Last updated: 18 July 2026
This notice explains how Fondazione Fiamma Viva ETS processes the personal data of people who browse and use www.fondazionefiammaviva.org, submit online forms, communicate with the Foundation or make a donation. It is provided under Articles 12, 13 and 14 of Regulation (EU) 2016/679 (“GDPR”), Italian Legislative Decree No. 196 of 30 June 2003, as amended, and the applicable data-protection rules.
1. Data Controller
The Data Controller is Fondazione Fiamma Viva ETS, Corso d’Italia 38, 00198 Rome RM, Italy, Italian tax code 96623930581, registered in the Italian National Third Sector Register (RUNTS) by Lazio Region determination G06426 of 23 May 2025.
Privacy-related requests and requests to exercise the rights described in this notice may be sent to privacy@carmelitaniscalzi.com.
2. Scope
This notice covers processing carried out through the website and the digital services directly connected with it. It does not govern processing by third-party websites, platforms or services reached through external links; their own privacy notices apply.
3. Categories of personal data processed
3.1 Browsing and technical data
During normal operation, IT systems, software and hosting services collect data whose transmission is inherent in Internet protocols. This may include IP address, browser and device type, operating system, language, date and time of the request, pages visited, requested resource, server response code, referring page, technical identifiers, security logs and diagnostic information.
3.2 Contact-form data
When a user submits a contact form, the Foundation processes the user’s full name, email address, message, acknowledgement of the privacy notice and any other information voluntarily included in the request.
3.3 Donation-related data
When a user uses a donation form or communicates an intention to support the Foundation, the following data may be processed: donation type and amount, first name, surname, email address, telephone number and information necessary to manage the request. For donations made by bank transfer or another channel, the Foundation may also process donor identification details, amount, date, payment reference and transaction information supplied by banks or payment-service providers. The website should not directly collect full payment-card details where the payment is handled by an external provider.
3.4 Communications sent to the Foundation
Sending a message to an address published on the website entails processing the sender’s address, the content of the communication and any other data needed to reply and manage the request.
3.5 Cookies, preferences and external content
The website may process online identifiers and technical preferences, including the selected language and choices recorded through any consent-management tool. Some pages include or link to external services such as Google Maps, Google Fonts and social-media profiles. Further information is available in the Cookie Policy.
3.6 Special categories of data
The website forms are not designed to collect special categories of data under Article 9 GDPR or data relating to criminal convictions and offences. Users should not submit such information unless it is strictly necessary and an appropriate legal basis exists. In that event, the Foundation will limit processing to what is indispensable.
4. Sources of personal data
Data is collected directly from the individual through browsing, forms, communications and donations. Additional information may be received from banks, payment providers or parties involved in the administrative management of a donation, solely for the related purposes.
5. Purposes and legal bases
5.1 Website operation, maintenance and security
Technical data is processed to deliver requested pages, ensure stability, prevent abuse, fraud, unauthorised access and security incidents, and perform diagnostics, backups and maintenance. The legal basis is the Foundation’s legitimate interest in keeping its systems secure and operational under Article 6(1)(f) GDPR, together with compliance with any legal obligations.
5.2 Requests and communications
Data submitted by form or email is processed to read the request, reply, provide information and manage any follow-up. The legal basis is taking steps at the individual’s request under Article 6(1)(b) GDPR or the legitimate interest in handling institutional relations and communications. Where the form expressly asks for consent, processing may also rely on Article 6(1)(a).
5.3 Donations and related obligations
Donation data is processed to handle the request, record the contribution, communicate with the donor, comply with administrative, accounting, tax and reporting obligations and protect the Foundation’s rights. The legal bases are the individual’s request, compliance with legal obligations and, where applicable, the legitimate interest in proper administration and legal defence under Article 6(1)(b), (c) and (f) GDPR.
5.4 Preferences and non-essential services
Technical cookies and strictly necessary features are used to provide the service requested. Non-essential cookies or external content are activated on the basis of consent where the law requires it, under Article 6(1)(a) GDPR and Article 122 of the Italian Data Protection Code.
5.5 Legal obligations and protection of rights
Data may be processed to answer public-authority requests, comply with legal obligations, prevent unlawful conduct and establish, exercise or defend legal claims. The legal bases are legal obligation and the Controller’s legitimate interest.
6. Whether data must be provided
Fields marked as mandatory are required to submit a form. Without them, the Foundation cannot receive or properly handle the message. Other data is optional. Making a donation is voluntary, although certain information may be necessary to carry it out and comply with administrative and tax obligations.
