Privacy Policy

PRIVACY NOTICE

  PURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679 (GDPR) REGARDING THE PROCESSING OF PERSONAL DATA  Dear Visitor,  La Baracca Cooperativa Sociale ONLUS hereby informs you that, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), the personal data collected and/or provided by you will be processed in accordance with the provisions set out below. 

DATA CONTROLLER 

The Data Controller is:  La Baracca Cooperativa Sociale ONLUS  Via Matteotti 16  40129 Bologna (BO), Italy  Email: gabriele.marchioni@testoniragazzi.it 

PURPOSES OF OPTIONAL DATA PROCESSING 

Processing of Personal Data for Profiling Purposes 

Subject to your freely given and optional consent (Article 6(1)(a) GDPR), expressed by selecting the relevant consent checkbox on the website, La Baracca Cooperativa Sociale ONLUS will process your personal data for profiling purposes in order to send you personalised promotional communications tailored to your profile.  Your personal data may also be processed to carry out statistical analyses regarding your personal characteristics for segmentation (“clustering”) activities, including the creation of target groups for internal analyses and market and consumer trend monitoring, as well as the development of new user clusters based on similar browsing habits and interests.  Failure to provide consent for profiling activities will not affect your ability to browse the website or use any of its features, nor will it result in any adverse consequences.  You may withdraw your consent to the processing of your personal data for profiling purposes at any time, free of charge, by contacting us through the dedicated contact section of the website. 

Processing of Personal Data for Newsletter Subscription 

To subscribe to our newsletter, you are required to provide your contact details and expressly consent to the processing of your personal data for this purpose.  The newsletter will only be sent after your registration and the receipt of your consent, in accordance with Article 6(1)(a) GDPR.  Our newsletters contain information about our products, offers, promotions, and updates concerning La Baracca Cooperativa Sociale ONLUS. Accordingly, by subscribing to the newsletter, your personal data will be processed for direct marketing purposes.  Consent to receive the newsletter is entirely voluntary. If you choose not to provide your consent, you will not receive marketing communications from La Baracca Cooperativa Sociale ONLUS. However, your ability to access and use the website and its functionalities will not be affected. 

METHODS OF PROCESSING 

Personal data processing includes, by way of example, the collection, recording, organisation, storage, retrieval, consultation, use, disclosure and erasure of personal data.  Personal data are processed, for the purposes described above, in accordance with the principles set out in Article 5 of the GDPR, including lawfulness, fairness, transparency, data minimisation and accuracy.  Processing may be carried out by telephone, in paper format, electronically and by automated means.  Appropriate technical and organisational measures are implemented to ensure the security, integrity and confidentiality of personal data, preventing in particular the risks of loss, unauthorised access, unlawful processing or disclosure, in compliance with Article 32 of Regulation (EU) 2016/679.  Personal data are processed only by duly authorised personnel, in accordance with Article 29 GDPR and Article 2-quaterdecies of the Italian Privacy Code. 

NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL 

The provision of personal data for mandatory purposes does not require your explicit consent. Without such data, we will be unable to provide our services.  The provision of personal data for any additional purposes is voluntary and requires your explicit consent. Should you decide not to provide such consent, you will not receive newsletters, information materials or commercial communications relating to the services offered by the Data Controller or by third-party companies. However, you will continue to have access to our services.  We process your personal data only where there is a lawful basis for doing so. The legal bases for processing include: 

• your consent to the relevant processing activities; 

• compliance with legal obligations to which we are subject; 

• compliance with laws, regulations, contracts, agreements or other legally binding instruments; 

• research conducted by authorised research organisations, preferably using anonymised personal data; 

• the performance of a contract to which you are a party and the implementation of pre-contractual measures taken at your request; 

• the establishment, exercise or defence of legal claims in judicial, administrative or arbitration proceedings; 

• the protection of your vital interests or those of another natural person; 

• the protection of health within procedures carried out by healthcare professionals or healthcare organisations; 

• our legitimate interests, provided that such interests are not overridden by your fundamental rights and freedoms; 

• the protection and recovery of credit. 

ACCESS TO PERSONAL DATA 

Your personal data may be made accessible, solely for the purposes described above, to: 

• employees and collaborators of the Data Controller who have been duly authorised to process personal data and/or appointed as system administrators; 

• third-party companies or other entities (including, by way of example, professional firms, consultants, software providers, credit institutions, insurance companies and similar service providers) that perform outsourced activities on behalf of the Data Controller, acting as Data Processors pursuant to Article 28 of the GDPR. 

