Privacy Policy

CITTADINANZATTIVA APS, pursuant to Article 4 of Regulation (EU) 2016/679 concerning the protection of personal data and their free movement, provides the following information to the categories of data subjects (members, users, suppliers, employees, collaborators, and volunteers) regarding the personal data being processed.

Personal data refers to any information that identifies or makes identifiable, directly or indirectly, a natural person and may provide information about their characteristics, habits, lifestyle, personal relationships, health status, economic situation, etc.

Particularly important are:

• Data that allow direct identification - such as personal data (e.g., name and surname), images, etc. - and data that allow indirect identification, such as an identification number (e.g., tax code, IP address, license plate number);

• Data falling into special categories: these are the so-called "sensitive" data, i.e., those revealing racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, health data, or sexual orientation. Regulation (EU) 2016/679 (Article 9) also includes in this category genetic data, biometric data, and those related to sexual orientation;

• Data related to criminal convictions and offenses: these are the so-called "judicial" data, i.e., those that may reveal the existence of certain judicial measures that must be recorded in the criminal record (e.g., final criminal convictions, conditional release, prohibitions or obligations to reside, alternative measures to detention) or the status of defendant or suspect. Regulation (EU) 2016/679 (Article 10) includes in this definition data related to criminal convictions, offenses, or associated security measures.

With the evolution of new technologies, other personal data have taken on significant roles, such as data related to electronic communications (via the Internet or phone) and data that allow geolocation, providing information on places visited and movements.

By "processing" (as per Article 4, number 2 of Regulation (EU) 2016/679), we mean any operation or set of operations, performed with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, communication by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

This processing must adhere to principles of fairness, lawfulness, transparency, and protection of your privacy and rights.

IDENTITY AND CONTACT DETAILS

Data Controller
CITTADINANZATTIVA APS

Registered Office
00183 Rome, Via Cereate No. 6

Tax Code
80436250585

Phone
06367181

Pec
This email address is being protected from spambots. You need JavaScript enabled to view it.

Institutional Website
https://www.cittadinanzattiva.it/

Data Processing Manager
Rosati Elio
Email This email address is being protected from spambots. You need JavaScript enabled to view it.

Data Protection Officer (DPO)
Lawyer Giancarlo Mattiello
Tax Code MTTGCR73A13H501Y
Phone 063231121
Pec This email address is being protected from spambots. You need JavaScript enabled to view it.

PURPOSE OF THE PROCESSING

Art. 6 letters a), b), d) and Art. 9 of REG EU 679/2016, Art. 118 Constitution, Art. 5 and 35 of Legislative Decree 117/2017

• Processing of members' data for managing the membership relationship and maintaining the association's historical archive

Art. 6 letter b) and Art. 9 of REG EU 679/2016, Workers' Statute and regulations on occupational safety, social security, and insurance

• Processing of employees and volunteers' data for managing the employment or volunteering relationship and related payments or expense reimbursements

Art. 6 letter a) and Art. 9 letter d) REG EU 679/2016, Art. 5 of Legislative Decree 117/2017

• Processing of users' data for contact management in handling the relationship and personal and/or sensitive data collected for the requested protection service or promoting and organizing campaigns, audits, petitions, events, initiatives, participation in surveys or questionnaires, or social promotion projects in the field of press or online communication
• Processing of users' data, in anonymous form, for preparing statistics or periodic reports or creating historical archives or sectoral surveys

Art. 6 letters a), b), and c) REG EU 679/2016

• Processing of members' and users' data for documentation and verification purposes by promoters, funders, or control authorities regarding the execution of projects and association activities

Art. 6 letter a) and Art. 9 letter d) REG EU 679/2016, Art. 5 of Legislative Decree 117/2017

• Processing of members' and users' data for managing newsletter services, organizing events/initiatives/petitions/audits, providing information, participating in surveys or questionnaires, or promoting campaigns or social promotion projects

Art. 6 letters a) and b) REG EU 679/2016

• Processing of suppliers' contact data for managing orders and payments
• Processing of contact and bank data or payment instruments of members, users, public or private entities for managing fundraising and financing

Art. 6 letter f) REG EU 679/2016

• Processing of contact data of other public or private entities for managing relationships and communication with third parties

METHODS OF PROCESSING AND STORAGE

The personal data being processed are collected and recorded for specific, explicit, and legitimate purposes, and are used in other processing operations in ways compatible with these purposes. They are relevant, complete, and not excessive in relation to the purposes for which they were collected or subsequently processed. They are stored in a form that allows identification of the data subject only when necessary and, in any case, for no longer than the period necessary for the purposes for which they were collected or subsequently processed. Depending on the different categories of data subjects and the specific purposes of the processing, personal, common, and sensitive data are provided directly by the data subjects and entered into paper or electronic databases managed by the data controller at the national headquarters or in locations controlled by authorized personnel, or exclusively in electronic format in databases within the national territory, thanks to cloud storage services delegated to third-party data processors, accessible through secure transmission methods. Sensitive or judicial data are processed according to logics and systems designed to minimize the identification of the data subject during the processing phase, within the limits necessary for the operator appointed by the Data Controller to manage the data as required for the provision of the requested service. The Data Controller identifies, authorizes, and appoints data processors based on specific roles and functions assigned for each purpose being carried out.

