Privacy policy

1. Data controller

The data controller is Comitato Progetto SolidALE ETS, based in Milan, Italian tax code 97996230153, registered with the RUNTS registry under rep. no. 153690. For any matter concerning your data you can write to info@progettosolidale.org.

2. What data we process

• • Data you provide voluntarily: first name, last name, e-mail address and the content of the message you send through the contact form or directly by e-mail.
• • Donation data: for bank transfers, the data shown on the bank record (name, IBAN, amount, reference); for PayPal, the data PayPal communicates to the committee. Payment data never passes through this website.
• • Browsing data: technical data collected through cookies and similar technologies, described in the Cookie policy.

3. Purposes and legal bases

• • Replying to requests, ideas and collaboration proposals: measures taken at your request and the committee's legitimate interest in handling correspondence (art. 6(1)(b) and (f) GDPR).
• • Managing donations and the related accounting and tax obligations, including receipts for tax benefits: compliance with legal obligations (art. 6(1)(c) GDPR).
• • Analysing how the site is used, in aggregate form, to improve it: consent (art. 6(1)(a) GDPR), which you can withdraw at any time.

4. Retention periods

• • Messages and correspondence: up to 24 months after the request is closed.
• • Donation records: 10 years, as required by art. 2220 of the Italian Civil Code and tax law.
• • Browsing data: for the periods indicated in the Cookie policy.

5. Recipients

Data is processed only by authorised members of the committee and by the providers delivering technical services for this site, appointed as data processors where required:

• • EmailJS Inc. — delivery of messages sent through the contact form.
• • Vercel Inc. — website hosting and anonymous performance measurement.
• • PostHog EU B.V. — aggregate usage statistics, with servers in the European Union, activated only with your consent.
• • Banks and PayPal — handling of donations.
• • Data is never disclosed or sold to third parties for commercial or marketing purposes.

6. Transfers outside the EU

Some providers (EmailJS, Vercel) are based in the United States: any transfers take place with the safeguards required by artt. 44 ff. GDPR, such as Standard Contractual Clauses approved by the European Commission and/or EU-U.S. Data Privacy Framework certification.

7. Your rights

Under artt. 15-22 GDPR you can at any time request access to your data, its rectification or erasure, restriction of processing, portability, object to processing, and withdraw any consent given, by writing to info@progettosolidale.org. If you believe the processing infringes the law, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

8. Changes to this notice

This notice may be updated, for example when new services are introduced or the law changes. The date of the last update is shown at the top of the page.