https://contenuti.savethechildren.it/cop31/
Save the Children Italia ETS (hereinafter also: “the Controller” or “Save the Children”) owns this website and, in pursuing its statutory objectives, processes the personal data of Internet users and, in particular, of those who visit its sites. Save the Children aims to safeguard the confidentiality of private life and the rights of individuals and is therefore committed to applying specific, protective rules of conduct – in line with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter “GDPR”) – that guarantee safe, controlled and confidential browsing of the web.
This policy for the protection of the confidentiality of information may change over time, also as a result of additions and changes to legislation and regulations on the subject or of our institutional decisions; we therefore invite you to consult this section of our site periodically.
Thank you, then, for reading the rules that our organisation has set itself in collecting and processing personal data and in always providing a satisfactory service to the users of its sites.
This Privacy Policy applies exclusively to the sites of Save the Children and not to those of other companies, bodies, associations, professionals or any other legal entity or natural person.
Save the Children Italia ETS, active since 1919, is an independent organisation that aims to care above all for the most vulnerable. It offers children concrete help on the ground, generating lasting impact at scale, including in emergencies. Among its main statutory purposes, Save the Children Italia ETS sets itself the objectives of: guaranteeing health and nutrition for mothers and children, education and schooling without discrimination, fighting poverty and discrimination, defending the rights of children and adolescents and protecting them from every form of abuse, neglect and violence, promoting the protection of children in the context of child labour, against trafficking and exploitation, and against the abuse of minors through new technologies. It works with institutions and urges them, through its own national and international actions and interventions, to act actively and legislatively to offer all children and adolescents a decent life that respects their rights.
carry out the processing (Art. 4(2) GDPR: “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”) of personal data (Art. 4(1) GDPR: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”) solely for the purposes and in the ways described in the information notices given to the user each time they access a section of the site in which the direct or indirect provision of personal data is envisaged;
use the data that the user has provided voluntarily;
use technical cookies to facilitate browsing of the site and analytics cookies for statistical purposes;
not use profiling cookies for promotion, marketing or profiling purposes;
transmit data to third parties (processors – Art. 4(8) GDPR: “a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller”) solely for purposes ancillary to what has been expressly requested and carefully selected by us;
disclose data to third parties for activities connected with what is of interest or where required by law, regulation or EU legislation;
respond to requests for access to personal data, rectification or erasure of the same, restriction of processing or the right to object to their processing on legitimate grounds. Ensure the exercise of the right to data portability and the right to object to the processing of data for the purposes of informative and promotional communications about our institutional initiatives, our actions and our projects in favour of children and their families and of the most fragile people in need of support, for fundraising campaigns or invitations to take part in events and to join services, surveys and research, and make known the possibility of lodging a complaint with the supervisory authority;
ensure correct and lawful processing of your data, safeguarding your confidentiality, and apply suitable security measures to protect the confidentiality, integrity and availability of the data itself.
The site https://contenuti.savethechildren.it/cop31/ is a landing page dedicated to an interactive activity developed on the occasion of the COP31 event. The site allows users to go through the interactive experience and, at the end, to optionally complete a short anonymous questionnaire to give feedback on the usability of the site and on the activity offered. The site uses only technical and analytics cookies. Therefore, in the course of use of the site, data will be processed in order to:
allow use of the interactive activity dedicated to COP31 and ensure the proper functioning of the landing page;
collect, at the end of the experience and on an optional basis, anonymous feedback on the usability of the site and on the interactive activity offered;
produce aggregate statistics on the use of the site and of the interactive activity by means of analytics cookies.
Any personal data processed in the course of browsing are processed by the Controller (and any External Processors) with electronic and telematic tools and are stored within the IT systems used to deliver the site and its services. Suitable security measures are observed to prevent the loss or alteration of data – including accidental – unlawful or incorrect uses and unauthorised access.
