PRIVACY NOTICE

Information on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679

Fondazione F.I.C.O. (hereinafter the “Controller” or the “Foundation”), with registered office in Milan, Corso di Porta Vittoria no. 17, Fiscal Code 98020980151, e-mail amministrazione@ficofondazione.org, tel. 030.3775080, intends to inform users visiting the institutional website www.ficofondazione.org and ficofondazione.org  (hereinafter the “Website”) of the policy adopted with regard to the protection of personal data processed as a result of users’ browsing on the Website and/or the completion of the form necessary to provide the data required to make any donations in favour of the Foundation and/or to contact the Foundation (hereinafter collectively the “Data”) in its capacity of Data Controller. In particular, the Foundation intends to provide the information provided for by Articles 13 et seq. of Regulation (EU) 2016/679, General Data Protection Regulation (the “Regulation”), regarding the processing of Data collected through the Website.

For the processing of technical cookies connected with browsing on the Website, reference is made to the specific cookie policy of the Foundation, available on the Website.

1. Types of personal data processed and categories of data subjects

The Foundation shall process the following Data:

• access and browsing data on the Website: information relating to the manner in which the user uses the Website, the user’s IP address, as well as the information collected through technical cookies and CAPTCHA codes to validate the user, as better specified in the Cookie Policy;
• personal identification data, contact details and fiscal code of the user, provided to the Foundation by the user themselves through the completion of the forms available on the Website.

The Data shall be processed predominantly by electronic means. All information collected through the Website will be transmitted via a secure connection, so as to prevent access thereto by external parties.

The Foundation clarifies that under no circumstances it will process data relating to payments, namely data relating to credit cards and/or current accounts, which shall be managed, as autonomous Data Controllers, directly by the service provider and by the banking institution selected to make donations in favour of the Foundation.

• Purposes and legal bases of the processing

The Data indicated in paragraph a) above shall be processed for the following purposes:

1. management, maintenance and security of the Website infrastructure and of the information systems; validation of users in order to differentiate between human visitors to the Website and potentially harmful robotic agents;
2. fulfilment of the obligations incumbent upon the Foundation provided for by laws, regulations, provisions/requests of Authorities and/or supervisory and regulatory bodies;
3. management of any disputes and legal defence;
4. communication and promotion activities relating to events and initiatives organised by the Foundation, where the user has given their consent;
5. sending receipts to donors for charitable donations, for the purposes of tax relief;
6. proper management of payments, which shall be made through third-party providers;
7. managing requests for collaboration with and/or contact of the Foundation.

The legal basis for the processing of the Data for the purposes referred to in points (1) and (3) is the legitimate interest of the Controller in the management, maintenance and security of the Website and of the information systems, as well as in the protection of its rights in the context of any disputes, pursuant to Article 6, paragraph 1, letter f) of the Regulation.

The legal basis for the processing of the Data for the purposes referred to in points (2), (5) and (6) is the need to comply with the legal obligations to which the Controller is subject, pursuant to Article 6, paragraph 1, letter c) of the Regulation.

The legal basis for the processing of the Data for the purpose referred to in point (4) is the express consent of the data subject, pursuant to Article 6, paragraph 1, letter a) of the Regulation.

The legal basis for the processing of the Data for the purpose referred to in point (7) is the need to follow up on a request from the data subject, pursuant to Article 6, paragraph 1, letter b) of the Regulation.

• Recipients and transfer of data outside the EU

The Data processed shall not be disseminated or communicated to third parties outside the specific statutory provisions. The Data shall be processed by the Foundation’s staff and/or collaborators, duly authorised and appointed to process the Data by means of a specific appointment deed, pursuant to and for the purposes of Article 29 of the Regulation.

The Data processed may also be transmitted to external parties operating on behalf of the Foundation in the capacity of Data Processors pursuant to Article 28 of the Regulation, with whom the Foundation has entered into a specific appointment agreement.

A complete list of the Data Processors appointed by the Foundation may be requested using the Controller’s contact details indicated above.

The Data shall under no circumstances be transferred to countries outside the EU.

• Retention period

The Data shall be retained for the period strictly necessary to pursue the purposes indicated above, without prejudice to their retention in compliance with legal obligations for administrative-accounting purposes or for the exercise of rights in legal proceedings and, where applicable, until the withdrawal of consent by the data subject.

• Rights of the data subjects

Each data subject may, at any time, by means of a simple communication to be sent to the Foundation using the Controller’s contact details indicated above, exercise the rights referred to in Articles 15 to 22 of the Regulation, including the right to know which Data are processed by the Foundation, by what means and for what purposes they are used.

The data subject may therefore request from the Data Controller access to the Data and the rectification or erasure thereof, or the restriction of the processing of the Data concerning them, or object to their processing, where this is not necessary pursuant to law, by sending an e-mail to amministrazione@ficofondazione.org.

The data subject may also, at any time, withdraw their consent to the sending by the Foundation of communications concerning the initiatives and activities of the Foundation itself and/or promoted by the latter.

• Complaint to the competent Supervisory Authority for the protection of personal data

Where the data subject considers that the processing of the Data carried out by the Controller is in breach of the provisions of the Regulation, the data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it).

Last updated: May 2026

Fondazione F.I.C.O.