Privacy Policy

Controller and contact details

The association below is identified as the controller for this notice. You can also use these contact details for requests concerning your personal data.

Browsing and security

To deliver pages, the server receives technical data such as your IP address, requested resource, request date and time and information sent by your browser. The verified public application does not integrate visitor analytics or profiling tools.

Purposes: operating and protecting the website. Intended legal basis: legitimate interest in service operation and security (Article 6(1)(f) GDPR).

Email and certified email enquiries

Email and PEC links open your email application. By writing to the Ecomuseum, you provide your address, message and any attachments. Please avoid sending information that is unnecessary for your enquiry.

Processing is intended to respond to and handle your request. Providing information is optional, but without relevant details and a way to contact you it may not be possible to reply.

Intended legal basis: Article 6(1)(b) GDPR for pre-contractual service enquiries; Article 6(1)(f) for general correspondence, subject to a legitimate-interest assessment. Access limited to people authorised to handle the request.

Newsletter

The Newsletter button opens an external form on sibforms.com, used by Brevo. The form is not embedded in this website.

Approved criterion: use the email address for Ecomuseum activity updates, based on optional, specific consent (Article 6(1)(a) GDPR), separate from browsing and enquiries. Collect only the email address and, if useful, an optional name, with subscription confirmation by email.

Approved criterion: allow withdrawal at any time through an unsubscribe link in each message or by contacting the controller, without affecting other association activities. Keep individual open/click tracking disabled until it has been assessed and properly explained.

External links and bookings

The website links to Eventbrite, YouTube, social networks and other websites. The verified configuration does not load embedded YouTube players or Eventbrite forms: these services open when you follow a link.

Please read the notices provided by external services. An event organiser may receive booking data from the service used.

Approved criterion: process booking data available to the Ecomuseum only to organise participation, send service communications and handle event-related requests, under Article 6(1)(b) GDPR. Do not automatically subscribe participants to the newsletter.

Providers and international transfers

The hosting provider identified by the association is Seeweb S.r.l., Via Armando Vona, 66, 03100 Frosinone, Italy. This does not automatically identify the email or PEC provider.

Approved criterion: restrict access to authorised people and hosting, maintenance, email and newsletter providers as necessary for their tasks, with Article 28 GDPR agreements where they act as processors. Disclosure to authorities remains possible where required by law.

Seeweb’s role in the contractual chain, including any reseller, must be verified. An Italian registered office alone does not prove where all data is located or that no transfers occur outside the European Economic Area.

Approved criterion: permit transfers outside the EEA only where GDPR conditions are met, specifying actual safeguards and how to obtain a copy in the final notice.

Seeweb provider privacy information

Data retention

The following retention criteria have been approved for data management; they are not statutory deadlines. Their implementation in service settings still needs to be checked: text approval has not enabled automatic deletion. Actual periods must remain limited to what is necessary for the stated purposes.

Website technical logs: delete or anonymise within 30 days of recording; keep specific records longer only for actual incidents or authority requests, documenting reasons and duration.

Ordinary email/PEC enquiries: until the request is closed and for the following 12 months. Contractual, administrative or tax records follow separately identified applicable requirements.

Bookings: Ecomuseum-held copies for up to 12 months after the event, except for specific record-keeping obligations or actual disputes. Shorten this period where the purpose ends earlier.

Newsletter: use for mailings until withdrawal or service termination; review the need for each subscription at least every 24 months, without relying on email-open tracking. After withdrawal, stop mailings and retain only any necessary minimum consent/withdrawal evidence or suppression record for a period justified by the controller.

Backups of association-managed copies: rotate within 30 days where technically supported by the purchased service. Reapply previous deletion requests after a restore. This is not a statement of Seeweb or other providers’ backup periods.

Your rights

Where the GDPR provides for them, you may request access, rectification, erasure, restriction and portability, and object to processing. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

To exercise your rights, use the controller’s contact details above. You may also lodge a complaint with the Italian data protection authority.

Italian data protection authority