All processing carried out in connection with this site will be done with logic related to the purposes for which the data were collected and in compliance with the security rules in force, for the purposes specified from time to time in the information to be provided under Art. 13 GDPR.
The purposes referred to in points 2. and 3., “Purposes of processing”, are pursued with electronic processing aimed at producing anonymous or aggregate results. The final questionnaire is designed so as not to require identifying data of the user; the answers are collected anonymously and used exclusively to assess the usability of the site and of the activity offered. The information collected through analytics cookies is used to produce statistics on the use of the site and of the interactive experience.
The legal basis for processing depends on the purpose of the processing itself. The different legal bases applied to the individual purposes of processing pursued by Save the Children are therefore listed below.
for the purpose referred to in point 1., “Purposes of processing”, the legal basis is the legitimate interest of Save the Children (Art. 6(1)(f) GDPR) in making available and ensuring the proper functioning of the digital experience dedicated to COP31, while guaranteeing the security and functionality of the site;
for the purpose referred to in point 2., “Purposes of processing”, the answers to the questionnaire are collected anonymously and are not intended to identify the user. For the purpose referred to in point 3., “Purposes of processing”, where the use of analytics cookies requires the user’s consent, the legal basis is consent under Art. 6(1)(a) GDPR, given through the cookie management tools on the site.
Use of the interactive activity does not require the user to provide first name, surname, e-mail address or other identifying data. Completing the final questionnaire is optional and the questionnaire is designed to collect feedback anonymously, without requiring data that directly identify the user. The browsing data whose transmission is implicit in the use of Internet communication protocols, and any data collected through analytics cookies, remain unaffected. Data are collected in compliance with the requirements of Art. 25 GDPR (“Data protection by design and by default”), applying the principles of minimisation and appropriate technical and organisational measures. The following data are therefore processed:
browsing data and technical information connected with access to and the proper functioning of the site
answers optionally provided in the final questionnaire, collected anonymously
data relating to the use of the site and of the interactive activity gathered through analytics cookies.
Depending on the purpose of processing, the criteria used by Save the Children to determine the data retention period are:
for the purpose referred to in point 1., “Purposes of processing”, any technical and browsing data are kept for the time strictly necessary to guarantee the functioning and security of the site, without prejudice to any further periods required by law or necessary to establish liability in the event of computer crimes
for the purposes referred to in points 2. and 3., “Purposes of processing”, the questionnaire feedback is collected anonymously and may be kept for the time necessary for analyses of usability and of the activity offered; data collected through analytics cookies are kept for the period provided for by the relevant Cookie Policy and by the settings of the analytics tool used.
Processing connected with the web services of this site takes place at the aforementioned premises of Save the Children and is handled by staff authorised to process data. Where necessary, the personal data collected through the site may be processed at their own premises by the staff of third-party companies that maintain the technological side of the site or carry out processing activities ancillary to the services provided through the site, as well as by other parties located mainly within the European Union, carefully selected and appointed as processors pursuant to Art. 28 GDPR.
Personal data are processed on servers owned by the Controller and/or by third-party companies appointed and duly designated as processors, located within the European Union. Should the need arise to transfer personal data to third countries, the Controller assures from now on that the transfer will take place in compliance with the applicable legal provisions (Arts. 45, 46, 47 and 49 GDPR).
Save the Children Italia ETS – Piazza di San Francesco di Paola 9, 00184 Rome (RM), Tax Code 97227450158 – VAT No. 07354071008, tel.: (+39) 06.4807.001, e-mail info.italia@savethechildren.org is the data controller (Art. 4(7) GDPR: “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data”), pursuant to and for the purposes of the GDPR, since it decides how and for what reasons, communicated in the information provided to data subjects, to collect and use the personal data supplied by the data subject, as well as with what tools to process them and what security procedures to activate to guarantee their integrity, confidentiality and availability, subject to the obligations and responsibilities provided for by Art. 24 GDPR.
