Privacy

This document describes how the website https://itaild.com (“Site”) is managed, with reference to the processing of personal data of users (“User/Users”) who consult it.

It is an information provided pursuant to articles 13 et seq. of the EU Regulation of 27 April 2016, no. 679 (“GDPR”), the Privacy Code D. L.gs. n. 196/2003, renewed by D. L.gs. n. 101/2018 on the protection of personal data, to all those who visit the Site and/or communicate with ITAiLD – Italian Clinical Research Network of Autoimmune Liver Diseases.

The information is provided only for the Site and not for other sites that the user may consult through links on the Site.

1. Data Controller

The holder of the personal data is Fondazione IRCCS San Gerardo dei Tintori, with registered office in via Pergolesi n. 33 – 20900 Monza (MB).

The e-mail address is: protocollo@pec.irccs-sangerardo.it

The Data Protection Officer, also referred to as the DPO, is the company ECOSafety Group in Rome, in the person of lawyer Alessia Vincenza Ferrari, whose contact details are as follows:

E-mail address: alessia.ferrari@pec.it

E-mail address: dpo@irccs-sangerardo.it

2. Types of data processed

2.1 Navigation data

The computer systems and software procedures used to operate the website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.

This is information that is not collected in order to be associated with identified subjects, but which, by its very nature, could allow users to be identified. This category of data includes (i) the IP addresses or domain names of the computers used by users connecting to the Site, (ii) the URI (Uniform Resource Identifier) addresses of the resources requested, (iii) the time of the request, (iv) the method used to send the request to the server, (v) the size of the file obtained in response, (vi) the numerical code indicating the status of the response given by the server (successful, error) and (vii) other parameters relating to the user’s operating system and computer environment.

These data are used solely to obtain anonymous statistical information on the use of the site and to check that it is functioning correctly and are deleted immediately after processing.

2.2 Cookies

For information on the processing of data using cookies, please refer to the relevant policy available at thefollowing link.

2.3 Data provided voluntarily by the user:

The optional, explicit and voluntary sending of electronic mail to the e-mail addresses of the Data Controller indicated on the website implies the acquisition and processing of such data and any other information contained in such communications by the Data Controller for the purposes indicated in section 3.2 below.

3. Purpose and legal basis of processing

The processing of the User’s personal data by the Data Controller

1. is carried out in order to: in accordance with Article 6.1(f) of the GDPR, to pursue its own legitimate interest, which consists in ensuring the security of the Website and the information exchanged on it, i.e. the ability of the said Website to withstand, with a given level of security, unforeseen events or unlawful or malicious acts that compromise the availability, authenticity, integrity and confidentiality of the personal data stored or transmitted and the security of the related services offered or made accessible;
2. to fulfil the requests made by the User by sending electronic mail to the email addresses of the Data Controller indicated on the Website, in accordance with Article 6.1(b) of the GDPR.

4. Consequences of refusal

The provision of data for the purposes indicated in the previous paragraph is optional. However, refusal to provide the data would make it impossible for the User to communicate with the Owner and for the Owner to respond to the User’s requests, as well as to ensure the security of the Site and the information exchanged on it.

5. Processing methods

Personal data will be processed using manual, computer and automated systems. In order for the data to be processed correctly, it is necessary for the interested party to communicate any changes to the data in good time.

In particular, the user’s personal data will be processed by persons duly appointed to carry out such tasks, who are permanently identified and/or designated, and who are duly instructed and made aware of the constraints imposed by the law, as well as through the use of security measures designed to guarantee the protection of your privacy and to avoid the risks of loss or destruction, unauthorised access, unauthorised processing or processing that does not comply with the above-mentioned purposes. Security measures will be constantly improved in line with technological developments.

6. Communication and disclosure of data

The personal data collected on the site may not be communicated, sold or transferred to third parties, except in the cases provided for by law.

In any case, this does not preclude the communication of data to companies expressly appointed to provide specific services within the scope of the activity carried out by the Data Controller and/or, more generally, for its benefit, which will act as autonomous data controllers and/or data processors, as well as the communication and/or dissemination of data required by law to police forces, judicial authorities, information and security bodies or other public bodies for purposes of defence or national security or for the prevention, detection or repression of crime.

7. Transfer of data outside the EU

Users’ data may be transferred to countries outside the EU in accordance with the provisions of Articles 44 et seq. of the GDPR. In particular, the transfer may take place on the basis of an adequacy decision issued by the European Commission (Art. 45 GDPR) or, for those countries where there is no Commission decision, on the basis of adequate safeguards, such as standard contractual clauses or other appropriate instruments under Art. 46 GDPR, as well as any additional security measures.

8. Rights of the data subject

Pursuant to Art. 15 et seq. of the GDPR, the User has the right to obtain:

1. confirmation as to whether or not personal data concerning him/her exist, even if not yet recorded, and their communication in an intelligible form and/or access to them;
2. a copy of his/her personal data;
3. the rectification of any of your personal data that may be inaccurate;
4. the deletion of your personal data;
5. the restriction of the processing of your personal data;
6. in a structured, commonly used and machine-readable format, the personal data that you have provided to us or that you have created yourself – with the exception of the decisions created by the data controller and/or the persons authorised to process your data on behalf of the data controller pursuant to Article 4 of the Regulations – and to transmit them to another data controller (the so-called right to data portability);
7. the indication of:
   1. The source of the personal data;
   2. The categories of personal data processed;
   3. The purposes and methods of the processing;
   4. the logic applied in the case of processing carried out with the aid of electronic instruments;
   5. the identification details of the data controller and, where applicable, of the data processors;
   6. the conservation period of your personal data or the criteria for determining this period;
   7. of the subjects or categories of subjects to whom the personal data may be communicated or who may come to know the data in their capacity as designated representative in the territory of the State, managers or persons authorised to process the data in the name and on behalf of the data controller, pursuant to art. 4 of the GDPR;
   8. the updating, rectification or, if interested, the integration of the data;
   9. the transformation into anonymous form or the blocking of data processed in violation of the law, including data whose retention is not necessary in relation to the purposes for which the data were collected or subsequently processed;
   10. certification to the effect that the operations as per letters a) and b) have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected.

You also have the right to oppose, in whole or in part:

1. for legitimate reasons, to the processing of personal data concerning him/her, even if relevant to the purpose of collection.

To exercise the above rights, users may send a written request to the PEC e-mail address: protocollo@pec.irccs-sangerardo.it , and/or to the e-mail address: dpo@irccs-sangerardo.itindicating in the subject line “Privacy – Exercise of privacy rights”.

Finally, we inform you that if you consider that your rights have been violated by the Data Controller and/or a third party, you have the right to file a complaint with the Data Protection Authority and/or any other competent supervisory authority under the GDPR.

9. Duration of the processing and storage of personal data

The User’s personal data will be processed by the Data Controller only for the period of time necessary to achieve the purposes of processing referred to in Article 3 above, after which they will be kept only for the fulfilment of the relevant legal obligations, for administrative purposes and/or to assert or defend one’s right, in case of litigation and pre-litigation.

The processing of the user’s data for the purposes referred to in paragraph 3.1 above will be carried out for the time strictly necessary to provide feedback to the user and, in any case, for no longer than 12 months.

Further information is available at: https://www.irccs-sangerardo.it/privacy

*** *** ***

This privacy policy was updated on 23 November 2023. Any updates will always be posted on this page.