Privacy policy

1. Who processes your data

The data controller is Isola Catania Impresa Sociale S.r.l., a social enterprise under Italian Legislative Decree No. 112/2017, with registered office at Via Museo Biscari 16, 95131 Catania (CT), Italy, tax code and VAT number 05973680878, REA (Economic and Administrative Index) CT-453162, represented by its legal representative pro tempore, Antonio Perdichizzi.

• Operating office: Piazza Cardinale Pappalardo 23, 95131 Catania (CT), Italy
• Email: info@isola.catania.it. For requests about personal data, please write “Privacy” in the subject line, so that they reach the right person straight away
• Certified email (PEC): isola.catania@pec.it

Fondazione Marea ETS and Arcadia Holding S.r.l. are separate legal entities and are not controllers of any processing carried out through this website.

Where this policy cites an article without further indication, the reference is to Regulation (EU) 2016/679, the GDPR. The “Italian Personal Data Protection Code” is Legislative Decree No. 196/2003.

This policy is also available in Italian. In the event of any discrepancy between the two versions, the Italian version prevails.

2. Data protection contact

Isola is not required to designate a Data Protection Officer under Article 37 GDPR and has not designated one. Data protection matters are handled internally: please send requests to the contacts given in section 1.

3. How this website is built

We say this first because it shapes almost everything else.

This website does not contact any third party while you read it. It uses no cookies, not even technical ones, writes nothing to your device and installs no measurement or tracking tools. The only operation it carries out on your device is deleting the cookies left by our previous website, as described in section I. There is no banner to accept, because there is nothing to consent to.

This is no accident: it is how the website is built. Our fonts are hosted on our own servers. The map on the contact page is our own image. Videos are links: where a preview image is shown, it is served by us. Event registrations, programme questionnaires and the WhatsApp link are links, not embedded content: nothing is sent until you open them.

The automatic check that runs each time the website is updated makes sure this stays true: if a page contacted an undeclared third party or wrote anything to your device, the update would be rejected.

The processing described below therefore concerns what happens when you write to us or sign up for something, not when you read our pages.

4. Processing activities, one by one

A. Browsing the website

• Data: IP address, date and time, page requested, browser type, referring website
• Purpose: running the website, keeping it secure and understanding, in aggregate form, how it is used
• Legal basis: our legitimate interest in keeping the service working and secure (Article 6(1)(f) GDPR)
• Retention: access logs are kept by our hosting provider, Netlify, for less than thirty days
• Nature: this is data that every web server records automatically. We do not use it to identify people
• Statistics: with Netlify’s analytics service we use the logs only in aggregate form, to count visits and the most-read pages, without identifying people and without any tool on your device. Legal basis: our legitimate interest in understanding how the website is used (Article 6(1)(f) GDPR)

B. The website’s forms

The website has several forms (information requests, spaces, ecosystem, applications, projects, website feedback), and we will add more. The following rules apply to all of them; the differences are set out in sections C and D. For the external channels linked from the website, see sections F, J and K.

• Data you enter: first name, surname, email address, message, plus phone number, organisation and other fields where the form includes them
• Data the website adds automatically: the page the request was sent from and its title, which form was used, any service selected, the website you came from if you arrived through an external link, and the version of this policy in force when the form was sent. This helps us reply to you better and understand how people find us
• What we do not collect: your IP address is not added to the form, and we do not collect data that would allow us to recognise your device. Of the referring website we keep only its name (for example linkedin.com), not the full address of the page
• Purpose: receiving your request and following it up
• Legal basis: taking steps at your request prior to entering into a contract, and our legitimate interest in replying to you (Article 6(1)(b) and (f) GDPR)
• Where it goes: the submission is collected and stored by Netlify, and we are notified by email to our Google Workspace mailboxes
• Retention: 24 months from the closure of the request, unless a different period is stated in sections C and D
• Whether you have to provide it: it is optional, but without the data requested we cannot reply to you
• Data sent through the forms is not used to send you promotional communications, unless you ask for them by ticking the dedicated box (section E)

C. Job applications

• Data: the data in section B, plus any information about your background that you choose to share with us and, if you attach it, your CV
• Your CV: you may attach one in PDF format; this is optional. The file is stored by Netlify together with your application, and we are notified of it by email with a link
• Purpose: assessing your application and, where relevant, contacting you again
• Legal basis: taking steps prior to entering into a contract at your request (Article 6(1)(b) GDPR). For unsolicited (speculative) applications, as provided by Article 111-bis of the Italian Personal Data Protection Code, we do not ask for your consent
• Retention: 12 months from receipt. When that period ends, we delete the application and the CV, both from the form archive and from our email
• Please note: we do not ask for data about health, disability, trade union membership, religious beliefs, political opinions or sex life, nor for data relating to criminal convictions and offences. Your CV does not need a photo or a date of birth either. If you share any of this, we do not use it in our assessment

D. Applications to take part in our projects

This processing follows its own rules, because our projects are funded by public and private bodies that impose documentation obligations on us.