The Data Protection Officer is the person whom Save the Children involves in many matters concerning the protection of personal data and who supports it in monitoring, where required, how data are processed and protected. He or she is also the point of contact for data subjects who wish to know details about the processing of their data. The Data Protection Officer can be contacted at the e-mail address italy.dpo@savethechildren.org for information on data processing.
Your personal data may be processed, both manually and electronically or telematically, either directly by the Controller or by third parties who, being experienced, technically capable, professional and reliable, carry out processing operations on our behalf, in compliance with the security and confidentiality of the information and under our constant supervision. The processor is “a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller” (Art. 4(8) GDPR) and is bound to Save the Children by contract, with a definition of the limits of its operations on the data, of the data it may process and the categories of data subjects to which they relate, of the nature and purpose of the processing, of the data retention limits, of the obligations and rights that Save the Children has towards the processor, and with a ban on using the data differently from the assignment entrusted. If formally authorised, in general or specific terms, by Save the Children, it may engage other processors, who are contractually bound by the initial processor appointed directly by Save the Children: breaches committed by such other processors fall under the responsibility of the initial processor and not of Save the Children. The complete and up-to-date list of processors (and, where applicable, of processors appointed by the initial processor, with our prior authorisation) can be requested by writing to Save the Children Italia ETS – Piazza di San Francesco di Paola 9, 00184 Rome (RM) or to the e-mail address informativa@savethechildren.org.
The personal data collected will be made available to the persons authorised by Save the Children pursuant to Art. 29 GDPR who carry out processing activities connected with the landing page and the interactive activity dedicated to COP31, as well as to those in charge of IT and data security services.
They will also be processed by Internet connection providers, as independent controllers.
They may be processed by public bodies, the judiciary or law enforcement, where required by law, regulation or EU legislation, which will act as independent controllers.
Users’ data may be disclosed to third parties for various purposes. To be precise, the various cases that involve disclosure of data to third parties are listed below.
Data are not disclosed to other bodies, associations or companies for their marketing, profiling or other purposes.
Data may also be disclosed to supervisory bodies, police forces and the judiciary in order to assert or defend one’s own right or the right of a third party in court. Such disclosure is permitted without the data subject’s consent pursuant to Art. 6(1)(f) GDPR, that is, by virtue of the legitimate interest of the Controller or of a third party in safeguarding their rights and fundamental freedoms, provided that those of the data subject do not prevail.
Personal data are not and will not be disseminated.
Users who join the social media pages of Save the Children (fans of the page or subscribers to a group of followers of a given initiative or of a service or donation incentive or sign-up to awareness events or petitions) decide, by that action, to make explicit their intention to follow news, comments and developments of Save the Children. Such users, following their behaviour, may lawfully receive promotional messages concerning the topics in which they have manifestly declared, implicitly by joining the page, that they are interested. The sending of promotional communications concerning a given service or action or initiative or an institutional activity in the broad sense, by the Save the Children to which the relevant page refers, must be considered lawfully conducted if, from the context and the way the social network works, also in light of the information provided spontaneously by the user, it can be inferred that, unequivocally, the user has in some way expressed their wish to receive precisely that type of message, through a behavioural formula that is conclusive of an implicitly declared consent. Therefore, pursuant to the Italian Data Protection Authority’s measure issuing guidelines on promotional activity and the fight against spam of 4 July 2013, register of measures no. 330, Save the Children may contact the active followers of its social pages in order to send informative and promotional messages about its own initiatives, services, events and activities in order to carry out its institutional activity.
When the user leaves the group or stops following the activities of Save the Children or exercises the right to object to the processing of data for promotional purposes, this prerequisite lapses and, if Save the Children intends to continue to use the data for such promotional and institutional activities, it will request the user’s consent.
Conversely, the contact data of the primary user will be used by Save the Children only after asking the individual contact for express consent, adequately and previously informed, specific to Save the Children’s promotional messages and freely given.