7. Processing methods and security
Processing is carried out electronically and, where necessary, on paper, in accordance with the principles of lawfulness, fairness, transparency, minimisation, accuracy, storage limitation and integrity. The Foundation adopts measures proportionate to the risks, including access controls, authorisation management, software updates, backups, communication safeguards and incident procedures. No system can guarantee absolute security; measures are reviewed in light of technical developments and risks.
8. Authorised persons, recipients and processors
Data may be processed by Foundation staff, collaborators and expressly authorised persons within their assigned duties. It may also be disclosed or made accessible to providers supporting the website and related operations, including:
- hosting, infrastructure, backup, security and technical-maintenance providers;
- email, message-delivery and form-management providers;
- IT, administrative, accounting, tax and legal advisers;
- banks, financial institutions and payment or donation service providers;
- cookie and consent-management providers;
- public authorities, supervisory bodies or other recipients where disclosure is required by law or necessary to protect a right.
Providers processing data on behalf of the Foundation are appointed as processors under Article 28 GDPR where required. An updated list may be requested using the privacy email address.
9. External services used by the website
9.1 Google Fonts
The website requests fonts from Google Fonts domains. The request may disclose technical data to Google, such as IP address, browser, device, date and time and referring page. The Foundation reviews the configuration and, where appropriate, local hosting or additional safeguards.
9.2 Google Maps
Contact pages may include an embedded Google Maps map. When it loads, Google may receive technical and usage data and use cookies or similar technologies under its own terms and settings. Where required, the external content must load only after the user’s choice through the consent tool.
9.3 Social networks and external platforms
The website contains links to Facebook, Instagram, YouTube and other platforms. A simple link does not by itself load platform content into the page. Once the user opens the link, the external provider processes data under its own notice. Sharing functions may send the address of the selected page to the service chosen by the user.
9.4 WordPress components
WordPress, WPML and Contact Form 7 are technical components used to publish multilingual content and manage forms. These software components are not automatically independent recipients of personal data; any disclosure depends on the external services actually configured.
9.5 Analytics and profiling
As of the last update, the technical frontend inventory does not show an independently active web-analytics or advertising-profiling tool. If such tools are introduced, this notice and the Cookie Policy will be updated and consent will be requested where required.
10. Transfers outside the European Economic Area
Some international providers may process data outside the European Economic Area. In those cases, the Foundation assesses whether there is a European Commission adequacy decision, whether the recipient participates in a recognised mechanism such as the EU-US Data Privacy Framework for certified US organisations, or whether Standard Contractual Clauses and any supplementary safeguards are in place. Information on applicable safeguards may be requested through the privacy email address.
11. Retention periods
Personal data is not kept longer than necessary for the relevant purpose. In particular:
- contact-request data is kept for the time needed to answer and handle follow-up, normally no longer than 24 months after closure, unless legal obligations or disputes require longer retention;
- administrative, accounting and tax records relating to donations are kept for the period required by law, normally ten years from recording the transaction;
- technical and security logs are kept for limited periods, normally no longer than 30 days, unless needed to investigate incidents, prevent abuse or comply with an authority request;
- cookie preferences and consent evidence are kept for the time needed to honour the choice and demonstrate compliance, according to the consent tool’s configuration and statutory limitation periods;
- data needed to protect a right may be kept until limitation periods expire or proceedings end.
At the end of the applicable period, data is erased, anonymised or archived with restricted access where further retention is legally required.
12. Automated decision-making and profiling
The Foundation does not use the website to make decisions based solely on automated processing that produce legal or similarly significant effects. It does not perform its own advertising profiling.
13. Children
The website is not designed to intentionally collect children’s data. Minors should use forms with the assistance of a parent or guardian. If the Foundation becomes aware that data has been collected without an appropriate legal basis, it will take steps to erase it or regularise the processing.
14. Data-subject rights
Where the GDPR applies, individuals may exercise the rights of access, rectification, erasure, restriction, portability and objection, and may withdraw consent without affecting processing carried out before withdrawal. They may also request information on data sources, recipients and safeguards for international transfers.
Requests may be sent to privacy@carmelitaniscalzi.com. The Foundation may request information needed to verify identity and will reply within the time limits laid down by law.
15. Complaint to a supervisory authority
Individuals may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), or with the competent supervisory authority in the Member State of habitual residence, place of work or alleged infringement, without prejudice to any other administrative or judicial remedy.
16. Cookie Policy
For information on cookies, similar technologies, external content and preference management, see the Cookie Policy.
17. Updates to this notice
The Foundation may update this notice following legal, organisational or technical changes, the introduction of new services or changes in providers. The date at the beginning identifies the current version. Material changes will be communicated in an appropriate manner.
