Legambiente and the protection of Privacy

We hereby inform you that, pursuant to Articles 13 and 14 of EU Regulation 679/2016 (hereinafter ‘GDPR’), your data provided to us through the use of the website will be processed as follows, in accordance with the principles of correctness, lawfulness, transparency and protection of your privacy and your rights.

Contact information

For matters related to the processing of personal data or to exercise your rights, you may contact:

Legambiente Onlus (Via Salaria n.403, 00199 Roma (ROMA)- P. IVA: 02143941009) as Data Controller, in the person of its legal representative pro tempore, addressing any kind of request to the following e-mail address: privacy@legambiente.it;
Tecnologie e Sistemi Srl (Corso Promessi Sposi n.23, 23900 Lecco (LC); P.IVA 03347650131), in the person of Dr. Mirco Giorgi (e-mail: mirco.giorgi@tssrl.it), as Data Protection Officer (DPO) pursuant to art.37 of the GDPR.
Purposes of the treatment

Your data will be processed for the following purposes:

to monitor the technical functioning and performance of the web pages;
to obtain statistical information on the use of the services (number of visitors per hour or per day, etc.)
to adhere to the initiative promoted by Legambiente;
to send communications related to further initiatives promoted by Legambiente of various nature, as well as to the activities offered by it.
Legal basis of the treatment and obligatory or optional nature of the conferment of the data

The Owner treats your anonymous navigation data in order to monitor the technical functioning and performance of the web page, to understand how to improve the services and make them evolve. These data are necessary to ensure the use of the web page.

The compilation of the online format on the web page, involves the acquisition of your data (name, surname and other fields including e-mail, telephone, postal address and any other data – if inserted as optional), the conferment of which is necessary to join the initiative, as well as useful for the realization of the same.

The optional, explicit and voluntary sending of messages to contact addresses, involve the acquisition of contact data of the sender, necessary to respond, and all personal data included in the communications.

For the purpose indicated in point 4) your explicit consent is required (through the appropriate flag); the conferment of data for this purpose is optional, since your refusal to provide them has no other consequence than the impossibility for the owner to make you participate in the activities we promote and offer.

Treatment modalities

Your personal data may be processed in the following ways:

entrusting third parties with processing operations;
collection of data via computer or telematics;
temporary processing aimed at a rapid aggregation of data or their transformation into anonymous form;
processing by means of electronic computers;
manual processing by means of paper archives.
All processing is carried out in compliance with the modalities set out in articles 6 and 32 of the GDPR and through the adoption of appropriate security measures.

Sharing, Communication and Dissemination of Data

In addition to the Data Controller, your data will only be processed by personnel expressly authorized by the Data Controller, who have been given adequate instructions and appointment as data processors.

Your data may be communicated to external parties (including all the duly appointed Data Processors, whose updated list can always be requested from the Data Controller) for activities strictly connected and instrumental to the operation of the service, such as the management of the computer system (technical and IT service providers, hosting providers, etc.).

No personal data is disclosed.

Transfer of personal data to third countries or international organizations

Your data will not be transferred to third countries outside the EU or to an international organization.

However, it is possible that some entities acting on behalf of the Data Controller have their databases in countries outside the European Economic Area (EEA); in this case it is ensured that they take appropriate contractual measures to ensure that the data is adequately protected, including through agreements based on the standard contractual clauses adopted by the European Commission.

Data categories and retention period

The data processed may be:

(a) Navigation data
The computer systems and software procedures used to operate these web pages acquire, during normal operation and only for the duration of the connection, some data that are then transmitted implicitly in the use of Internet communication protocols.

This information is not collected with the aim of associating it with users but, by its very nature, could, through processing and association with data held by third parties, allow them to be identified.

b) Cookies
This site uses cookies or markers, which are technically packets of information sent by a web server to the user’s browser and stored on the user’s device (personal computer, tablet, cell phone, etc.) and automatically sent back to the server each time the page is accessed. To find out about the types and purposes of the cookies used, you can consult the relevant Cookie Policy.

c) Personal data provided in the compilation of the form
The data you entered in the form will be kept for the time necessary to promote the initiative as well as until you revoke your consent if you have given it by ticking the appropriate box; in the latter case your data will no longer be kept for the purpose referred to in paragraph 4).

d) Data provided voluntarily by users/visitors
If you voluntarily decide to send us your personal data (for example: name, surname, e-mail address) for any requests/information, the Data Controller will process these data only to respond to your request, in accordance with this policy. The data will be kept for the time necessary to provide the requested service and to handle any disputes.

Rights of the interested party

Interested parties may exercise certain rights with reference to the Data processed by the Data Controller. In particular, you have the right to

access your Data: you have the right to obtain information on the Data processed by the Data Controller, on certain aspects of the processing and to receive a copy of the Data processed.
verify and ask for rectification: you can verify the correctness of your Data and ask for updating or correction.
obtain the cancellation or removal of your Personal Data: when certain conditions are met, you may request the cancellation of your Data by the Data Controller.
revoke consent at any time: you may revoke the consent to the processing of your Personal Data previously expressed.
oppose the processing of your Data: you may oppose the processing of your Data when it is done on a legal basis other than consent.
obtain the limitation of processing: when certain conditions are met, you may request the limitation of the processing of your Data.
Obtain data portability: You have the right to receive your Data in a structured, commonly used and machine-readable format and, where technically feasible, to obtain its unimpeded transfer to another data controller. This provision is applicable when the Data is processed by automated means and the processing is based on consent, a contract to which you are a party or contractual measures related thereto.
Propose a complaint: you may lodge a complaint with the competent data protection supervisory authority or take legal action.

Details of the right to object

Where Personal Data is processed in the public interest, in the exercise of official authority vested in the Controller or in pursuit of a legitimate interest of the Controller, you have the right to object to the processing on grounds relating to your particular situation.

Please note that if your Data were processed for direct marketing purposes, you may object to the processing without providing any reasons.

How to exercise your rights

In order to exercise your rights, you may address a request to the contact details of the Data Controller indicated in this document. Requests are filed free of charge and processed by the Controller as soon as possible, in any case within one month.