The personal data collected by this Website, either directly or through third parties, may include: 

• Tracking Tools (such as cookies and similar technologies); 

• Usage Data; 

• first name and surname; 

• email address; 

• website; 

• unique device identifiers used for advertising purposes (such as Google Advertising ID or Apple’s IDFA); 

• number of users; 

• city; 

• device information; 

• session statistics; 

• browser information; 

• responses to questionnaires; 

• clicks; 

• keypress events; 

• motion sensor events; 

• mouse movements; 

• scrolling position; 

• touch events. 

DISCLOSURE OF PERSONAL DATA 

The Data Controller may disclose your personal data to Public Authorities, Supervisory Authorities, Judicial Authorities, and any other public or private bodies where such disclosure is required or permitted by applicable law.  Your personal data will not be disclosed to the public. 

DATA RETENTION 

All personal data provided will be processed in accordance with the principles of lawfulness, fairness, relevance and proportionality, exclusively by means necessary to achieve the purposes described in this Privacy Notice, including electronic and telematic means.  Personal data will be retained for a period of six (6) years following the last contact with the data subject or until a request for erasure is received.  Where applicable, personal data may be retained for a longer period where necessary to protect the legitimate interests of the Data Controller or to comply with legal obligations.  The information systems used to manage the collected data are designed from the outset to minimise the processing of personal data in accordance with the principles of privacy by design and privacy by default. 

RIGHTS OF THE DATA SUBJECT 

As a data subject, you are entitled to exercise the rights provided for under Articles 15 et seq. and Article 77 of the GDPR, including the right to: 

Right of Access 

Obtain confirmation from the Data Controller as to whether or not personal data concerning you are being processed and, where that is the case, obtain access to your personal data together with the following information: 

• the purposes of the processing; 

• the categories of personal data concerned; 

• the recipients or categories of recipients to whom the personal data have been or will be disclosed, particularly recipients in third countries or international organisations; 

• where possible, the envisaged period for which the personal data will be stored or, where this is not possible, the criteria used to determine that period; 

• where the personal data have not been collected from you, any available information as to their source; 

• the existence of any automated decision-making, including profiling, and, at least in such cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you. 

Right to Rectification 

Obtain without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement. 

Right to Erasure (“Right to be Forgotten”) 

Obtain the erasure of personal data concerning you without undue delay where one of the following grounds applies: 

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; 

• you withdraw the consent on which the processing is based pursuant to Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for the processing; 

• you object to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to processing pursuant to Article 21(2) GDPR; 

• the personal data have been unlawfully processed; 

• the personal data must be erased in order to comply with a legal obligation under European Union or Member State law. 

Right to Restriction of Processing 

Obtain restriction of processing where one of the following applies: 

• you contest the accuracy of the personal data, for a period enabling the Data Controller to verify their accuracy; 

• the processing is unlawful and you oppose the erasure of the personal data, requesting instead that their use be restricted; 

• although the Data Controller no longer requires the personal data for the purposes of processing, they are required by you for the establishment, exercise or defence of legal claims; 

• you have objected to processing pursuant to Article 21(1) GDPR pending verification of whether the legitimate grounds of the Data Controller override your own. 

Right to Data Portability 

Receive the personal data concerning you, which you have provided to the Data Controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance, where the processing is carried out by automated means.  Where technically feasible, you also have the right to have your personal data transmitted directly from one controller to another. 

Right to Object 

Object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you where such processing is based on Article 6(1)(e) or Article 6(1)(f) GDPR, including profiling based on those provisions.  Where personal data are processed for direct marketing purposes, you have the right to object at any time to such processing, including profiling to the extent that it is related to direct marketing. 

Right Not to Be Subject to Automated Decision-Making 

Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. 

Right to Lodge a Complaint 

Lodge a complaint with the competent Supervisory Authority pursuant to Article 77 of the GDPR. 

HOW TO EXERCISE YOUR RIGHTS 

You may exercise your rights at any time by contacting the Data Controller at the following email address:  gabriele.marchioni@testoniragazzi.it 

DATA PROCESSORS AND AUTHORISED PERSONS 

The updated list of Data Processors and persons authorised to process personal data is kept at the registered office of the Data Controller and may be made available upon request. 

CHANGES TO THIS PRIVACY NOTICE 

This Privacy Notice was issued on 9 June 2026.  It may be amended from time to time, including as a result of legislative or regulatory changes concerning the protection of personal data.  Data subjects are therefore encouraged to review this Privacy Notice periodically in order to remain informed of any updates.