Privacy Notice
September 22, 2025

Notice on the processing of personal data pursuant to Article 13 of Regulation (EU) No. 2016/679

Pursuant to Article 13 of Regulation (EU) No. 2016/679, also known as the General Data Protection Regulation (hereinafter the “GDPR”), the Social Promotion Association Kora informs you that your personal data (hereinafter the “Data”) will be processed in compliance with the GDPR and all applicable regulations concerning the processing of personal data, in accordance with the following notice.

1. Data Controller. Data Protection Officer.
The Data Controller is:
Social Promotion Association Kora, Registered Office, Via Campagna 26, 06065 Passignano sul Trasimeno.
The Data Protection Officer can be contacted at: [email protected] for information regarding the processing of Data.

2. Categories of Data
The Data processed by the Controller include:
(i) personal details (first name, last name, age, gender), residence or domicile address and contact details (phone number, email address);
(ii) banking and/or payment details.

3. Purpose and legal basis of processing. Legitimate interest.
The Data will be processed for administrative purposes related to donations and legal obligations, pursuant to Article 6(1)(b) and (c) of the GDPR, as well as for the pursuit of the Controller’s legitimate interest under Article 6(1)(f) of the GDPR, with reference to:

  • carrying out all phases related to donations and/or participation in specific projects and appeals promoted by the Controller, including related activities (e.g., communications on payments, donation summaries);
  • compliance with internal administrative procedures and fulfillment of legal or regulatory obligations in force in Italy;
  • sending commercial and promotional communications relating to projects, activities, and fundraising initiatives, as well as surveys and research addressed to donors and other individuals who have previously expressed interest in the Controller’s activities, in order to raise public awareness of its non-profit projects.

In any case, the processing of your Data based on the Controller’s legitimate interest is carried out, in addition to compliance with Article 6(1)(f) of the GDPR, also in accordance with Recital 47 and Opinion No. 6/2014 of the Article 29 Data Protection Working Party, para. III.3.1.

4. Methods of processing.
Your Data are collected and recorded lawfully and fairly for the purposes indicated above and are processed also with the aid of electronic and automated tools, including through entry and organization in databases, in compliance with GDPR provisions on security measures, and in any case in such a way as to ensure the security and confidentiality of the Data.

5. Recipients or categories of recipients.
The Data may be made accessible to, disclosed to, or communicated to the following parties, who will be appointed by the Controller, as appropriate, as data processors—whose list is available at the Controller’s premises—or authorized persons:

  • non-profit organizations belonging to the group of which the Controller is part, employees and/or collaborators of the Controller in any capacity;
  • public or private entities, natural or legal persons, used by the Controller to carry out activities instrumental to achieving the purposes mentioned above or to whom the Controller is required to communicate the Data by virtue of legal or contractual obligations.

In any case, the Data will not be disclosed.

6. Transfer of Data abroad
For processing activities related to the management of the donor database, the Data may be transferred to third countries (outside the EU). In such cases, the transfer will be carried out by adopting the contractual clauses prescribed by the European Commission’s decision of February 5, 2010, as well as in a manner that provides appropriate safeguards pursuant to Articles 46, 47, or 49 of the GDPR.

7. Retention period.
The Data will be retained for a period not exceeding 10 (ten) years for administrative purposes and, in any case, for the time strictly necessary to pursue the Controller’s legitimate interest.

8. Rights of access, erasure, restriction, and portability.
The Controller informs you that you are entitled to the rights set out in Articles 15 to 20 of the GDPR. By way of example, by sending a specific request to [email protected], you may:

  • obtain confirmation as to whether or not personal data concerning you are being processed;
  • if processing is ongoing, obtain access to the data and information relating to the processing, as well as request a copy of the data;
  • obtain the rectification of inaccurate data and the completion of incomplete personal data;
  • obtain, where one of the conditions set out in Article 17 of the GDPR applies, the erasure of your Data;
  • obtain, in the cases provided for by Article 18 of the GDPR, the restriction of processing of your Data;
  • receive your Data in a structured, commonly used, and machine-readable format and request their transmission to another controller, where technically feasible.

9. Right to object.
Pursuant to Article 21 of the GDPR, you also have the right to object at any time to the processing of your Data carried out for the purposes of the Controller’s legitimate interest by writing to [email protected]. In the event of objection, the Data will no longer be processed unless there are legitimate grounds for processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

10. Right to lodge a complaint with the Supervisory Authority.
The Controller also informs you that you may lodge a complaint with the Data Protection Authority if you believe that your rights under the GDPR or any other applicable regulation have been violated, according to the procedures indicated on the Authority’s website: www.garanteprivacy.it.