Privacy Policy

Collection of Collections Associazione di Promozione Sociale (COC APS)
INFORMATION ON THE PROCESSING OF PERSONAL DATA
of the users visiting the website https://www.collectionofcollections.org/ Pursuant to Article 13 of the EU Regulation 2016/679

WHAT IS THIS INFORMATION?
The information provided below describes, as required by the EU Regulation 2016/679 (hereinafter Regulation or GDPR), the processing operations performed on the Personal Data of the Users visiting the website https://www.collectionofcollections.org/.
The information provided does not concern other online websites, pages or services that can be accessed via hyperlinks on the above website but relate to resources outside the Collection of Collections APS's domain.

DATA CONTROLLER AND CONTACT
Visiting the above mentioned website may result into processing data relating to identified or identifiable natural persons.
The Data Controller is Collection of Collections Associazione di Promozione Sociale – Modena - e-mail: info@collectionofcollections.org

PROCESSING OF PERSONAL DATA AND RELATED PURPOSES
a) Browsing data
By visiting the website https://www.collectionofcollections.org/ the browser of the Users automatically sends information to the server of this website. The information is logged without user intervention and stored until they are automatically deleted. For further details see the Cookie Policy.
This information is used for the following purposes:
• To ensure a smooth connection;
• To ensure the safety and stability of the system.
The legal basis of the processing of data is art. 6, point f) GDPR. The legitimate interest derives from the aforementioned purposes. Personal data are in no way processed for profiling or for statistical analysis purposes.
b) Data communicated by users
Sending messages, on the basis of the user's free, voluntary, explicit choice, to the addresses indicated on the site and filling in and sending the forms made available on the website entail the acquisition of the sender's contact information as necessary to provide a reply as well as of any and all the personal data communicated in that manner.
Specific information concerning the Personal Data shall be cited or visualized in the web page dedicated to the request (for instance the forms in the page join us).
Collection of Collections APS uses the free e-mail service named "Gmail" provided by Google. Google has adopted a privacy policy compliant with the GDPR and verifiable at https://policies.google.com/privacy?hl=en which shows that Google Ireland Limited is the data controller for users residing in the European Economic Area or Switzerland, unless otherwise stated in a specific Google service privacy policy.
The processing of data for the aforementioned purposes takes place pursuant to art. 6 point a) GDPR based on expressed consent.
c) Hosting and Data Center
The Collection of Collections APS website is hosted by Bassanonet, via Roma, 5 - 36061 Bassano del Grappa VI (Italy) https://www.bassanonet.com/ ("Bassanonet"). COC APS has concluded a data processing agreement with Bassanonet. Bassanonet guarantees constant control of its Server Farms through a sophisticated software that can monitor the installed machines 24 hours a day, 7 days out of 7, verifying performance and reliability. Thus any fault is signaled and notified in real time to the technicians that intervene immediately. Bassanonet’s Data Centers are located in Italy and in Europe.

METHODS OF PROCESSING
The Data Controller processes the Data of the Users in a proper manner and shall take appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data.
The Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to the Data Controller, in some cases, the Data may be accessible to certain types of persons in charge, involved with the operations of the site (members and volunteers) or external parties (such as for example: hosting providers, e-mail services, IT companies, communications agencies, legal and fiscal companies that provide assistance and consultancy to the Association), appointed, if necessary, as Data Processors by the Controller.

RETENTION PERIOD
The Personal Data of the Users will be processed and stored for as long as required for the purposes for which they were collected, and in accordance with the storage periods provided for by the applicable laws, or until the User revokes the consent to the processing, if applicable. After such period, the Personal Data will be automatically and permanently erased or made anonymous.

COMMUNICATION AND TRANSMISSION OF DATA
The Personal Data of the Users are not transferred to third parties except for the purposes expressly indicated. A transmission of data to third parties may take place:
• in case of explicit consent pursuant to art. 6 point a) GDPR;
• if the transmission pursuant to art. 6 point f) GDPR is necessary for the assessment, exercise or defense of a right in court and there is no reason why another legitimate interest of the User prevails over transmission;
• in cases in which the transmission occurs in fulfillment of a legal obligation pursuant to art. 6 point c) GDPR;
• if the transmission takes place in execution of a contract of which the User is a party pursuant to art. 6 point b) GDPR.

COOKIES
The Cookies are not used to transmit information of a personal nature, nor are user-tracing and identification systems used. The use of so-called cookies is strictly limited to the transmission of session identifiers necessary to allow the safe and efficient exploration of the website and are used for statistical purposes in order to survey the number of visitors. The Cookies can be inhibited by the navigator using the functions of the user own browser. For further details see the Cookie Policy.

DATA SUBJECT’S RIGHTS
Data Subjects have the right to obtain from the Collection of Collections APS access to their personal data as well as, where appropriate, rectification or erasure of such data or the restriction of the processing concerning them, and to object to the processing (under articles 15 to 22 of the Regulation).
Data Subjects also have the right to withdraw the consent at any time. The withdrawal of the consent will not affect the lawfulness of processing based on the consent before the withdrawal.
Please contact the Collection of Collections APS’s Data Controller (e-mail: info@collectionofcollections.org) to lodge all requests to exercise these rights.

RIGHT TO LODGE A COMPLAINT
If a Data Subject considers that the processing of personal data relating to him or her as performed via this website infringes the Regulation, he or she has the right to lodge a complaint with the applicable supervisory authority of the Italian territory (Autorità Garante per la protezione dei dati personali - Piazza di Montecitorio n. 121, 00186, Roma) pursuant to art. 77 of the Regulation, or else to bring a judicial proceeding pursuant to art. 79 of the Regulation.

CHANGES TO THIS PRIVACY POLICY
The Data Controller reserves the right to amend this privacy policy at any time. The version published on the website is the one currently in force.

Modena, 7 March 2021