PRIVACY POLICY FOR THE PROCESSING OF PERSONAL DATA

pursuant to Article 13 of Legislative Decree 196/2003 and Article 13 of EU Regulation No. 2016/679

Pursuant to Article 13 of Legislative Decree 196/2003 (hereinafter the “Privacy Code”) and Article 13 of EU Regulation No. 2016/679 (hereinafter “GDPR 2016/679”), containing provisions for the protection of individuals and other persons with regard to the processing of personal data, we hereby inform you that the personal data you provide will be processed in compliance with the aforementioned legislation and with the confidentiality obligations to which the Anna Trust Catholic Sisters’ Elder Care Fund Foundation (hereinafter also “The Anna Trust”) is subject.

Your data will be processed in accordance with the principles of fairness, lawfulness and transparency, while safeguarding your privacy and the rights granted to you by law.

1. Data Controller

The Data Controller is the Anna Trust Catholic Sisters’ Elder Care Fund Foundation, tax code 96591720584, with registered office in Rome, Via di Panico nos. 55–59, represented by its President and legal representative, Sr. Patricia Margaret Murray.

2. Purposes of processing

2.1 The personal data you provide will be processed in compliance with applicable legislation and in accordance with the principles established by law and will be collected by the Foundation for the purpose of carrying out its statutory activities (cultural, religious and educational), including training, religious education and charitable activities.

2.2 The data may also be processed for the purpose of asserting or defending a right, including by third parties, in judicial proceedings, as well as in administrative proceedings or in cases governed by European Union law, EU legislation, regulations or collective bargaining agreements.

2.3 For the purposes indicated above, the processing of the aforementioned data may also concern the maintenance of registers, accounting records and financial documents necessary for the administrative management of grants and programmes, as well as compliance with tax and reporting obligations required by law.

3. Methods of data collection

3.1 Your telephone contact details and email address will be collected for the purpose of providing you with information on the Foundation’s activities and sending institutional communications relating to your status as a donor or Participant. Data collected for the purpose of providing grants to applicant or beneficiary organisations is acquired directly through the application and the grant award notification.

3.2 The data will be processed and stored in electronic and paper records managed by the Foundation in compliance with the aforementioned legislation. These are organisational and non-individual data collected through the application and reporting forms provided by The Anna Trust. In any event, the provision of identification data (personal details, residence and/or domicile, tax code and telephone contact details) is essential for the acceptance of donations. The provision of such data is therefore mandatory, and refusal to provide it will make it impossible to accept the donations.

3.3 In the case of communications relating to fundraising and donations, The Anna Trust considers donors’ names and the purposes of donations to be confidential and will make such names public only with the donor’s or donor organisation’s explicit and informed consent. However, donors’ names may be communicated to The Anna Trust’s Board of Directors as required by law.

3.4 In the case of seminars, webinars, workshops or other training and skills-development activities, the processing and any dissemination of data for the purpose of broader promotion and awareness of The Anna Trust’s training resources (for example, publication of the webinar on a YouTube channel) are subject to the explicit and informed consent of the person or persons concerned.

3.5 With regard to newsletters, information reports and any other form of promotion of The Anna Trust’s activities, data are processed confidentially by The Anna Trust. The Anna Trust always requires explicit consent for the sending of its quarterly newsletter. Subscription to The Anna Trust newsletters takes place exclusively following the explicit consent of the data subject, given through a subscription form available on the website https://annatrustfoundation.org or by email request. The user has the right to withdraw consent at any time by clicking the “unsubscribe” link at the bottom of each newsletter or by writing to info@annatrustfoundation.org.

3.6 The Anna Trust has its own accounts on the following social media:

• YouTube channel
• LinkedIn page

The data collected by The Anna Trust during courses, seminars, webinars or similar activities may be disclosed for educational purposes and to promote The Anna Trust’s activities, subject to the consent of the data subject, through The Anna Trust’s social media or website.

4. Methods of processing and storage

4.1 Data processing will be carried out automatically and/or manually, in compliance with Article 32 of GDPR 2016/679 and Annex B to Legislative Decree 196/2003 (Articles 33–36 of the Code) concerning security measures, by specifically appointed personnel and in accordance with Article 29 of GDPR 2016/679.

4.2 Technical and administrative security measures will be adopted to reduce the risk of loss, misuse, unauthorised access, disclosure and alteration of data. Security systems include firewalls, physical access controls to offices and IT systems, as well as controls authorising access to data.

4.3 In compliance with the principles of lawfulness, purpose limitation and data minimisation, pursuant to Article 5 of GDPR 2016/679, and subject to your free and explicit consent expressed at the bottom of this privacy policy, your personal data will be stored for the period necessary to achieve the purposes for which they are collected and processed.