Save the Children does not use personal data, including images and testimonies, for the purpose of training artificial intelligence systems. Conversely, we warn that third parties, primarily social media (e.g. Facebook, Instagram, X, TikTok), may, unbeknownst to us, process personal data for the purposes of generating and improving artificial intelligence algorithms for their own use or for the provision of services to third parties. We advise contacting directly those third parties to which you may have made your personal data available, including images and testimonies (e.g. through posts or uploads of content), in order to exercise the right to object so that the data are not included in the processing of artificial intelligence system algorithms. Save the Children neither requests nor receives artificial intelligence services from such third parties.
The rights under Arts. 15-22 GDPR, set out below, may be exercised at any time by writing to Save the Children Italia ETS – Piazza di San Francesco di Paola 9, 00184 Rome (RM), or to the e-mail address informativa@savethechildren.org:
The person has the right to ask whether processing of their personal data is under way and, therefore, has the right of access to the information concerning them and to receive information on:
the purposes of the processing (e.g. information on the training course);
the categories of personal data (e.g. personal details and contact data)
the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if recipients in third countries or international organisations;
where possible, the envisaged period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period;
the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data or to object to their processing;
the right to lodge a complaint with a supervisory authority;
where the data are not collected directly from the person, any available information as to their source;
the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the person.
The person has the right to obtain the rectification of inaccurate personal data concerning them without undue delay. Taking into account the purposes of the processing, the person has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
The person has the right to obtain the erasure of personal data concerning them, and there is an obligation to erase personal data without undue delay, where one of the following grounds applies:
the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
consent on which the processing is based is withdrawn and there is no other legal ground for the processing (e.g. one’s own legitimate interest, legal or contractual obligations);
the person objects to processing for marketing and profiling purposes and there are no overriding legitimate grounds for the processing;
the personal data have been unlawfully processed;
the personal data have to be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject.
The person has the right to obtain restriction of processing of their personal data where one of the following applies:
the person contests the accuracy of the personal data, for a period enabling the accuracy of those personal data to be verified;
the processing is unlawful and the person opposes the erasure of the personal data and requests the restriction of their use instead;
although the data are no longer needed for the purposes of the processing, the personal data are required by the person for the establishment, exercise or defence of legal claims;
the person has objected to the processing where the processing is based on legitimate interests, pending verification as to whether the legitimate grounds of the controller override those of the person.
The person has the right to request that the rectification or erasure of data or restriction of processing be communicated by Save the Children to any other parties to whom the data may have been disclosed. Save the Children may not comply with the request if the means to be employed are disproportionate to the right to confidentiality invoked by the person.
This right allows the person to receive, in a structured, commonly used and machine-readable format, the personal data concerning them which they have provided to a party processing their data, and to transmit those data to another party for that party’s use without hindrance from the party to which they were provided. This right can be exercised in the following cases:
the processing is based on consent or on a contract or on pre-contractual measures requested by the person, and at the same time
the processing is carried out by automated means.
The person has the right to have their data transmitted directly from one party to another (from the one to which they were provided to the one to which they want them transmitted), where technically feasible.
The person has the right to object to the processing of their data for the pursuit of the legitimate interest of Save the Children or of third parties, provided that the interests or fundamental rights and freedoms of the person which require protection of personal data do not override them, including for profiling purposes.
Where personal data are processed for marketing purposes, the person has the right to object at any time to the processing of personal data concerning them for such purposes, including profiling to the extent that it is related to such marketing.
The person has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. In particular, they have the right to object to profiling to which they are subject through automated processes.
This right cannot be exercised if the decision:
is necessary for entering into, or performance of, a contract;
is authorised by Union or Member State law to which one is subject, which also lays down suitable measures to safeguard the person’s rights, freedoms and legitimate interests;
is based on explicit consent.
The person has the right to express their point of view and to contest the decision of Save the Children, where exercisable.
