Asino Foundation for Oncological Neurosurgery

Privacy Policy

Fondazione Asino per la Neurochirurgia Oncologica ETS

Privacy Policy pursuant to Article 13 of Regulation (EU) 2016/679

1. Data Controller

This privacy notice is provided to you, pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”), by Fondazione Asino per la Neurochirurgia Oncologica ETS (registered with the Italian National Register of the Third Sector pursuant to Article 45 of Legislative Decree No. 117 of 3 July 2017, rep. no. 33271, in section “g - Other Third Sector Entities” under Article 46(1) of Legislative Decree No. 117 of 3 July 2017), with registered office at Via Bronzetti No. 19, 20129 Milan (MI), Tax Code and VAT No. 97830750150, as data controller (“Foundation” or “Data Controller”), which can be contacted at the following e-mail address: privacy@fondazioneasino.it.

2. General information about this notice

By means of this notice, the Foundation intends to provide all data subjects with the necessary information on the processing of personal data for which it acts as controller, in compliance with the transparency obligations laid down by the applicable data protection legislation.

Section 3 (“Information on processing”) describes in detail the processing activities carried out, arranged by category of data subjects.

3. Information on processing

USERS OF THE WEBSITE https://fondazioneasino.it

Further information on the Cookie Policy is available at https://fondazioneasino.it/it
Purpose of processing	Legal basis of processing	Nature of provision of data	Recipients of personal data	Retention of personal data
Browsing the Website	Article 6(1)(f) GDPR – Data Controller’s legitimate interest in ensuring the usability of the website	Mandatory	IT and hosting providers	6 months
Sending communications concerning Fondazione Asino initiatives	Article 6(1)(a) GDPR – Consent of the data subject	Optional	IT providers, consultants	24 months (unless consent is withdrawn)
Compliance with legal obligations	Article 6(1)(c) GDPR - Compliance with legal obligations (Article 2220 of the Italian Civil Code)	Required by law	Authorities, legal and tax advisers	The period expressly provided for by law
Website maintenance	Article 6(1)(f) GDPR – Data Controller’s legitimate interest in maintaining the website	Necessary to ensure the security and proper functioning of the website	IT consultants/maintenance companies	For the time strictly necessary to carry out maintenance activities
Establishment, exercise or defence of legal claims	Article 6(1)(f) GDPR – Data Controller’s legitimate interest in asserting its rights in judicial proceedings	Necessary to protect the Data Controller’s rights	Consultants/lawyers and judicial/administrative authorities	For the entire duration of judicial or out-of-court proceedings, including any pre-litigation phase

PARTICIPANTS IN THE FOUNDATION’S EVENTS

Purpose of processing	Legal basis of processing	Nature of provision of data	Recipients of personal data	Retention of personal data
Management of participation	Article 6(1)(f) GDPR – Data Controller’s legitimate interest in managing registrations and participation in the Foundation’s events	Necessary for participation in the events. Failure to provide data may prevent or limit participation	Any companies appointed to manage specific operational activities related to the event (such as, by way of example and without limitation: catering, accreditation management, etc.)	Until the end of the event
Management of food intolerances	Article 6(1)(f) GDPR – Data Controller’s legitimate interest in managing registrations and participation in the Foundation’s events Article 9(2)(a) GDPR – Explicit consent given by the data subject	Optional – however, failure to provide data may make it impossible for the Foundation to arrange ad hoc meals	Any companies appointed to manage specific operational activities related to the event (such as, by way of example and without limitation: catering, etc.)	Until the end of the event
Communications during and after the event	Article 6(1)(a) GDPR – Consent of the data subject	Optional. If data are not provided, the data subject will not appear in the photographic and video material of the event	Photographers/videomakers, any other parties appointed to manage the material collected	6 months from the event (unless consent is withdrawn)
Sending communications concerning Fondazione Asino initiatives	Article 6(1)(a) GDPR – Consent of the data subject	Optional	IT providers, consultants	24 months (unless consent is withdrawn)
Establishment, exercise or defence of legal claims	Article 6(1)(f) GDPR – Data Controller’s legitimate interest in asserting its rights in judicial proceedings	Necessary to protect the Data Controller’s rights	Consultants/lawyers and judicial/administrative authorities	For the entire duration of judicial or out-of-court proceedings, including any pre-litigation phase

DONORS

Purpose of processing	Legal basis of processing	Nature of provision of data	Recipients of personal data	Retention of personal data
Administrative, accounting and tax obligations relating to donations provided for by the applicable legislation	Article 6(1)(c) GDPR - Compliance with legal obligations (Article 83 of Legislative Decree No. 117/2017, and MEF Decree, paragraphs 1 and 2, of 1 March 2024)	Required by law.	Consultants and competent authorities (Italian Revenue Agency)	10 years pursuant to Article 2220 of the Italian Civil Code
Sending communications concerning Fondazione Asino initiatives	Article 6(1)(a) GDPR – Consent of the data subject	Optional	IT providers, consultants	24 months (unless consent is withdrawn)
Establishment, exercise or defence of legal claims	Article 6(1)(f) GDPR – Data Controller’s legitimate interest in asserting its rights in judicial proceedings	Necessary to protect the Data Controller’s rights	Consultants/lawyers and judicial/administrative authorities	For the entire duration of judicial or out-of-court proceedings, including any pre-litigation phase

