Privacy Policy

• October 18, 2026

Privacy Notice on the Processing of Personal Data pursuant to Article 13 of Regulation (EU) 2016/679

Pursuant to Article 13 of Regulation (EU) 2016/679, also known as the General Data Protection Regulation (hereinafter the “GDPR”), Associazione di Promozione Sociale Joint informs you that your personal data (hereinafter the “Data”) will be processed in accordance with the GDPR and all applicable legislation on the processing of personal data, as set out in the following notice.

1. Data Controller. Data Protection Officer.
The Data Controller is Associazione di promozione sociale Kora, Registered Office, Via Campagna 26, 06065 Passignano sul Trasimeno, Italy. The Data Protection Officer can be contacted at [email protected] for information on the processing of Data.

2. Categories of Data
The Data processed by the Controller include: (i) personal details (first name, surname, age, gender), address of residence or domicile, and contact details (telephone, email address); (ii) bank and/or payment details.

3. Purposes and legal basis of processing. Legitimate interest.
The Data will be processed for administrative purposes related to donations and to comply with legal obligations, pursuant to Article 6(1)(b) and (c) of the GDPR, as well as to pursue the legitimate interest of the Controller, pursuant to Article 6(1)(f) of the GDPR, with regard to:

• carrying out all stages connected with the donation and/or participation in specific projects and appeals promoted by the Controller, including ancillary activities (e.g. communications about payments, donation summaries);
• compliance with internal administrative procedures and with legal obligations or regulations in force in Italy;
• sending commercial and promotional communications relating to projects, activities and fundraising initiatives, as well as surveys and research reserved for donors and other individuals who have previously expressed interest in the Controller’s activities, in order to raise public awareness of its non-profit projects.

In any case, the processing of your Data on the basis of the Controller’s legitimate interest is carried out in compliance with Article 6(1)(f) of the GDPR, as well as in accordance with Recital 47 and Opinion 6/2014 of the Article 29 Data Protection Working Party, para. III.3.1.

4. Methods of processing.
Your Data are collected and recorded lawfully and fairly for the purposes indicated above and are also processed with the aid of electronic and automated tools, including by entering and organising them in databases, in accordance with the GDPR provisions on security measures and, in any case, in such a way as to guarantee the security and confidentiality of the Data.

5. Recipients or categories of recipients.
The Data may be made accessible, disclosed or communicated to the following parties, who will be appointed by the Controller, as the case may be, as processors (a list of whom is available at the Controller’s office) or as persons authorised to process the Data:

• non-profit organisations of the group to which the Controller belongs, and employees and/or collaborators of the Controller in any capacity;
• public or private entities, natural or legal persons, whom the Controller uses to carry out activities ancillary to the purposes above, or to whom the Controller is required to disclose the Data under legal or contractual obligations.

In any case, the Data will not be disseminated.

6. Transfer of Data abroad
For processing operations ancillary to the management of the donor database, the Data may be transferred to third countries (outside the EU). In such cases, the transfer will take place using the contractual clauses set out in the European Commission Decision of 5 February 2010, and in such a way as to provide appropriate and suitable safeguards pursuant to Articles 46, 47 or 49 of the GDPR.

7. Retention period.
The Data will be retained for a period not exceeding 10 (ten) years for administrative purposes and, in any case, for no longer than strictly necessary to pursue the Controller’s legitimate interest.

8. Rights of access, erasure, restriction and portability.
The Controller informs you that you have the rights set out in Articles 15 to 20 of the GDPR. For example, by sending a specific request to [email protected], you may:

• obtain confirmation as to whether or not personal data concerning you are being processed;
• where processing is taking place, obtain access to the data and to information about the processing, and request a copy of the data;
• obtain the rectification of inaccurate data and the completion of incomplete personal data;
• obtain, where one of the conditions set out in Article 17 of the GDPR applies, the erasure of the Data concerning you;
• obtain, in the cases provided for by Article 18 of the GDPR, the restriction of the processing of the Data concerning you;
• receive the Data concerning you in a structured, commonly used and machine-readable format, and request their transmission to another controller, where technically feasible.

9. Right to object.
Pursuant to Article 21 of the GDPR, you also have the right to object at any time to the processing of your Data carried out to pursue the Controller’s legitimate interest, by writing to [email protected]. If you object, your Data will no longer be processed, unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing is needed for the establishment, exercise or defence of legal claims.

10. Right to lodge a complaint with the Supervisory Authority.
The Controller also informs you that you may lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) if you believe that your rights under the GDPR or any other applicable legislation have been infringed, following the procedures set out on the Authority’s website: www.garanteprivacy.it.