5. Scope of communication and dissemination

5.1 The data collected will not be disseminated or communicated to third parties without your explicit consent, except for communications that are necessary and may involve the transfer of data to public authorities, consultants or other parties for the fulfilment of legal obligations.

5.2 The Anna Trust may communicate data to affiliated entities and organisations or to external parties forming part of its organisation, including companies providing services strictly connected with and instrumental to its activities, such as banks, legal assistance providers and website management providers. These parties act as “Data Processors” (appointed pursuant to Article 28 of GDPR), and their data protection standards are aligned with those of The Anna Trust. Upon request by the data subject, The Anna Trust will provide a list of such external parties.

6. Transfer of personal data

The data you provide will not be transferred to other Member States of the European Union or to third countries outside the European Union, except for data that may be shared with organisations or entities affiliated with The Anna Trust that are based outside the EU for the pursuit of common purposes. In such cases, appropriate protection measures will be adopted for the transfer and processing of data in compliance with Chapter V of GDPR 2016/679.

7. Special categories of personal data

7.1 Pursuant to Articles 26 and 27 of Legislative Decree 196/2003 and Articles 9 and 10 of EU Regulation No. 2016/679, you may be asked to provide the Anna Trust Foundation with data qualifying as “special categories of personal data”, namely data revealing “racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, data concerning health or a person’s sex life or sexual orientation”. Such categories of data may be processed by the Anna Trust Foundation only with your free and explicit consent, expressed in writing at the bottom of this privacy policy.

7.2 In any event, the Anna Trust Foundation collects and organises the personal data it acquires in relation to four categories of individuals:

a) applicants and beneficiaries of its grant and support programmes;

b) applicants, students and instructors of courses, seminars, webinars, workshops or other training or skills-development programmes;

c) supporters of the Anna Trust Foundation or persons in contact with its supporters;

d) subscribers to the Anna Trust Foundation’s electronic newsletters, reports and other publications.

8. Automated decision-making processes

8.1 The Anna Trust Foundation does not adopt any automated decision-making process, including profiling, as referred to in Article 22, paragraphs 1 and 4, of EU Regulation No. 679/2016.

8.2 In any event, the data collected will not be used by The Anna Trust or third parties for profiling, combining or comparing datasets originating from different sources; will not be used by The Anna Trust or third parties to make decisions having legal effects; will not be used by The Anna Trust or third parties for decisions that may prevent the data subjects from benefiting from a service; and will not be subject to systematic monitoring (video surveillance).

8.3 The Anna Trust does not process personal data on a large scale, does not use advanced technological solutions such as facial recognition or similar technologies, and does not systematically monitor employees’ activities, including their IT devices.

9. Rights of access and rectification (Articles 15 and 16 of EU Regulation 2016/679)

Persons who have provided personal data to the Anna Trust Foundation have the right to obtain from it, as Data Controller, confirmation as to whether or not personal data concerning them are being processed and, where this is the case, access to the personal data and the following information:

10. Right to erasure (“right to be forgotten”) pursuant to Article 17 of EU Regulation 2016/679

10.1 Persons who have provided personal data to the Anna Trust Foundation have the right to obtain from it, as Data Controller, the erasure of personal data concerning them without undue delay.

10.2 The same Data Controller is obliged to erase personal data without undue delay where one of the following grounds applies:

11. Right to restriction of processing (Article 18 of EU Regulation 2016/679)

Persons who have provided personal data to the Anna Trust Foundation have the right to obtain from it, as Data Controller, restriction of processing of their data where one of the following applies:

12. Right to data portability (Article 20 of EU Regulation 2016/679)

Persons who have provided personal data to the Anna Trust Foundation have the right to receive the personal data concerning them, which they have provided to it as Data Controller, in a structured, commonly used and machine-readable format, and have the right to transmit such data to another Data Controller without hindrance by the Anna Trust Foundation.

13. Withdrawal of consent to data processing

13.1 Persons who have provided their personal data to the Anna Trust Foundation have the right to withdraw consent to the processing of such data by sending:

• a registered letter with acknowledgement of receipt to the following address: Anna Trust Catholic Sisters’ Elder Care Fund Foundation – Via di Panico nos. 55–59 – 00186 Rome, accompanied by a copy of an identity document, bearing the following wording: “withdrawal of consent to the processing of all my personal data” and signed;
• a certified email (PEC) to the Foundation’s certified email address: theannatrust@legalmail.it.

13.2 Upon receipt of the request referred to above from the data subject, the personal data acquired will be removed from the Foundation’s records as soon as possible.

13.3 For any information concerning the processing of your personal data or the procedures for exercising the rights granted to you by law, you may contact:

• Tel.: +39 06 69225724;
• info@annatrustfoundation.org.

14. Consent to data processing

The undersigned declares that they have read the above privacy policy in full and consent to the processing of their personal and sensitive data necessary for the performance of the requested service.