Dear Sir or Madam,

We would like to inform you that Regulation (EU) 2016/679 and Italian Legislative Decree 196/2003 (as amended by Italian Legislative Decree 101/2018) about the “protection of personal data” provide for a series of obligations for those subjects – called “Controllers” –carrying out “processing” (i.e. collection, processing, communication, dissemination, etc.) of personal data of third parties – called “data subjects”.

Processing

1. The processing of your personal data and of the data of your family members communicated to us is and will be carried out to comply with legal and contractual obligations related to the activities promoted by the Controller you decided to enrol in. The processing will be based on the principles of fairness, lawfulness and transparency.

Purposes of the processing

2. Personal data are processed as part of the usual Controller’s activities for the following purposes:

      1. Exclusively for complying with contractual obligations or acquiring pre-contractual information, as well as information related to the data subject’ request to enrol in the activities promoted by the Controller;

      2. In relation to obligations provided for by laws, regulations and EU legislation and by provisions issued by authorities entitled to do so and control and supervisory bodies, as well as in relation to tax and accounting obligations.

      3. Exclusively for information and advertising of the activities carried out and promoted by the Controller, for which you are entitled to give or not your consent, such as taking audiovisual footages and pictures which may be published on the website, blog or social media pages of the Controller, or on information and advertising flyers, printed material or any other communication medium.

      4. Information purposes related to the Controller’s activities, for which you are entitled to give or not your consent, through information communications (sent via e-mail and/or through the Controller’s official social network pages), including the newsletter.

      5. For the purpose of facilitating contacts, for which you are entitled to give or not your consent, such as drafting a contact list to be distributed to all participants of the camp you are attending, which contains the participants’ contact details (first name, last name, address, phone number, and e-mail).

Categories of data collected

3. The data collected are identification data (personal identification data, tax ID or VAT number, ID number) strictly connected and instrumental to manage the contractual and pre-contractual relationships (such as acquisition of information before concluding a contract or performing operations under the concluded contract) as well as to comply with legal obligations.

The processing may involve data defined as “special categories of data” (also called “sensitive” data) as they may reveal health status, religious believes, sexual orientation, etc.

Legal basis of processing

4. Processing of your data for the purposes under point 2 letters a) and b) of this Privacy Notice is lawful because:

    • It is carried out for the performance of a contract to which the data subject (you) is party;
    • It is necessary for compliance with a legal obligation to which the Controller is subject (obligations provided for by laws, regulations and EU legislation, as well as by tax and accounting obligations).

Processing of your data for the purposes under point 2 letters c), d) and e) of this Privacy Notice is lawful to the extent that you gave your consent.

Processing of your special categories of data is lawful to the extent that you gave your consent.

Methods of processing

5. Processing will be carried out with manual and/or automated systems in order to store, manage and transmit the data with logics strictly connected with the purposes, on the bases of the data that we have and with you committing to promptly communicate to us any correction, integration and/or update of the same.

Communication and Dissemination

6. Your data won’t be disseminated but will be communicated, when necessary, according to legislation in force to credit institution for the management of collections and payments deriving from the execution of contracts; companies, consultants or professionals tasked with the installation, maintenance, update and management of the Controller’s informational and other systems; professional firms and entities providing legal, tax, commercial, labour and organisational consulting services; company consultants, volunteers and employees tasked with processing; those subjects to whom communication is necessary or functional for the correct fulfilment of contractual obligations, as well as legal obligations or who have access to personal data by virtue of legal or administrative measures.

These subjects are external Processors or operate autonomously from the Controller. The list of Processors is available at the Controller’s registered office and is available upon request from the Controller.

Communication of data is mandatory

7. Without prejudice to the personal autonomy of the data subject, providing personal data for the purposes under point 2, letters a) and b) is:

    • absolutely necessary to manage and perform the existing contracts or those being finalised, or in order to take steps at the request of the data subject prior to entering into a contract;
    • mandatory in relation obligations provided for by laws, regulations and EU legislation and by provisions issued by authorities entitled to do so and control and supervisory bodies, as well as in relation to tax and accounting obligations.

Providing personal data for the purposes under point 2 letters c), d) and e) is optional.

Refusal to provide data

8. If the data subject refuses to provide their data for the purposes under point 2 letters a) and b) of this Privacy Notice, it won’t be possible to correctly and completely perform the contract to which the data subject is a party or to implement pre-contractual measures taken at the data subject’s request.

If the data subject refuses to provide their data for the purposes under point 2 letters c), d) and e), there won’t be any consequences on the existing contracts or those being finalised. However, the Controller won’t be able to carry out the activities indicate therein.

Storage of data

9. The data will be stored in a way that will allow your identification for the period of time strictly necessary for the purposes for which they are processed, and, however, in compliance with legal obligations relating to data storage periods.

Rights of the data subject

10. In relation to the data processed according to this Privacy Notice, the data subject is entitled, at any time:

    • to ask if the Controller has any of their personal data;

    • to obtain information about the purposes of the processing, the categories of personal data, the recipients or the categories of recipients to whom the data have been or will be communicated and, when possible, the storage period;

    • to obtain rectification or erasure of the data;

    • obtain restriction of processing;

    • to obtain data portability, i.e. to obtain the data from the Controller in a structured, commonly used and machine-readable format and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided;

    • object to processing at any time and also in case of processing for purposes of direct marketing;

    • to oppose automated individual decision-making related to individuals, including profiling;

    • to request from the Controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject’s data and to object to processing, as well as the right to data portability;

    • to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

    • to lodge a complaint with a supervisory authority.

Exercise of the data subject’s rights

11. The rights above can be exercised with an informal request sent via e-mail to the following address: ufficio@agapecentroecumenico.org

Controller

12. The Controller of your personal data is Agape Centro Ecumenico, in the person of its pro tempore legal representative, with registered office in Borgata Agape 1, 10060 Prali (TO), Italy, e-mail: ufficio@agapecentroecumenico.org