.
Sharing your data allows these Partners, who will become independent Data Controllers, to send you informational and promotional messages about their initiatives, even if different from the Services, including newsletters and market surveys, via automated (email, SMS, fax, MMS, social media messages, WhatsApp, Messenger, online instant messaging apps) and non-automated tools (postal mail, phone with operator).
In this case as well, the legal basis is always represented by your consent, freely provided at registration for the Services.
Retention period: for these purposes, unless consent is revoked, the data will be retained for a maximum of 36 months, considering that project planning and execution in synergy with Partners refer to periods no shorter than this.
- Social network profiles and pages
The Fondazione Patrizio Paoletti per lo Sviluppo e la Comunicazione manages its own pages on major Social Networks (e.g., Facebook, Instagram, YouTube) to promote its activities, publishing informational and promotional messages about initiatives, services, and fundraising campaigns for institutional purposes.
Those who access and follow the Foundation’s Social Network profiles and pages indicate their willingness to follow activities and receive information, including promotional messages, via these channels. In this case, sending messages through these channels is considered lawful if, from the context, operation of the social network, and information voluntarily provided by the user, it is clear that the individual has implicitly consented to receive informational and promotional messages about initiatives, services, and fundraising campaigns for institutional purposes.
Retention period: for these purposes, data will be used as long as the user chooses to follow the Social Network pages, since unsubscribing indicates revocation of consent to receive messages.
Consequences of refusal to provide data and refusal to consent
- Failure to provide data required for the use of the Services and Controller obligations will prevent the Controller from completing your registration request.
- Failure to give CONSENT for processing personal data for promotional communications and sharing with Partners will have no consequences; you always have the right to revoke it at any time without affecting the lawfulness of processing based on consent prior to revocation.
Processing methods and security measures
Personal data will be processed for the purposes for which they were collected, mainly using IT, telematic, and manual tools, adopting necessary security measures to minimize risks of unauthorized or accidental disclosure, unauthorized or accidental modification, or loss and destruction, even temporary.
Disclosure and categories of recipients
Personal data will never be disclosed.
Data will be processed by authorized personnel and by Data Processors linked to the Controller by specific agreement.
Except for sharing data with Partners upon your consent, the Controller may communicate personal data to third parties (Public Authorities, Police Forces, or other Public and Private Entities) only to fulfill contractual, legal, or regulatory obligations.
Transfer to third countries
Data are processed in EU countries. If transferred outside the EU, data will only be sent to countries deemed capable of providing adequate protection of personal data, as determined by the European Commission, or with appropriate safeguards (e.g., “standard clauses”) and provided that data subjects have enforceable rights and effective remedies, as required by current law.
Data subject rights
As a Data Subject, you may exercise the rights under Articles 15–21 of EU Regulation 679/2016, requesting the Controller to access, rectify, delete, or restrict processing of your data.
You also have the right to object to processing for legitimate reasons and the right to data portability.
To exercise these rights or revoke consent, you may contact the Controller by any suitable means, using the contact information above.
Finally, as a Data Subject, you always have the right to lodge a complaint with a supervisory authority in your EU member state of residence, work, or where a suspected violation occurred, or to take appropriate legal action (art. 79 GDPR).
For Italy: the supervisory authority is the Italian Data Protection Authority, Piazza Venezia n. 11 – 00187, Rome (RM) – email: [garante@gpdp.it](mailto:garante@gpdp.it) – certified email: [protocollo@pec.gpdp.it](mailto:protocollo@pec.gpdp.it), – website: [www.garanteprivacy.it](http://www.garanteprivacy.it).
Last update of this notice: 23.02.2022
FONDAZIONE PATRIZIO PAOLETTI PER LO SVILUPPO E LA COMUNICAZIONE