CANDIDATES AND AWARDEES OF PROJECTS FUNDED BY THE FOUNDATION

Purpose of processing	Legal basis of processing	Nature of provision of data	Recipients of personal data	Retention of personal data
Management of the relationship, selection process and grant award	Article 6(1)(b) GDPR - Performance of a contract and pre-contractual measures	Necessary to manage the selection process and award the grant. Failure to provide data will prevent participation	The Foundation’s consultants and third-party partners (such as, for example, the medical or research center where the training or research program is carried out)	Identification and payment data of the funding awardee: 10 years pursuant to Article 2220 of the Italian Civil Code; CV-related data: 12 months from conclusion of the project
Communication and marketing	Article 6(1)(a) GDPR – Consent of the data subject	Optional. If data are not provided, the Foundation will not be able to promote the positive outcome of the selection on its communication channels	Foundation’s marketing companies/communications consultants	24 months (unless consent is withdrawn)
Communication of data to the Foundation’s partners	Article 6(1)(a) GDPR – Consent of the data subject	Optional. If data are not provided, the data will not be communicated to the Foundation’s partners	The Foundation’s partners (for example, companies and/or other non-profit entities co-funding the project)	24 months (unless consent is withdrawn)
Establishment, exercise or defence of legal claims	Article 6(1)(f) GDPR – Data Controller’s legitimate interest in asserting its rights in judicial proceedings	Necessary to protect the Controller’s rights	Consultants/lawyers and judicial/administrative authorities	For the entire duration of judicial or out-of-court proceedings, including any pre-litigation phase

VOLUNTEERS AND COLLABORATORS

Purpose of processing	Legal basis of processing	Nature of provision of data	Recipients of personal data	Retention of personal data
Performance and management of the relationship with collaborators	Article 6(1)(b) GDPR - Performance of contractual acts and/or agreements	Necessary for establishing and managing the relationship	Consultants and authorities	10 years pursuant to Article 2220 of the Italian Civil Code
Performance and management of the relationship with volunteers	Article 6(1)(c) GDPR - Compliance with legal obligations (Articles 17-18 of Legislative Decree No. 117 of 3 July 2017); Article 6(1)(f) GDPR – Data Controller’s legitimate organisational interest in managing the volunteer relationship	Necessary for establishing and managing the relationship	Consultants and authorities	Occasional volunteers: until the event following the one for which the volunteer has performed his/her services and, in any case, for a maximum period of 12 months from the event; Non-occasional volunteers: 5 years from the termination of the relationship, without prejudice to any longer period necessary for the establishment, exercise or defence of a legal claim
Communications during and/or after the event	Article 6(1)(a) GDPR – Consent of the data subject	Optional. If data are not provided, the data subject will not appear in the photographic and video material of the event	Photographers/videomakers, any other parties appointed to manage the material collected	6 months from the event (unless consent is withdrawn)
Keeping contact details for future events	Article 6(1)(a) GDPR – Consent of the data subject	Optional	The Foundation’s consultants and collaborators	12 months from termination of the relationship (unless consent is withdrawn)
Establishment, exercise or defence of legal claims	Article 6(1)(f) GDPR – Data Controller’s legitimate interest in asserting its rights in judicial proceedings	Necessary to protect the Controller’s rights	Competent authorities, legal and tax advisers	For the entire duration of judicial or out-of-court proceedings, including any pre-litigation phase

SUPPLIERS

Purpose of processing	Legal basis of processing	Nature of provision of data	Recipients of personal data	Retention of personal data
Performance of the supply contract (execution, management of payments and business relationships)	Article 6(1)(b) GDPR - Performance of a contract	Necessary for the performance of the supply contract. Failure to provide data will prevent the performance of the contract.	Consultants, competent authorities	10 years pursuant to Article 2220 of the Italian Civil Code
Compliance with legal obligations	Article 6(1)(c) GDPR - Compliance with legal obligations (Article 2220 of the Italian Civil Code)	Required by law	Consultants, competent authorities	10 years pursuant to Article 2220 of the Italian Civil Code
Establishment, exercise or defence of legal claims	Article 6(1)(f) GDPR – Data Controller’s legitimate interest in asserting its rights in judicial proceedings	Necessary to protect the Data Controller’s rights	Consultants/lawyers and judicial/administrative authorities	For the entire duration of judicial or out-of-court proceedings, including any pre-litigation phase

4. Transfer of data outside the European Union or to international organizations

The personal data are not transferred to countries outside the European Economic Area (“EEA”) or to international organizations, since the personal data processed by the Foundation are stored on servers located within the EEA.

5. Automated decision-making

The Foundation does not carry out processing that involves automated decision-making, including profiling, within the meaning of Article 22 GDPR.

6. Data subject rights

The data subject may exercise his or her rights at any time by contacting the Data Controller and, in particular, the right to:

access his or her personal data, obtaining information on the processing, the categories of personal data processed, the recipients or categories of recipients to whom the data have been or will be disclosed, the envisaged retention period, and the existence of automated decision-making (Article 15 GDPR);

obtain without undue delay the rectification of inaccurate personal data concerning him or her (Article 16 GDPR);

obtain, in the cases provided for by law, the erasure of his or her personal data (Article 17 GDPR);

obtain restriction of processing, in the cases provided for by Article 18 GDPR;

withdraw any consent given at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3) GDPR);

object at any time to processing based on the Data Controller’s legitimate interest, on grounds relating to his or her particular situation (Article 21 GDPR);

request the portability of the data that the data subject has provided to the Data Controller, i.e. to receive such data in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance (Article 20 GDPR).

To exercise these rights, the data subject may contact the Data Controller using the contact details indicated in Section 1 of this notice.

The data subject shall in any case retain the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it), pursuant to Article 77 GDPR, if he or she considers that the processing of his or her personal data is carried out in breach of the applicable legislation, and to seek a judicial remedy pursuant to Article 79 GDPR.