Privacy policy

Why this notice

This notice is given under art. 13 of Regulation (EU) 2016/679 (the “GDPR”) and Legislative Decree 196 of 30 June 2003, as amended by Legislative Decree 101 of 10 August 2018, to anyone consulting the donarteassociation.org website. It describes what personal data the site collects, why, how long it is kept and what rights you can exercise. It covers this site only: it does not extend to third-party sites reachable through links in our pages, which have notices of their own.

Data controller

The data controller is DONARTE Association for Organ Donation and Transplantation ETS, registered office at Viale Regina Margherita 59, 98121 Messina (ME), Italy, tax code 97143880835, email info@donarteassociation.org. The controller has not designated a Data Protection Officer, as the conditions in art. 37(1) GDPR are not met: the association is not a public authority, its core activities do not consist of regular and systematic monitoring of data subjects on a large scale, and it does not process special categories of data on a large scale. Any question about the processing of personal data can be sent to the address above.

What data we process

The site processes two categories of data. 1) Browsing data. The systems and software that run this site acquire, in the course of their normal operation, certain data whose transmission is inherent in the use of internet communication protocols: IP address, date and time of the request, address of the resource requested, method used, response status code and size, browser type and operating system, and referring page. This data is not collected in order to identify visitors, but through processing and association with data held by third parties it could allow identification. 2) Data you provide through the contact form. Which fields appear depends on why you are writing:

• A question: full name, email, subject, message.
• Join or volunteer: full name, email, phone (optional), city (optional), what you have in mind, what you can offer (optional), message.
• Support the congress: organisation or company, full name, role (optional), email, phone (optional), message.
• Each submission also carries: the language the form was read in, the label of the enquiry type chosen, the exact wording of the consent statement shown, and the date and time of receipt. These allow us to reply in the right language and to keep a record of what was agreed to.

Health data

This association works in organ donation and transplantation, and people who write to us sometimes describe their own clinical situation or a relative's. We do not ask for health data, and we expressly ask you not to enter it in the message field, whether about yourself or anyone else. If, despite this warning, you nonetheless choose to provide it, that data falls within the special categories under art. 9 GDPR and is processed on the basis of the explicit consent expressed by the deliberate act of writing and sending it in a communication you initiated (art. 9(2)(a)), for the sole purpose of reading and answering your message. It is deleted or redacted as soon as the enquiry is closed and in any event within 30 days. For clinical or personal matters it is better to write directly to info@donarteassociation.org, or to speak to your doctor or your transplant centre: this association does not provide medical advice.

Purposes and legal bases

Each processing operation has a specific purpose and its own legal basis:

• Answering enquiries sent through the contact form — legal basis: the consent given by ticking the box before sending (art. 6(1)(a) GDPR). Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Health data that a message happens to contain — legal basis: explicit consent (art. 9(2)(a) GDPR), as described in the section above.
• Keeping the site running, secure and available, and detecting abuse — legal basis: the controller's legitimate interest in providing a working and protected service (art. 6(1)(f) GDPR).
• Complying with legal obligations to which the controller is subject — legal basis: art. 6(1)(c) GDPR.

Whether providing data is required

No data has to be provided in order to read the site, which can be read in full without communicating anything. For the contact form, the fields marked as required are necessary in order to reply: without a name, an email address and a message the enquiry cannot be answered. The optional fields only help us answer better and may be left blank. Declining to provide the required data means only that you will not receive a reply, and has no other consequence.

How we process and protect the data

Data is processed by electronic means, for no longer than the stated purposes require, applying technical and organisational measures appropriate under art. 32 GDPR. The site is served only over an encrypted connection (HTTPS). A form submission is transmitted to our own endpoint, which stores nothing: the message is composed, handed to the mail provider and forgotten. The only copy of an enquiry is the one that arrives in the association's mailbox. Access to that mailbox is restricted to persons authorised to process data under art. 2-quaterdecies of Legislative Decree 196/2003, instructed in writing.

Who receives the data

Data is not disseminated, sold, or transferred to third parties for commercial or marketing purposes. It may be processed on our behalf and on our instructions by the suppliers that make the site work, appointed as processors under art. 28 GDPR:

• Vercel Inc. — website hosting and execution of the function that receives the form. It processes browsing data and, in transit, the content of a submission.
• Resend — delivery of the email message to the association, configured to send from the European region (eu-west-1).
• Google, which hosts the info@donarteassociation.org mailbox through Google Workspace and the donarteassociation@gmail.com mailbox through Gmail, where the message is stored once received.
• Authorities and supervisory bodies, where disclosure is required by law or necessary to establish or defend a legal claim.