TRANSFER OF DATA TO THIRD COUNTRIES OUTSIDE THE EU

The data is not transferred to third countries and is stored within the Italian national territory.

DATA RETENTION AND DELETION PERIOD

The data controller performs controlled and periodic destruction of paper archives generally after ten years of storage. Specifically, paper documents containing sensitive data related to PIT services for healthcare protection are destroyed immediately after their use to fulfill the purpose for which they were collected. Paper archives related only to the management and historical archiving of institutional documents and association life, as well as relations with members, are stored indefinitely, subject to the exercise of the data subject's rights and compatible with the purposes of historical and statistical data retention.

Regarding data collected and stored also in electronic format, the data controller has adopted the following deletion methods and periods:

• Member data – not deleted; after the termination of the relationship, it is stored in a dedicated historical archive.
• User data – after ten years from the termination of the individual service, user personal data is deleted, and data related to the specific case is kept in an anonymous format. For specific projects, events, audits, surveys, personal data collected is deleted once the activity is completed, even for reporting and verification by promoters or control authorities.
• Supplier or consultant data – legal retention period of ten years.
• Employee or volunteer data – legal retention period of ten years from the termination of the individual relationship.
• Donor data – legal retention period of ten years.

CONSENT TO THE PROCESSING OF PERSONAL DATA

If the legal or contractual (or even pre-contractual) basis for the processing purpose requires it, the data subject must provide the requested data. Otherwise, the data controller will not be able to proceed with the specific processing purposes.

Consent may be given in writing, either in paper form or electronically, by accessing the requested service online, in any case after reading the privacy notice.

Those who register via the official website (by checking the appropriate box confirming reading of the terms and privacy policy) express clear and explicit consent to the privacy notice and authorize the data controller to process their personal data as described in this document.

Those accessing newsletter services or joining the association authorize the processing to also receive direct or automated communications to their email address from the website manager related to information or communications about the association's activities and institutional matters, as well as sector-related information and dissemination activities of the data controller.

Those providing consent also authorize the data controller to send paper or electronic communications dedicated to fundraising and voluntary donations.

AUTOMATED DECISION-MAKING PROCESS

The data controller does not use automated decision-making processes.

RIGHTS OF THE DATA SUBJECT

Under Chapter III, Rights of the Data Subject, Section I “Transparency and Methods,” Articles 12 and following of EU Regulation No. 2016/679 on personal data protection, the data subject may request and obtain confirmation of the existence of their data, even if not yet recorded, and their communication in an intelligible form. The data subject has the right to obtain information regarding: the origin of personal data (the subjects from whom it is collected), the purposes and methods of processing, the criteria and logic of processing carried out using electronic tools, the details of the controller and any appointed data processors, the subjects or categories of subjects to whom the data is communicated, any transfer of data abroad and its modalities, the retention period of the data or criteria used to establish it, any automated decision-making processes including profiling, their logic, and expected consequences. The data subject may also request: updates; corrections and integration of incomplete or inaccurate data; deletion, anonymization, or blocking when the processing violates the law, including data not necessary for the purposes for which it was collected or subsequently processed; certification that the aforementioned operations have been brought to the attention of those to whom the data was communicated or disclosed, unless such action proves impossible or the use of means excessively costly or disproportionate to the protected right; portability; limitation of processing. The data subject may object, in whole or in part, to the processing of their data for legitimate reasons. This opposition may result in the complete or partial inability of the data controller to continue providing the services requested by the user. If the data subject is dissatisfied with the response provided by the data controller or their representative, they may file a complaint with the Italian Data Protection Authority as outlined in Chapter VIII, Articles 77 and following of EU Regulation No. 2016/679. Any requests, communications, or complaints by the data subject and, in any case, to exercise their rights, can be addressed to the following email: This email address is being protected from spambots. You need JavaScript enabled to view it.

SECURITY MEASURES

The data controller has implemented appropriate security measures to ensure the safe processing and storage of data, authorized access, protecting the information and minimizing processing to reduce the risks of loss, accidental destruction, unauthorized access, and processing. These security measures can be reviewed in the processing register adopted by the controller, which will be provided upon specific request by the data subject.

The data controller for managing the website, while ensuring appropriate Antivirus systems within it, reminds users that, in addition to being a legal obligation, it is advisable for the data subject to equip their workstation with a virus prevention and scanning system. Access to the dedicated part of the site is assigned to users with an identification code and password; these passwords are generated by the users based on criteria predefined by the site administrator. The user is required to keep the password confidential, and in the absence of such care, they assume full responsibility for any third-party use.

The co-controllers and external data processors independently carry out data processing activities and functions, adopting appropriate security measures, the proper implementation of which depends solely on them and not on the data controller, who monitors only the adoption and compliance with their privacy policy.

PRIVACY POLICY

This document constitutes the “Privacy Policy” of the data controller (CITTADINANZATTIVA APS National) and is subject to modifications and/or additions for any regulatory updates or changes to the systems, procedures, or methods of data processing by the data controller. Any other body or subject of the association, different and with a regional office or different location within the national territory, independently processes the data it manages and adopts the corresponding security measures, of which it is the controller.