This notice describes how Consorzio Stabile Resilia processes the personal data of people who visit the website www.cth-resilia.com and of those who contact the Consortium. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and to Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 (Codice Privacy).

Data controller

The data controller is Consorzio Stabile Resilia, with its registered office at Via Trento 3, 52014 Poppi (AR), VAT number 02505700514.

• Email: segreteria@cth-resilia.com
• PEC: consorzio.stabile.resilia@legalmail.it
• Telephone: +39 055 471460

Data protection officer

The Consortium has not appointed a data protection officer (DPO) because the conditions of Article 37 of the GDPR are not met: it is not a public authority or a public body, its core activities do not consist of processing operations which, by their nature, require regular and systematic monitoring of data subjects on a large scale, and it does not process on a large scale special categories of personal data or data relating to criminal convictions and offences.

For any matter concerning personal data, including requests to exercise rights, you may write to segreteria@cth-resilia.com or to the PEC address consorzio.stabile.resilia@legalmail.it.

The contact form does not send data to this website

This is the most important point in this notice and it is worth reading in full.

The contact form published on the website does not transmit any data to a server of the Consortium or to third-party services. When the send button is pressed, the website composes a draft email and opens the mail program configured on the sender's device, with segreteria@cth-resilia.com as the recipient and with the data entered already set out in the text of the message. The message is sent only if the user decides to send that email from their own mail program.

As a result, the website does not collect, does not transmit and does not store the name, the email address, the telephone number and the text of the message typed into the form: until the email is sent, that data remains on the user's device. Processing by the Consortium begins at the moment the email arrives in the segreteria@cth-resilia.com mailbox, and from that moment what is described in the following section applies.

The same applies to the email addresses and telephone numbers published on the pages of the website: selecting them opens the user's mail program or telephone application, without the website recording anything.

What data is processed, for what purposes and on what legal basis

Correspondence and requests for information. If you write to the Consortium by email or PEC, or telephone, the contact details and all the information contained in the message are processed: first name and surname, email address, telephone number, any body or company you belong to, the subject of the request. The purpose is to reply to the request and to manage the contacts preliminary to a possible relationship: visits to the spaces, quotations, proposals for collaboration, applications to join, candidate applications. The legal basis is Article 6(1)(b) GDPR, that is, the performance of pre-contractual measures taken at the data subject's request.

Browsing data and technical logs. The website is built and hosted with the Framer platform, provided by Framer B.V. (the Netherlands). As happens with any website, the infrastructure that delivers the pages automatically records certain technical data necessary to provide the service and to guarantee its security: the IP address of the device, the date and time of the request, the address of the page requested, the outcome of the request, the type of browser and operating system, the referring page. The Consortium does not use this data to identify users and does not cross-reference it with other information. The legal basis is Article 6(1)(f) GDPR, that is, the legitimate interest in delivering the website securely and in working order.

Usage statistics. Only if the user gives their consent, the website uses Google Analytics 4 to measure in aggregate form how many people visit the website and which pages are viewed. The legal basis is consent, Article 6(1)(a) GDPR. Consent is optional, it may be refused with no consequence for viewing the website and it may be withdrawn at any time. The details of the cookies used are in the cookie policy.

Technical cookies. The cookie that stores the choice made about cookies is necessary to provide the service requested by the user and does not require consent, pursuant to Article 122 of the Codice Privacy and Article 6(1)(f) GDPR.

Nature of the provision of data

The provision of the data necessary to reply to a request is voluntary, but without it no reply can be given: to answer an email at least an address to reply to is needed. Giving consent to statistical cookies is entirely optional and refusal does not restrict the viewing of the website in any way.

How long data is retained

• Correspondence by email and PEC: 24 months from the last contact. If the relationship continues, or if legal, accounting or tax obligations apply, the periods laid down by the applicable legislation apply.
• Statistical data collected through Google Analytics: 14 months.
• Record of the choice made about cookies: 6 months.
• Technical logs of the hosting infrastructure: for the time necessary for the security and the operation of the service, according to the policies of the platform provider.

Who the data is disclosed to

The data is processed by the Consortium's staff authorised to process it and instructed pursuant to Article 29 of the GDPR. It may also be processed, for the purposes indicated above only, by the providers of the technical services of the website and of the email service, which act as data processors pursuant to Article 28 of the GDPR:

• Framer B.V. (the Netherlands), provider of the platform with which the website is built and hosted;
• Google Ireland Ltd. (Ireland), for the Google Analytics statistics service, active only subject to consent.

The data is not subject to disclosure to the public and is not disclosed to parties other than those indicated, unless the disclosure is required by law or requested by the judicial authority.

Transfers outside the European Union

Within the Google Analytics service, provided by Google Ireland Ltd., data may be transferred to the United States to Google LLC. The transfer takes place on the basis of the adequacy decision adopted by the European Commission on 10 July 2023 concerning the EU-US Data Privacy Framework, to which Google LLC adheres, and additionally on the basis of the standard contractual clauses approved by the European Commission.

Framer B.V. has its registered office in the Netherlands and the data processed to deliver the website normally remains within the European Economic Area.

No profiling and no automated decision-making

The Consortium does not carry out profiling of users and does not adopt automated decision-making processes which produce legal effects or similarly significantly affect individuals. The Google Analytics statistics are used only in aggregate form, without building individual profiles and without any advertising purpose.

Rights of the data subject

Pursuant to Articles 15 to 22 of the GDPR, every data subject has the right to:

• obtain confirmation as to whether or not processing of their personal data is taking place and, where that is the case, obtain access to it (Article 15);
• obtain the rectification of inaccurate data and the completion of incomplete data (Article 16);
• obtain the erasure of the data in the cases provided for by the legislation (Article 17);
• obtain the restriction of processing in the cases provided for by the legislation (Article 18);
• receive the data provided in a structured, commonly used and machine-readable format, and transmit it to another controller (Article 20);
• object to processing based on the legitimate interest (Article 21);
• withdraw at any time the consent given, without this affecting the lawfulness of the processing carried out before the withdrawal (Article 7(3)).

Requests must be sent to segreteria@cth-resilia.com or to the PEC address consorzio.stabile.resilia@legalmail.it. The Consortium replies without undue delay and in any event within one month of receipt of the request, a period which may be extended by two months in cases of particular complexity, informing the data subject accordingly.

Complaint to the supervisory authority

Anyone who believes that the processing of their personal data is carried out in breach of the legislation may lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority), Piazza Venezia 11, 00187 Roma, in the manner indicated on the Authority's website: www.garanteprivacy.it. The right to bring proceedings before the judicial authority is unaffected.

Cookies and similar technologies

The use of cookies and storage technologies by this website is described in the cookie policy, which forms an integral part of this notice: www.cth-resilia.com/en/cookie-policy. The Cookie preferences panel, which can be opened from the footer of every page, makes it possible to change your choice at any time.

Changes to this notice

The Consortium may update this notice to bring it into line with changes to the website, to the services used or to the applicable legislation. The version in force is always the one published on this page; the date of the last update is indicated below the title.