Privacy Policy

This notice describes the processing of personal data of visitors to www.ilsorrisodicostanza.org. The data controller is the Association “Il sorriso di Costanza – E.T.S.”, based at Via Sommacampagna, 47 – 00185 Rome, Italy.

Associazione “Il sorriso di Costanza – E.T.S.”
Via Sommacampagna, 47 – 00185 Rome, Italy
Tax code: 97933810588
Email: info@ilsorrisodicostanza.org
Certified email (PEC): ilsorrisodicostanza@pec.it
Phone: +39 345 3966917

This notice applies to the Association’s website and requests received through its contact details and contact form. External websites reached through links and third-party services have their own privacy notices, which we encourage you to read.

Data collection is limited to what is needed for the purposes described. For cookies and similar technologies, please read our Cookie Policy.

• Information requests and contact: responding to messages submitted through the form or by email and taking the steps needed to deal with your request. The legal basis is taking steps at the data subject’s request before entering into a potential relationship, where applicable (Article 6(1)(b) GDPR), or the legitimate interest in managing correspondence and answering requests (point (f)).
• Donations: managing contributions received, donor relations and any receipts. The legal bases are performance of the relationship with the donor (point (b)) and compliance with administrative, accounting and tax obligations (point (c)).
• Website operation and security: making pages available, preventing abuse and protecting systems and data. The legal basis is the Controller’s legitimate interest in website security and operation (point (f)), while respecting users’ rights.
• Legal obligations: complying with applicable provisions and requests from competent authorities (point (c)).
• Processing requiring consent: if functions requiring consent are enabled, consent must be requested separately and may be withdrawn without affecting the lawfulness of processing before withdrawal (point (a)).

Data provided voluntarily. The contact form collects your name, email address, subject and message. Emails or telephone communications may contain additional contact details and information you provide. Donations may require identification details, transaction references and a tax code, including for issuing receipts.

Browsing data. Operating web services may involve processing IP addresses, device and browser information, request dates and times, and technical data relating to access, errors and security.

Special categories of data. The form does not request health information or other special categories of personal data under Article 9 GDPR. Please do not include these in messages unless necessary. Any processing requiring such data must be accompanied by an appropriate notice and a valid legal condition.

Providing data is optional, but failure to provide necessary information may prevent us from answering a request, managing a donation or issuing requested documents.

Data is processed using electronic and, where necessary, paper-based tools by authorised people and providers whose work relates to the stated purposes. Processing follows the principles of necessity, proportionality and confidentiality.

Contact data is retained for as long as needed to deal with the request and any related correspondence. Donation data and supporting documents are retained for the period required by applicable accounting and tax obligations. Technical data is retained according to operational and security needs; further retention may be necessary to meet legal obligations or establish, exercise or defend a legal claim.

Please contact the Controller for information about the retention periods applicable to specific processing.

Data may be accessed by the Association’s authorised people and providers of IT, email, administrative and accounting services, to the extent necessary for their tasks. Where acting on behalf of the Controller, these providers must be appointed as processors where required by Article 28 GDPR. Data may also be disclosed to authorities where required by law.

For donations through PayPal, the payment provider processes data under its own Privacy Statement. The Google Maps map on the Contacts page involves interaction with a Google service, governed by Google’s Privacy Policy.

Some external services may involve processing in countries outside the European Economic Area. Processing locations and applicable safeguards are described in the providers’ notices. Any transfers are subject to the conditions set out in Chapter V of the GDPR.

The Controller adopts technical and organisational measures appropriate to the processing risks to protect data against loss, destruction, unauthorised access and uses incompatible with the stated purposes.

In the cases and within the limits provided by Articles 15–22 GDPR, you may request access, rectification, completion, erasure, restriction of processing and data portability, where applicable. You may also object to processing based on legitimate interests and withdraw any consent you have given.

To exercise your rights, email info@ilsorrisodicostanza.org or use the certified email address ilsorrisodicostanza@pec.it. Where necessary, information may be requested to verify your identity.

You also have the right to lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority.

This notice may be amended to reflect changes to the website, activities or applicable law. The updated version will be made available on this page. For further information, please contact the Association using the details provided above.