Introduction

When you browse our website or use our services, we collect information and data personal that concerns you. For this reason, in compliance with the provisions of the EU Regulation n. 679/2016 (hereinafter “GDPR”) and any implementation laws, we have created the present document (hereinafter “Privacy Policy”) for the purpose of describing the personal data we collect, the purposes and methods of processing of the same and the security measures that we take to protect such data.

This Privacy Policy constitutes the notice to data subjects issued pursuant to applicable legislation on personal data protection and has been drawn up in compliance with Recommendation n. 2/2001, adopted on May 17, 2001 by the Working Group for the Protection of Personal Data – Article 29 in relation to the minimum requirements for online data collection in the European Union. In addition, we inform you that this Privacy Policy applies only to the website www.novacaritas.org (hereinafter the “Webstite”) and does not apply to third party websites potentially mentioned by way of link or banner within the Website.

Sources of data and purposes of the data processing

2.1 Browsing data

The IT systems used to run the services acquire, during their normal operation, certain personal data, the transmission of which is implicit in the use of Internet communication protocols. This information is not processed with the aim of identifying you, but it could be possible to identify you if such information is combined with data held by third parties. This category of data includes the IP addresses or domain names of your computer, the addresses denoted in Uniform Resource Identifier (URI) strings of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server response and other parameters relating to your operating system. We use this information solely to obtain anonymous statistical data on use of the Services and verify that the Website is functioning correctly. All such data is erased immediately after processing. The data could be used to ascertain responsibility in the event of computer crimes, which are detrimental to the Services.

2.2 Purpose of the processing

Providing us with the information indicated above is mandatory to be able to navigate on our Website. Your refusal to provide such information would prevent you from navigating on the Website.

Information collected via cookies and other technology

Cookies are small files sent by the websites visited by users and stored on the device used to access these sites. When users visit the same site again, the browser reads the cookies stored on the device and retransmits the information to the site that originally created the cookie. Our site also uses different types of cookies and other technologies for reading and storing information on the user’s device in order, for example, to perform statistical analysis, customize and facilitate the browsing experience of users and, with the prior consent of user, offer advertising based on your interests. We do not use cookies that have the ability to run programs on your devices or send viruses on them, or that establish a control on your devices.

In accordance with the Decision of May 8, 2014 of the Italian Data Protection Authority, we inform you that this notice also represents the extension of the short banner already displayed when you connected to the Website. In particular, our Services use:

• technical cookies, which are necessary for the functioning of the Website, including the provision of the Services offered in it. This category of cookies includes analytics, session and functionality cookies, used by the controller, for example, to collect information, in aggregate form, on the number of users and how they visit the site, to save your navigation preferences, such as language, or to recognize the user who returns to the website;
• profiling cookies, aimed at creating profiles related to the user and used to send and display advertising messages in line with the preferences expressed by the user during the navigation.

The cookies can be:

• temporary, when they are automatically deleted at the end of the connection;
• permanent, when they remain stored on the user’s hard disk, unless the user himself cancels them;

Cookies can be of the first part, if set and managed directly by the site manager or third party when managed by parties other than the site manager.

While for the use of technical cookies the user’s consent is not required, for the use of profiling cookies it is always necessary the user’s consent and the user can choose which profiling cookies give consent to.

You can manage and disable cookies directly from your browser settings:

• Internet Explorer
• Google Chrome
• Safari
• Firefox

or through www.youronlinechoices.com.

The table below shows the cookies used by this Website.

Nature	Type and name	Duration
First party cookie	Session – pll_language	1 year
First party cookie	Session – displayCookieConsent	1 year
Third party cookie	Session – _ga	2 years

The Services may contain applications and materials (“API”) that use data taken from your accounts opened on social networks such as Facebook, Linkedin, Google+ etc. For example, an API can allow you to post comments directly on the social network you are subscribed to. When you use an API of this type, your personal data is transmitted to the social network. These data are governed by the privacy notice of this social network. An API can also be designed to get information and content related to you, your friends, your user ID and other types of content taken from the social network you used. This information and content will not be acquired, unless you have given your consent to the social network. If such consent is given, the aforementioned information will be used in accordance with this Privacy Policy and the rules on APIs of the social network.

Processing mechanisms and conservation of data

We process your personal data through paper and electronic tools and in continuous compliance with the security requirements imposed by applicable law. Our security measures include contractual arrangements with any contractor (e.g., service providers) in order to ensure the protection of the security and confidentiality of your personal data in accordance with provisions set forth by applicable legislation on personal data protection.

We keep your personal data for the time necessary to perform the service you requested and in line with obligations of applicable laws and regulation, to protect and exercise our rights, to prevent frauds and to apply this Privacy Policy.

Context of the communication

4.1 Internal and external communication of personal data

Your personal data will be processed only by persons previously authorized to process or by data processors. In particular, your data may be disclosed to following categories of external persons: professional and/or technical service providers, legitimate recipients according to the law. The recipients of the data act as data controllers, processors or persons authorised to the processing according to the applicable legislation.

Any third party which, as part of this procedure, is a the recipient of your data will be able to use it within the limits established by this Privacy Policy. To receive the updated list of data processors, as well as the list of recipients of your personal data, contact us by sending an email to the following address: [Please insert email address].

4.2 Transfer of data abroad

Your personal data may be transferred by us to third parties established within the European Union. This transfer is permitted as each country in the European Union guarantees an adequate level of data protection. However, we could transfer your data also to third countries, not belonging to the European Union, which do not guarantee the same level of data protection. We hereby inform you that such transfer to third countries will always be in accordance with the provisions of the GDPR, i.e. by collecting your consent, when necessary, or by adopting every necessary measure to ensure the security of the data being transferred, e.g. EU Standard Contractual Clauses.

Rights of the data subjects

At any time, you can exercise the rights recognised in the GDPR, as follows:

• Request for access to your personal data: you have the right to obtain from the data controller confirmation of processing of personal data concerning you and, in this case, to access your personal data. Access entails the availability of certain information, including the purposes of the processing, the categories of personal data processed and the recipients to whom the data are communicated. However, there is no absolute right of access and the interest of other individuals may limit your right of access. You also have the right to obtain a copy of the personal data being processed. For additional copies, a monetary contribution may be applied.
• Rectification of your personal data: you have the right to obtain the rectification of inaccurate personal data concerning you, as well as to obtain the integration of incomplete personal data, including by providing an additional declaration.
• Erasure of your personal data: you have the right to obtain from the data controller the erasure of personal data concerning you without undue delay, and the data controller is obliged to cancel the personal data without undue delay in certain circumstances, including the elimination of the need for data with respect to the purposes for which they were collected or the withdrawal of consent.
• Limitation of the processing of your personal data: in certain circumstances – including in the case of disputing the accuracy of data – you have the right to request the limitation of the processing of personal data concerning you.
• Data portability: you  have the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used and machine-readable format and you have the right to request transmission of those data to another controller without hindrance from the controller to whom you have provided the data if the processing has been based on consent and is carried out by automatic means.
• Opposition to processing: you have the right to object to the processing of personal data concerning you at any time, for reasons connected to your particular situation.
• The right to lodge a complaint with the competent supervisory authority (Italian Data Protection Authority) remains unaffected.

To exercise these rights, please contact us using the contact details below.

Data Controller

The Website is managed by Fondazione Novacaritas Onlus, with registered office in Appiano Gentile, via Milano 12, 22070 (CO) email: [please insert email], which acts as data controller.