Titolare dei dati oltre a prenotaunposto.it.

Information notice on the processing of personal data (Art. 13 EU Reg. 2016/679)
The General Custody of the Sacred Convent of St. Francis of the Friars Minor Conventual, in its capacity as Data Controller of your personal data, pursuant to Italian Legislative Decree 196/2003 as amended (“Privacy Code”) and EU Regulation 2016/679 (“GDPR”), recognizes the importance of protecting personal data and considers its safeguarding one of the main objectives of its activities. The General Custody informs you that the processing of your personal data will be based on the principles of lawfulness, fairness, transparency, purpose and storage limitation, data minimisation, accuracy, integrity and confidentiality. Your personal data will therefore be processed in accordance with the applicable legal provisions and the confidentiality obligations provided therein.
This privacy policy applies to the websites www.sanfrancescoassisi.org, www.sanfrancescopatronoditalia.it, www.sanfrancescovive.org, www.sanfrancesco.org and does not apply to other websites that may be consulted via external links; the General Custody of the Sacred Convent of St. Francis of the Friars Minor Conventual declines any responsibility in this regard.

1. Data Controller; Data Protection Officer
The Data Controller is the General Custody of the Sacred Convent of St. Francis of the Friars Minor Conventual (Tax ID C.F. 80002810549), with registered office in Assisi (PG), Piazza S. Francesco no. 2, e-mail privacy@sanfrancescoassisi.org.
The Controller has appointed a Data Protection Officer (DPO), who can be contacted at dpo@sanfrancescoassisi.org for any information regarding the processing of your data carried out by the Controller. Joint Controllers of the processing are the Fondazione per la Basilica di S. Francesco in Assisi (C.F. 80052240548) and the association Francesco d’Assisi, un Uomo un Fratello ONLUS (C.F. 80052760545), both with registered office in Assisi (PG), Piazza S. Francesco no. 2.

2. Types of data processed
Common personal data (identification and tax data). If you request services that involve the processing of third parties’ personal data, you warrant that you are authorised to provide their personal data on the basis of an appropriate legal basis that legitimises such processing. In these situations, you act as an independent data controller and assume all legal obligations and responsibilities, granting the broadest indemnity with respect to any dispute, claim, or request for damages arising from processing, etc., that may be addressed to the Controller by third parties whose personal data have been processed through your requests in breach of the applicable legislation.

4. Automated decision-making. Profiling
No automated decision-making processes are applied in the processing carried out for the purposes set out in this notice.

5. Recipients of personal data
Your data will be processed by the Controller and its employees and/or collaborators, duly authorised and bound by confidentiality. Your data will not be disseminated; they may be communicated to and/or become known by the following subjects:
– public entities (e.g., Tax Administration, Revenue Agency);
– professionals, consultants and service companies for corporate administration and management acting on behalf of the Controller (e.g., accountant, lawyer, etc.);
– credit institutions for payment services management;
– providers of IT processing tools such as software, cloud, etc., including support and maintenance;
– call-center service providers engaged by the Controller to contact data subjects;
– Judicial Authorities and/or Law Enforcement, where necessary for the detection and repression of crimes.

6. Transfer of data outside the European Economic Area (EEA)
Data will be processed and stored within the European Economic Area. Some personal data may be transferred to suppliers located outside the EEA. In such cases, transfers are based alternatively on an adequacy decision or on the Standard Contractual Clauses approved by the European Commission, and your data will be processed by the suppliers in compliance with the applicable legislation.

7. Data retention periods
Your data will be processed for the time strictly necessary to achieve the purposes referred to in point 3 of this notice. By way of example, data relating to donations will be retained for 10 years, in compliance with tax regulations. Contact data provided for sending the newsletter will cease to be processed when you decide to unsubscribe using the appropriate link at the bottom of each e-mail sent. Without prejudice to the above, the Controller will process your personal data for the period permitted by Italian law to protect its interests (Arts. 2946 and 2947 of the Italian Civil Code). Further information on retention periods may be requested by writing to the Data Controller or to the DPO at the addresses indicated in point 1 of this notice.

8. Rights of the data subject
As a data subject, with regard to your personal data you have the right to: access your personal data; obtain the rectification of inaccurate personal data; have incomplete data completed; obtain the erasure of data; obtain the restriction of processing; object, in whole or in part and on legitimate grounds, to the processing of personal data even if relevant to the purpose of collection; object to processing carried out for the purpose of sending advertising material or direct sales or for carrying out market research or commercial communication; exercise the right to data portability, i.e., to receive, in a structured, commonly used and machine-readable format, the personal data concerning you provided to the Data Controller. In certain cases, the exercise of rights may be limited pursuant to Art. 23 GDPR.

9. Complaints
If you believe that your personal data have been processed in a manner that does not comply with the law, you have the right to lodge a complaint with the supervisory authority of the EU Member State where you usually reside or work, or of the place where the alleged infringement occurred. In Italy, the supervisory authority is the Garante per la protezione dei dati personali, with offices in Rome, Piazza Venezia no. 11, Switchboard: (+39) 06.696771, e-mail: garante@gpdp.it.

10. Requests and inquiries
For any request, withdrawal of consent, or inquiry relating to the processing of your personal data, please write to the Data Controller or to the DPO using the contacts indicated in point 1.