Privacy & cookies

1. Data controller

The data controller is Fondazione GRACE E.T.S. (Gaining Results in health through Active Citizen Engagement), registered office at Via Burlamacchi 11, 20135 Milan, Italy, tax code and VAT number 98031290152.

For any question about data processing, write to info@fondazionegrace.it or to the certified email address fondazionegrace@pec.it.

Data Protection Officer (DPO): [name and contact details, if appointed; otherwise delete this line].

2. What data we process

Browsing data. When you visit the site, the servers hosting it automatically log some technical data: IP address, date and time of the request, page requested, browser type and operating system. We use them only to serve the site and protect it from abuse, not to identify you.

Data you send us. If you email us, we process your address, your name and the information in your message.

Registration form data. If you register on the Contact page, the form prepares an email with the details you enter (first and last name, email and, if you provide them, phone, city, age group, reason for registering, organisation and message), which you send yourself to info@fondazionegrace.it. The site does not store these data: we receive them only if you send the email.

The site has no reserved areas or newsletter and uses no profiling or analytics tools.

3. Why we process them and on what legal basis

• Running the site and keeping it secure (browsing data): the Foundation’s legitimate interest in offering a working, secure website (Art. 6(1)(f) GDPR).
• Answering your requests (data you send us): steps taken at your request (Art. 6(1)(b) GDPR) or, for general enquiries, our legitimate interest in replying (Art. 6(1)(f)).
• Registering you with GRACE and contacting you (registration form data): for the app waiting list, partnership or support proposals, or to collaborate as a volunteer or researcher. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to us, and steps taken at your request (Art. 6(1)(b)).
• Complying with legal obligations or requests from authorities (Art. 6(1)(c) GDPR).

We make no decisions based solely on automated processing and do no profiling.

4. Who may receive the data

Data are processed by the Foundation’s authorised staff and by providers acting as processors (Art. 28 GDPR), in particular:

• Cloudflare, Inc., which hosts the site;
• Aruba S.p.A., which manages the info@fondazionegrace.it mailbox;
• technical or legal advisers, only when necessary.

Data may be disclosed to authorities where required by law. We never sell or share data with third parties for commercial purposes.

5. Transfers outside the European Union

Cloudflare, Inc. is based in the United States and is certified under the EU-U.S. Data Privacy Framework, which the European Commission found adequate in its decision of 10 July 2023. Transfers to Cloudflare therefore rely on that adequacy decision (Art. 45 GDPR). Aruba S.p.A., which manages email, is based in Italy.

6. How long we keep them

Registration form data are kept while you remain registered or until you withdraw consent, and in any case no longer than [e.g. 24 months from the last contact].

• Browsing data: for the period set by the hosting provider for technical logs, [state the period, e.g. 30 days], unless needed to investigate unlawful acts.
• Emails and requests: for as long as needed to handle the request and at most [e.g. 24 months] from the last contact, unless the law requires otherwise.

7. Your rights

At any time you can ask to access, rectify or erase your data, restrict processing and obtain data portability, and you can object to processing based on legitimate interest (Arts. 15–22 GDPR). Just write to info@fondazionegrace.it: we will reply within one month.

If you believe the processing infringes the GDPR, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it).

Providing data by email is optional, but without it we cannot reply.

8. Cookies

This site uses no cookies or other tracking tools, first- or third-party: no profiling cookies, no analytics, no advertising. Fonts are hosted on our own server, so visiting the site involves no requests to external services.

For this reason, in line with the Italian Data Protection Authority’s cookie guidelines (10 June 2021), the site shows no banner. If we ever introduce tools that require consent, we will update this page and ask for your consent before activating them.

You can still manage or delete cookies in your browser settings.

9. The GRACE app

The GRACE app, currently in testing, will have its own privacy notice, published before its release on the app stores.

10. Changes

This notice may be updated, for example if the site’s services or the law change. The version in force is always the one published on this page, with the date of the last update.