1. Data Controller
The Data Controller for personal data processed through this website is the Comitato Fra Elia nel Mondo (Fra Elia Committee in the World), with legal headquarters in Via Antonio Cavalli n. 23, Bergamo (BG), Italy, in the person of its legal representative pro tempore, Fiorella Turolli.
- Contact E-mail:
[email protected]
2. Types of Data Processed and Collection Methods
- A) Contact Forms (WPForms Plugin): Through contact forms submitted on the website, we collect personal data voluntarily provided by the user, including: full name, e-mail address, and any additional personal information included in the body of the message.
- B) Online Donations (“Donations with PayPal & Stripe” Plugin): To process and manage online donations, we collect: full name, e-mail address, donation amount, and any data necessary for tax accounting and reporting (e.g., tax code/VAT number, billing address).
- Important Notice: Payment card details and financial account credentials are never stored on our servers. They are directly and securely processed in encrypted form by third-party Payment Service Providers:
- PayPal: PayPal Privacy Statement
- Stripe: Stripe Privacy Policy
- Important Notice: Payment card details and financial account credentials are never stored on our servers. They are directly and securely processed in encrypted form by third-party Payment Service Providers:
- C) Browsing Data and Cookies (Managed via CookieYes Plugin): IT systems automatically acquire standard browsing data (e.g., IP address, browser type, request timestamps). The website uses the CookieYes platform to manage cookie consent banners and ensure prior consent management. Users may give, customize, or revoke consent for non-essential analytics and tracking cookies at any time (e.g., Google Analytics with anonymized IP).
3. Purposes and Legal Bases for Processing
- Responding to contact form inquiries (WPForms):
- Legal basis: Execution of pre-contractual or contractual measures taken at the user’s request (Art. 6(1)(b) GDPR).
- Processing donations and accounting/tax compliance:
- Legal basis: Execution of the donation contract (Art. 6(1)(b) GDPR) and compliance with legal obligations under applicable tax and accounting laws (Art. 6(1)(c) GDPR).
- Cookie Consent Management (CookieYes) and Technical Operations:
- Legal basis: For technical cookies, the legitimate interest of the Controller to ensure website functionality and security (Art. 6(1)(f) GDPR); for analytics and third-party cookies, the user’s explicit consent (Art. 6(1)(a) GDPR) gathered via CookieYes.
- Website security and fraud prevention:
- Legal basis: Legitimate interest of the Data Controller in protecting IT infrastructure (Art. 6(1)(f) GDPR).
4. Nature of Data Provision
- Providing personal data via WPForms and donation forms is mandatory to allow us to handle inquiries or process financial contributions. Failure to provide such data will result in the inability to deliver the requested service.
- Consent for non-essential cookies is optional and can be freely modified at any time via the CookieYes consent banner.
5. Data Retention Periods
- Contact Form Data (WPForms): Retained for the duration necessary to handle and respond to the inquiry, and subsequently deleted unless required for legal defense.
- Donation Records: Retained for 10 years in accordance with statutory accounting and tax retention obligations.
- Cookie Preferences: Saved choices via CookieYes are stored for up to 12 months or until cleared manually by the user.
6. Data Recipients and International Transfers
Personal data will not be publicly disseminated. Data may be processed by:
- Authorized internal staff and appointed accounting/legal consultants.
- Web hosting and IT service providers acting as Data Processors pursuant to Art. 28 GDPR.
- PayPal Inc. and Stripe Inc. for payment execution. Data transfers to non-EU countries (such as the USA) operated by these providers rely on appropriate safeguards, including the EU-U.S. Data Privacy Framework and European Commission Standard Contractual Clauses (SCCs).
- Mozilor Limited (CookieYes): for consent logging and compliance management.
7. Rights of the Data Subject (Artt. 15-22 GDPR)
Data subjects have the right to request access to their personal data, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, and to object to processing. Users may also withdraw cookie consent at any time via the website footer link.
To exercise your rights, please contact us at: [email protected]
You also have the right to lodge a complaint with the competent Data Protection Authority