Resources loaded from third parties

None. The pages of this site load no resource from any third-party server: the typefaces are hosted on the site's own domain, and there are no embedded videos, maps, social buttons, captchas or advertising scripts. Until 24 August 2026 the typefaces were requested from Google Fonts, which sent every visitor's IP address and browser type to Google's servers when a page opened, before any interaction. They are now served from this domain and that no longer happens. This is recorded here rather than simply removed, because anyone who visited the site before that date is entitled to know that it did.

Transfers outside the EU

Some of the suppliers named above are established in the United States, so the processing may involve a transfer of personal data outside the European Economic Area. Such transfers are made on the basis of the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, incorporated into the data processing agreements entered into with those suppliers, under art. 46(2)(c) GDPR, together with the supplementary measures those agreements provide for. A copy of the safeguards in place can be requested by writing to info@donarteassociation.org.

How long we keep the data

Data is kept for as long as the purpose it was collected for requires, and is then deleted:

• General enquiries: 12 months from the last exchange of messages.
• Membership or volunteering approaches that do not proceed: 24 months.
• Sponsorship approaches: for the duration of the discussion and, if it results in a relationship, for the accounting and tax retention periods required by law.
• Health data a message happens to contain: deleted or redacted within 30 days of the enquiry being closed.
• Browsing data: for the technically necessary period only, according to the hosting provider's settings, except where the judicial authorities are investigating an offence.

Cookies and other tracking tools

This site sets no profiling cookies, uses no analytics, carries no advertising and employs no tracking or fingerprinting technique. It sets no cookies at all, not even technical ones, and stores nothing on your device through localStorage or similar technologies. The language of a page is determined by the address you are reading (/it or /en) and is not recorded anywhere. For that reason, in line with the Italian Data Protection Authority's Guidelines on cookies and other tracking tools of 10 June 2021, no banner is shown and no consent is requested: there is nothing for which consent would be due. Should different tools be introduced in future, this notice will be updated and, where required, prior consent will be sought.

No automated decision-making

The data is not used for automated decision-making, including profiling, within the meaning of art. 22(1) and (4) GDPR. Every message is read and every reply is written by a person.

Minors

The site is not directed at children under fourteen and does not knowingly collect their data. A parent or guardian who believes a child has submitted data through the form can write to info@donarteassociation.org and we will delete it.

Your rights

You may exercise the rights set out in arts. 15-22 GDPR at any time by writing to info@donarteassociation.org. There is no charge, and we respond without undue delay and in any event within one month. Each right is listed with its actual scope, because not all of them apply to every processing operation:

• Access (art. 15): to obtain confirmation that processing is taking place and a copy of the data.
• Rectification (art. 16): to correct inaccurate data or complete incomplete data.
• Erasure (art. 17): to have data deleted in the cases provided for, including withdrawal of consent where consent is the basis.
• Restriction (art. 18): to have processing suspended, for instance while the accuracy of the data is checked.
• Portability (art. 20): to receive the data in a structured, machine-readable format. This applies only to processing based on consent or a contract and carried out by automated means: it therefore covers data sent through the form, not browsing data.
• Withdrawal of consent (art. 7(3)): may be withdrawn at any time for processing based on consent, without affecting the lawfulness of what was done before.

Right to object

Under art. 21 GDPR you may object at any time, on grounds relating to your particular situation, to processing based on the controller's legitimate interest, identified in the “Purposes and legal bases” section. Where you do, the controller will stop processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or that the processing is needed to establish, exercise or defend a legal claim. This information is given separately and prominently, as art. 21(4) GDPR requires. To object, simply write to info@donarteassociation.org.

Complaint to the supervisory authority

If you consider that the processing of your personal data infringes the applicable rules, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) under art. 77 GDPR, or to bring proceedings before the competent courts under art. 79. Garante per la protezione dei dati personali — Piazza Venezia 11, 00187 Rome, Italy — telephone +39 06 696771 — email garante@gpdp.it — certified email protocollo@pec.gpdp.it.

• Website of the Italian Data Protection Authority

Amendments, version and language

This notice may be updated to reflect changes in the law or in the site. The version published on this page is always the one in force, and carries the date of its last update at the top. Substantive updates are marked by a change of version number. The notice is published in Italian and in English. In the event of any discrepancy between the two, the Italian text prevails, being the version drafted under the applicable law.