This notice explains how Progetto Quadrifoglio Onlus processes personal data collected through its public website (information pages, blog, forms, donations and subscriptions) and the software services connected to it. The controller is Progetto Quadrifoglio Onlus, with registered office at Via del Caravita 8/A, 00186 Rome, Italy, represented by its legal representative. To exercise your rights or ask questions about processing, please use the contact details on the website’s Contact page.
Overall purposes: to provide secure browsing; to respond to requests sent via forms; to manage newsletter subscriptions and project communications where consent is required; to handle donations and related supporter requests; to measure aggregate use of pages where analytics tools are enabled; to comply with legal obligations and defend rights in or out of court.
Browsing and connection data: IT systems and site software may acquire, during normal operation, data whose transmission is implicit in Internet protocols (for example IP addresses or device identifiers, browser identifiers, request times). Such data may be used for security, technical diagnostics and correct service operation, on the basis of legitimate interests or performance of pre-contractual/contractual measures, in accordance with applicable law.
Cookies and local storage: a technical cookie may be used for site language (NEXT_LOCALE). The choice made in the cookie banner about non-essential tools is stored on your device in local storage (key quadrifoglio_cookie_consent). For tools used, Google Tag Manager, and available options, please read the dedicated Cookie notice.
Google Tag Manager (GTM): the site includes Google Tag Manager to load measurement scripts or other tags configured by the association. Any data collected depends on the GTM container configuration and active tags. The site may push events to a data layer for internal measurement. See the Cookie page for details on cookies and third parties.
Google Ads (Google tag / gtag.js): public pages may load the Google Ads tag to measure conversions and campaign performance. It uses the site’s data layer. For users in the European Economic Area, Google Consent Mode applies: until you consent via the cookie banner for non-essential categories, ad-related storage and related features stay off; accepting or declining updates the same locally stored preference described above. Google’s processing follows the vendor notice (policies.google.com/privacy).
Contact form: name, email address, optional phone number, subject, message text and, if provided, an attachment in an allowed format. Data are processed to handle your request and keep correspondence. The lawful basis is generally performance of pre-contractual steps at your request or legitimate interests in managing inbound communications; where separate consent is required, it will be requested explicitly. Email may be sent through a transactional email provider acting as processor or authorised person under agreements with the controller.
Newsletter and marketing communications: updates on activities, fundraising and ways to support the project are sent only after explicit consent through the dedicated site form (or other forms where expressly provided), recording email address, language and subscription source. The lawful basis is consent (Art. 6(1)(a) GDPR). Data collected for these purposes are not sold to third parties nor transferred for those third parties’ own marketing; they are used by the association and its appointees for the stated purposes, with the help of strictly necessary providers (e.g. email delivery). You may withdraw consent at any time using the instructions in messages or by writing to the association.
“Forms and documents” upload: first name, surname, email, phone, message, optional file, language and, if selected, optional choices to receive operational updates about the request and/or newsletter/marketing messages. Data are used to handle the submission, create any internal case file and, only where you give specific consent, subscribe you to the newsletter. Lawful basis: pre-contractual/contractual steps or consent where required for optional communications.
Donations: data needed for online card donations (when the service is enabled) or for handling supporter-related requests are processed to complete the transaction and meet related obligations. Card payments may be processed by Stripe, which independently processes the payment-specific part of the data. For bank-transfer coordinates requested via a dedicated form, identification and contact data provided with consent for project communications are recorded for supporter relationship purposes as described on the form.
Blog: aggregated view statistics and limiting repeated submissions may use technical identifiers stored in the browser (for example session storage for views and a local identifier for “like” actions). Processing supports service operation and aggregate measurement; it is not used for behavioural profiling of site visitors.
Third-party content: some pages may embed video (for example YouTube in a privacy-enhanced mode). In that case the third party may collect data under its own notice; please read the provider’s policy.
Staff portal: any restricted area for authorised staff (dedicated subdomain) is a separate context; this notice primarily covers the public site. Portal-only processing may be covered by notices given to portal users.
Retention: data are kept for as long as needed for the purposes for which they were collected and thereafter as required by law or documented legitimate interest (for example defending legal claims). Periods may vary by data category and case type.
Your rights: under Articles 15–22 GDPR, subject to legal limits, you may request access, rectification, erasure, restriction of processing, objection and data portability where applicable, and withdraw consent where consent is the lawful basis. Requests can be sent using the website contact details. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali — www.garanteprivacy.it).
Changes: this notice may be updated; the version is reflected in the lead text above. Please review it periodically.
Use this form to request withdrawal from all marketing and operational messages sent through our public website systems, erasure of your personal data held there, or a machine-readable copy of that data. Requests are reviewed by staff; sensitive actions require manual confirmation in our internal tools.
If this address is also used for a staff portal login, automated erasure or export may be blocked; we will contact you or handle it manually.