Privacy Policy

Pursuant to Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 as amended
Last updated: March 2026

1. Data Controller

The Data Controller of personal data is:

Artivismo e Sport per i Diritti Umani (ASHR) – Voluntary Organisation (ODV)
Registered office: Modena (MO), Italy
Tax code: 94229150365
E-mail: artivismo.dirittiumani@gmail.com

2. Personal data collected

Personal data are collected through the Association's website via three distinct instruments, each with its own purposes and legal bases.

2.1 – Donation payment form

Data collected	Required
First and Last Name	Yes
Email address	Yes
Tax code	Yes
Donation amount	Yes
Personal message	Optional
Recurring donation preference (monthly/annual)	Optional
Request for tax deduction certificate	Optional
Newsletter subscription	Optional

Payments are processed through the third-party payment processors Stripe and PayPal. The Association does not collect or store data relating to credit cards, bank accounts or other payment instruments. For the processing of financial data, please refer to the respective privacy policies of Stripe and PayPal.

2.2 – Newsletter subscription

Data collected	Required
Email address	Yes

The email address is used solely for the periodic sending of communications relating to the Association's activities, projects and initiatives. Subscription is voluntary and consent may be withdrawn at any time via the unsubscribe link included in every communication.

2.3 – "Send message" form (Contacts)

Data collected	Required
First name	Yes
Last name	Yes
Email address	Yes
Message	Yes

Data provided through the contact form is used solely to respond to the user's request and manage communication with the Association.

3. Purposes and legal bases for processing

3.1 – Donation management

Purpose: collection and management of donations; issuance of declarations for tax deduction/reduction pursuant to art. 83 of D.Lgs. 117/2017 (Third Sector Code); mandatory accounting and tax obligations.

Legal basis: performance of pre-contractual and contractual measures (art. 6, par. 1, lett. b, GDPR); compliance with legal obligations (art. 6, par. 1, lett. c, GDPR).

3.2 – Newsletter delivery

Purpose: sending periodic communications about the Association's activities, projects, campaigns and events.

Legal basis: consent of the data subject (art. 6, par. 1, lett. a, GDPR). Consent is freely given, specific and may be withdrawn at any time.

3.3 – Contact request management

Purpose: responding to the user's request; handling any collaboration proposals.

Legal basis: legitimate interest of the Data Controller in responding to received requests (art. 6, par. 1, lett. f, GDPR); performance of pre-contractual measures at the data subject's request (art. 6, par. 1, lett. b, GDPR).

4. Processing methods

Personal data are processed using electronic tools and, where necessary, paper-based tools, with logic strictly related to the purposes indicated above and in any case in a manner that ensures the security, integrity and confidentiality of the data, in compliance with the organisational, physical and technical measures required by applicable law.

5. Data sharing and disclosure

Personal data may be disclosed to:

Payment processors (Stripe, PayPal) – limited to the data necessary for processing the transaction;
Email marketing platforms (e.g. Mailchimp) – limited to the email address for sending the newsletter;
Tax and accounting advisors – for tax obligations connected to donations;
Competent authorities – in cases provided for by law.

Data will under no circumstances be sold, transferred to third parties for marketing purposes or publicly disseminated.

6. International data transfers

Some of the third-party services used (Stripe, PayPal, Mailchimp) may involve the transfer of data to non-EU countries (in particular the United States). In such cases, the transfer takes place on the basis of adequate safeguards pursuant to artt. 46-49 of the GDPR, such as standard contractual clauses approved by the European Commission or adequacy decisions.

7. Data retention period

Processing	Retention period
Donations and tax data	10 years from donation (tax and accounting obligations)
Newsletter	Until withdrawal of consent by the data subject
Contact messages	12 months from the reply, unless further retention is needed to establish a collaborative relationship

Upon expiry of the above periods, data will be deleted or irreversibly anonymised.

8. Data subject rights

Pursuant to artt. 15-22 of the GDPR, the data subject has the right to:

Access – obtain confirmation of the existence of processing and access their own data;
Rectification – request the correction or updating of inaccurate or incomplete data;
Erasure ("right to be forgotten") – request the erasure of data, within the limits provided by law;
Restriction – request restriction of processing in certain cases;
Portability – receive data in a structured, machine-readable format;
Objection – object to processing on legitimate grounds;
Withdrawal of consent – withdraw at any time the consent given, without prejudice to the lawfulness of processing based on consent before its withdrawal.

To exercise their rights, the data subject may contact the Data Controller at the email address indicated in section 1.

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

9. Cookies and tracking technologies

For information on the possible use of cookies by the site, please refer to the specific Cookie Policy which is not currently available as the site does not use its own cookies or third-party cookies.

10. Changes to this policy

The Data Controller reserves the right to modify or update this policy at any time. Changes will be published on this page with an indication of the date of last update. Users are invited to consult this policy periodically.

Data Controller contacts

Artivismo e Sport per i Diritti Umani (ASHR) – ODV

E-mail: artivismo.dirittiumani@gmail.com

Tax code: 94229150365