Skip to content
Language

Privacy Policy

Last updated: 21 October 2026.

This notice explains how Associazione Luca Persiani APS processes the personal data of people who visit www.associazionelucapersiani.it, write to us, become members, make a donation or take part in our events. It is provided under Articles 13 and 14 of EU Regulation 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003).

1. Who the data controller is

Associazione Luca Persiani APS
Via della Maglianella, 175, Rome, Italy
VAT no. 17834821005, tax code 96609710585
Email: associazionelucapersiani@gmail.com

For any privacy question you can write to the email address above.

2. What data we process, why and for how long

2.1 Browsing the website

The website is hosted by Aruba S.p.A. on servers in Italy. Like any website, the server automatically records some technical data about visits (IP address, date and time, page requested, browser type) to make the website work and protect it from misuse. For the same reason, anyone who tries to log in to the administration area with wrong passwords is blocked for a limited time, and during the block we keep an encoded version of their IP address.

  • Legal basis: the association's legitimate interest in the security and proper functioning of the website (Art. 6(1)(f) GDPR).
  • Retention: server logs for the period set by the hosting provider; login block data only for the duration of the block.

2.2 Internal visit statistics

We count visits and clicks on the main links (for example the donation button or the email address) with a tool installed on our own server, with no cookies and no external services. To tell apart visits made on the same day we use a code derived, in a non-reversible way, from the IP address, browser type, date and a secret key: we do not store the IP address and the code changes every day, so we cannot recognise you from one day to the next. We also record the general source of the visit (for example "from Google" or "direct").

  • Legal basis: legitimate interest in knowing how much and how the website is read (Art. 6(1)(f) GDPR).
  • Retention: the daily code is deleted the following day; only overall figures remain, for up to 400 days.

2.3 Google Maps on the event pages

The maps of event locations are provided by Google and load only if you have accepted "External content" in the banner or if you press "Show the map". From then on Google receives your IP address and the technical data of your browser and may set its own cookies.

  • Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin, Ireland, with possible transfer to Google LLC (United States), which participates in the EU-U.S. Data Privacy Framework. Privacy policy: policies.google.com/privacy.
  • Legal basis: consent (Art. 6(1)(a) GDPR), given in the banner or by clicking the button.
  • Retention: decided by Google under its own policy. The association does not receive this data.

2.4 Emails you send us

There are no contact forms on the website: to write to us you use your own email program. We process your email address, your name and whatever you choose to tell us, only to reply and follow up on your request (for example information about the association, events or membership). Please do not send us data that the request does not need.

  • Legal basis: replying to your request and pre-contractual steps, for example before membership (Art. 6(1)(b) GDPR); for other requests, legitimate interest in replying to people who contact us (Art. 6(1)(f) GDPR).
  • Tool: the association's mailbox is a Google Gmail account, so messages are stored on Google's servers, also outside the EU (see section 5).
  • Retention: for as long as needed to handle the request and then for no more than 24 months after the last exchange, unless the messages are needed for an ongoing relationship (for example membership) or for legal obligations.

2.5 Members of the association

When you join the association we process the data you give us to register you, for example first name, surname, address, telephone, email and the payment details of the membership fee.

We use it for:

  • entering you in the register of members and managing the membership relationship;
  • taking part in the life of the association (calling general meetings, voting, holding office);
  • keeping you informed about the association's activities and initiatives;
  • the administration and accounting of membership fees;
  • the legal obligations of Third Sector organisations and tax obligations.
  • Legal basis: performance of the membership relationship governed by the articles of association (Art. 6(1)(b) GDPR) and compliance with legal obligations, such as keeping the register of members required by Art. 15 of Legislative Decree 117/2017 and accounting and tax obligations (Art. 6(1)(c) GDPR).
  • Retention: for the whole duration of membership. After it ends, the data in the register of members and in administrative and accounting documents is kept for 10 years, as required for accounting records (Art. 2220 of the Italian Civil Code); other data is deleted and communications about activities stop.

