Headquarter: San Bonifacio (VR)

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLES 13 AND 14 OF EU REGULATION 2016/679

1. Identity and contact details of the data controller:

The data controller is FONDAZIONE PEDROLLO ETS, tax code 92031380238, with its registered office at Via Enrico Fermi, 7, San Bonifacio (VR), Italy.

You can contact the data controller using the following details:

2. Data processed

Common data

  • Identifiable and contact data: last name, first name, gender, nationality, place and date of birth, phone number, email address, and home address.
  • Donation-related data: amount, payment method, donation date, bank account number, credit card number, or other electronic payment details.

3. Purpose of processing and legal basis

The personal data collected will be processed for the following purposes:

  • Management of donations: registration and administration of received donations, financial transaction management, and sending of tax receipts.
  • Communication with donors:
    • Reporting on the Foundation’s activities realized through received donations.
    • (With explicit consent) Providing other information about initiatives promoted by the organization.
  • Compliance with legal obligations: fulfilling fiscal and accounting requirements under current donation and tax benefit regulations.

The legal basis for processing is as follows:

  • a) Necessity for the execution of a contract [Article 6(1)(b) GDPR].
  • b) Legitimate interest of the data controller [Article 6(1)(f) GDPR].
  • c) Consent to processing [Article 6(1)(a) and Article 9(2)(a) GDPR].
  • d) Necessity to comply with legal obligations [Article 6(1)(c) GDPR].

4. Processing methods and principles

Processing will be carried out in compliance with the GDPR and Legislative Decree No. 196/03 (“Personal Data Protection Code”), following principles of lawfulness, fairness, transparency, adequacy, and relevance. Both paper and electronic means will be used by authorized personnel of the Foundation, with adequate protective measures in place to ensure the security and confidentiality of the data. No automated decision-making processes will be applied.

5. Categories of third parties to whom the data may be disclosed

The data collected for donation management may be disclosed to the following categories:

  • Banking institutions.
  • Payment service providers, tax and legal consultants for donation and fiscal obligation management.
  • IT system maintenance companies.
  • Competent authorities for legal compliance or in response to judicial requests.

Data may also be disclosed to individuals or entities (public or private) where communication is necessary or functional for fulfilling the Foundation’s institutional activities and projects (e.g., accountants, auditors, insurers, etc.).

When necessary, external entities handling the described services will be appointed as External Data Processors under Article 28 GDPR.

6. Duration of processing and data retention period

Your data will be processed for no longer than necessary to achieve the purposes for which it was collected and processed, and in any case, not exceeding 10 years to comply with fiscal and legal obligations.

Data collected for re-contact and marketing purposes will be processed until consent is withdrawn.

7. Transfer of data outside the European Union

The collected data will not be transferred to non-EU countries.

8. Data subject’s rights

As a data subject, you may exercise the rights provided under Articles 15 and following of EU Regulation 2016/679, as detailed below:

  • Rights of access, rectification, integration, and erasure of data, as well as data portability, restriction of processing, and withdrawal of consent.
  • Pursuant to EU Regulation 2016/679, you have the right to request access to your data, as well as its rectification, integration, or erasure. A written response will be provided within 30 days of the request submission, including electronic means.
  • You also have the right to object to or restrict the processing for legitimate reasons, as provided for in Articles 18 and 21 of EU Regulation 2016/679.
  • Consent given for specific purposes outlined in this notice may be withdrawn at any time.
  • Finally, you may exercise the right to data portability, requesting the transmission of data to another controller.

To exercise the above rights, simply use any of the contact details for the data controller provided in section 1.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the competent supervisory authority if you believe your data is being processed unlawfully and contrary to legal requirements.