As established by the GDPR, Save the Children will reply to the person within 1 (one) month of the request, unless complex procedures must be put in place (or the requests are numerous) that make it impossible to meet this deadline. A full reply within 3 (three) months of the request is permitted, but we are in any case obliged to inform you of this within 1 (one) month of the request originally submitted (Art. 12(3) GDPR).
The data subject has the right to contact the Supervisory Authority to assert their rights.
For Italy this is the Garante per la Protezione dei Dati Personali (Italian Data Protection Authority), Piazza Venezia 11, 00187 Rome (RM) – www.garanteprivacy.it, to which the complaint may be sent at protocollo@pec.gpdp.it, using the template (https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524&zx=e0yn0riezmmw) made available by the authority or in free form.
Cookies are pieces of information saved on the hard disk of your PC or other device and sent by your browser to a Web server, relating to your use of the network. As a result, they make it possible to know the services, the sites visited and the options that have been expressed while browsing online.
This information is therefore not provided spontaneously and directly, but leaves a trace of your actions. The data collected through cookies will be used for technical needs, in order to guarantee easier, more immediate and quicker access to the site and its services and easier browsing for the individual user.
Profiling cookies are not used to create user profiles, for advertising purposes or to personalise promotional communications on the basis of browsing carried out on the site.
The use of so-called session cookies (which are not stored persistently on the user’s computer and are automatically deleted when the browser is closed) is strictly limited to the transmission of session identifiers (made up of random numbers generated by the server) necessary to allow safe and efficient exploration of the site. The so-called session cookies used on this site avoid the use of other computer techniques that are potentially prejudicial to the confidentiality of users’ browsing and do not allow the acquisition of personal data identifying the user. Conversely, profiling cookies make it possible to know the user’s browsing on the web and to detect their interests, expressed needs and preferences, and then allow advertising campaigns to be created or profiles to be built in order to target promotional, institutional and awareness-raising communications better and in a personalised way. In any case, it is possible to configure the browser so that you are notified when a cookie is received and can then decide whether to accept it.
This site uses only technical cookies and analytics cookies aimed at obtaining statistical information on the use of the landing page and of the interactive activity. Profiling cookies are not used.
To learn in detail about our policy on cookies and the cookies policies of third parties, we invite you to read the full information by clicking on the “Cookie Policy” link located in the footer bar of the site.
The IT systems and software procedures used to operate this site acquire, in the course of their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected in order to be associated with identified users but which, by its very nature, could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of the computers used by users who connect to the site, the addresses in URI (Uniform Resource Identifier) notation of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and computer environment. These data are used only to obtain anonymous statistical information on the use of the site and to check its correct functioning, and are deleted immediately after processing. The data could be used to establish liability in the event of hypothetical computer crimes against the site.
Save the Children adopts suitable and preventive security measures to safeguard the confidentiality, integrity, completeness and availability of your personal data. As laid down by the legislation governing the security of personal data, technical, logistical and organisational measures have been developed with the aim of preventing damage, loss (including accidental), alteration, and improper and unauthorised use of the data concerning you.
In particular, Save the Children has put in place technical and organisational measures aimed at ensuring a level of security appropriate to the risk that could affect the rights and freedoms of individuals, including the confidentiality of the information concerning them. It adopts security criteria that include, among others:
“pseudonymisation” (Art. 4(5) GDPR: “the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person”) and/or encryption of data
systems that permanently safeguard the confidentiality, integrity, availability and resilience of processing systems and services
systems to restore promptly the availability of and access to personal data in the event of a physical or technical incident
procedures for regularly testing, verifying and evaluating the effectiveness of the technical and organisational measures in order to ensure the security of processing.
Similar preventive security measures are adopted by the third parties (processors) to whom we have entrusted processing operations on your data on our behalf.
On the other hand, Save the Children does not consider itself responsible for untrue information sent directly by the data subject (for example: correctness of the e-mail address or postal address or other personal details), nor for information concerning the data subject that has been provided by a third party, including fraudulently.