2.6 Donations with SumUp

The "Dona ora" (Donate now) button leads to SumUp's payment page, an external website. You enter your card and payment details on SumUp and they never pass through our website: for that part SumUp acts as an independent data controller, under its own privacy policy (sumup.com/en-ie/privacy).

SumUp sends us the transaction data (amount, date and any details you enter on the payment page, such as name or email). We use it to record the donation in our accounts, to thank you if you left a contact and to answer any questions you may have about the donation.

  • Legal basis: compliance with accounting and tax obligations (Art. 6(1)(c) GDPR) and handling your donation and the receipt you request (Art. 6(1)(b) GDPR).
  • Retention: 10 years for accounting records (Art. 2220 of the Italian Civil Code).

2.7 Photos and videos of events

During events the association may take photos and videos to tell the story of its activities on the website and on its own channels. The images show the context of the event and are not used for commercial purposes. We do not publish images in which minors can be recognised without the consent of whoever holds parental responsibility. If you appear in a photo and would like it removed or made unrecognisable, write to us and we will act without delay.

  • Legal basis: the association's legitimate interest in documenting its public initiatives (Art. 6(1)(f) GDPR); consent where needed, as for portraits and for minors (Art. 6(1)(a) GDPR).
  • Retention: as long as the images remain useful to document the association's activities, unless you ask for removal.

2.8 Legal obligations and protection of rights

We may also process the data above to comply with requests from authorities or legal obligations (Art. 6(1)(c) GDPR) and, if necessary, to defend the association's rights in court (Art. 6(1)(f) GDPR), for no longer than strictly necessary.

3. Do you have to provide your data?

Technical browsing data is needed to show you the website. Google Maps is optional: if you do not consent, the website works just the same. Writing to us is your free choice, but without an email address we cannot reply. The data requested for membership is necessary: without it we cannot register you as a member.

4. Who we share the data with

The data is processed by authorised members of the association. It may also be received by:

  • Aruba S.p.A., which hosts the website on servers in Italy, as data processor (Art. 28 GDPR);
  • whoever provides technical management of the website, as data processor;
  • Google, for the association's mailbox and for maps;
  • SumUp, for donations, as an independent controller;
  • advisers and professionals who assist the association with administrative, accounting and tax obligations;
  • insurance companies, for the cover of volunteer members required by law;
  • public authorities, where the law requires it.

We do not sell or hand over your data and we do not use it for advertising.

5. Transfers outside the European Union

Google, for the association's mailbox and for maps, may also process data in the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission in its decision of 10 July 2023, and also uses the standard contractual clauses approved by the Commission. You can check its participation on the official website dataprivacyframework.gov. The website and its data remain on servers in Italy.

6. How we protect the data

The website uses an encrypted connection (HTTPS). The administration area is restricted to a few people and protected by passwords and by blocks against repeated login attempts. Members' records are accessible only to those who need them to run the association.

7. Your rights

At any time you can ask us:

  • whether we process your data and for a copy of it (Art. 15 GDPR);
  • to correct or complete it (Art. 16 GDPR);
  • to erase it, where no obligation requires us to keep it (Art. 17 GDPR);
  • to restrict its processing (Art. 18 GDPR);
  • to receive it in a commonly used format, for the data you gave us (Art. 20 GDPR);
  • to stop processing it, where the legal basis is our legitimate interest (Art. 21 GDPR);
  • to withdraw your consent, without affecting what was done before the withdrawal (Art. 7 GDPR). For cookies, just use the "Cookies" button at the bottom of the page.

To exercise your rights write to associazionelucapersiani@gmail.com. We reply within one month; in complex cases this may be extended by two further months, and we will let you know if so.

If you believe that the processing of your data breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (garanteprivacy.it), with the supervisory authority of the EU country where you live, or go to court.

8. Cookies

Which cookies the website uses and how you can manage them is explained in the Cookie Policy.

9. Changes to this notice

We may update this notice, for example if we add a service to the website. The date of the last update is shown at the top of the page.