• Data: the data required by each call or notice, as stated on the project page. For some programmes, applications are made through an external questionnaire (section K)
• Purpose: selecting participants, running the activities, monitoring and reporting to the funding body
• Legal basis: taking steps at your request to take part (Article 6(1)(b) GDPR) and compliance with the reporting and audit obligations laid down by the rules on public funding and by the related funding agreements (Article 6(1)(c) GDPR)
• Recipients: the data may be disclosed to the body funding the project and to the reporting platforms it designates, as well as to project partners appointed as processors. Each project lists its own recipients on its page
• Retention: for the period during which project documentation must remain available for checks and audits, under the funding body’s rules and, for accounting records, under Article 2220 of the Italian Civil Code: this may be up to ten years from the end of the project. We cannot delete this data earlier, because we are obliged to keep it
• Minors: where the activities involve minors, participation is managed outside this website, with the involvement of those who hold parental responsibility

E. Newsletter

• Data: email address
• Purpose: sending our newsletter with news, initiatives and events
• Legal basis: your consent, freely given, specific, informed and unambiguous, which you may withdraw at any time (Article 6(1)(a) GDPR). We collect it with a separate, unticked box in the website’s forms, or with the sign-up form shown after you submit an application
• Provider: MailerLite, a processor established in the European Union
• Sign-up: your address is added to the mailing list within a few days of your request. You may withdraw your subscription at any time
• Retention: until you withdraw your consent. When you unsubscribe, your address is removed from the list; for five years we keep, separately, only the record of the consent you gave and of its withdrawal, so that we can demonstrate it and avoid adding you again by mistake
• Withdrawal: using the link at the bottom of every newsletter, or by writing to us

F. Event registration

Registration for our events takes place on Eventbrite, an external platform reached through a link. When you open that link, your data is collected by Eventbrite under its own privacy policy, over which we have no control: for the running of its platform, Eventbrite acts as an independent controller.

We receive the list of registered participants from Eventbrite and, as controller, we process it to organise the event and manage admission, in order to process your registration (Article 6(1)(b) GDPR); for this part, Eventbrite processes the data on our behalf. We keep the list for 12 months; if the event is part of a funded project, the period in section D applies.

Addresses collected for an event are not used for later communications, unless you have consented to the newsletter: in that case the rules in section E apply, and your registration joins our single list, with a single way to unsubscribe.

G. Videos and external links

Videos are not embedded on this website: they are links, and where a preview image is shown, it is served by us. When you open the link, you leave our website and the terms and privacy policy of the destination platform apply. As long as you stay here, no data is sent to that platform.

The same applies to links to our social media profiles.

H. Transparency page

On the Transparency page we publish the corporate documents required by the law on social enterprises, which include the names of the members of our corporate bodies. This publication is mandatory and concerns data connected with roles of public relevance. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR). We do not publish personal data of employees and collaborators, nor their individual remuneration.

I. Removing cookies left by our previous website

Our previous website, at the same address, used analytics and marketing tools that may have left cookies on your device. For your browser, those cookies belong to our domain, and they would not otherwise be removed.

The first time a page loads, we delete them. We neither use nor keep the content of those cookies: the only operation is the deletion, which is carried out in your interest. Nothing leaves your device.

J. Writing to us on WhatsApp

From the footer and from some pages you can write to us on WhatsApp. The link is a plain link: until you open it, nothing is sent to anyone.

• Data: your telephone number, the name and picture on your WhatsApp profile, and the content of your messages
• Purpose: answering your questions and following them up
• Legal basis: taking steps at your request prior to entering into a contract, and our legitimate interest in replying to you (Article 6(1)(b) and (f) GDPR)
• Provider: WhatsApp Ireland Limited (Meta), which processes messages under its own terms and privacy policy, with transfers to the United States
• How we use it: we reply from a device belonging to the organisation, not from personal phones, and we do not use this channel to send you promotional communications
• Retention: 24 months from the last message, as for the forms
• A word of advice: WhatsApp is not the right channel for sending us documents or sensitive personal information. For those, please write to info@isola.catania.it

K. Bookings and questionnaires on external platforms

Some activities go through external tools reached through a link: booking a Day Pass, signing up for Isola Connect, and the application questionnaires for some programmes. Here too, nothing is sent until you open the link.

The data you enter in those tools is processed by us, as controller, for the purposes stated on the page you came from: managing your booking, registration or application. The providers of the tools, listed in section 5, process the data on our behalf. The retention periods in sections B and D apply, depending on the purpose.

5. Who else processes your data

Your data may also be disclosed to the professionals who assist us with accounting, legal and tax matters, and to the authorities where the law requires it.

6. Transfers outside the European Union

Some of the providers listed in section 5 are based in the United States or transfer data there. That table shows, for each of them, where the data is processed.

Transfers take place on the basis of the adequacy decision adopted by the European Commission on 10 July 2023 for the EU-U.S. Data Privacy Framework, for providers certified under it, and otherwise on the basis of the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914.

You can ask us for a copy of the safeguards in place by writing to the contacts in section 1.

7. Security

We take appropriate technical and organisational measures: encrypted transmission, access limited to those who need it, up-to-date systems, and the design choice of not adding third-party tools to the pages of the website. No measure removes all risk; if a personal data breach occurred that posed a high risk to your rights and freedoms, we would inform you as required by Article 34 GDPR.

8. Automated decision-making

We do not take decisions about you based solely on automated processing, and we do not carry out profiling.

9. Minors

The forms and channels on this website are not intended for minors (people under 18). If we realise that we have received data from a minor without the involvement of those who hold parental responsibility, we delete it.

10. Your rights

You can ask us for access to your data, rectification, erasure, restriction of processing and data portability, and you can object to processing based on our legitimate interest (Articles 15 to 22 GDPR). Where processing is based on consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal (Article 7(3) GDPR).

Please send your requests to the contacts in section 1. We will reply within one month, which may be extended by two further months in complex cases, and we will tell you why.

If you believe that the processing infringes the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Article 77 GDPR): Piazza Venezia 11, 00187 Roma, Italy, certified email (PEC) protocollo@pec.gpdp.it, or by the means indicated at www.gpdp.it. You may also contact the supervisory authority of the EU country where you live or work, or where you believe the infringement took place. You retain the right to seek a judicial remedy before the courts.

11. Version

Version 1.2, in force from the date shown at the top. Previous versions are kept and available on request. If we make material changes, we will give notice on the website.