Privacy Policy

Last updated: 2026-07-06

Data controller

The data controller is Amnesty International — Italian Section, a Volunteer Organisation (OdV) registered with the Italian Single National Register of the Third Sector (RUNTS), tax code 03031110582, with offices at Via Ludovico di Savoia 2b (Spazio 3M), 00185 Rome, Italy. This website is run by the Lazio regional structure ("Amnesty International Lazio"), a territorial branch of the controller with no separate legal personality.

Email: email us

Data Protection Officer (DPO)

The controller has appointed a Data Protection Officer, whom you can contact on any matter relating to the processing of your personal data and the exercise of your rights at the following addresses:

• DPO: email us
• Certified email (PEC): email us

Data collected

Depending on your interaction, the following categories of personal data may be collected:

• Browsing data: IP address, browser and device type, operating system, pages visited and access time, collected by technical systems and statistical tools (the latter only with consent where not strictly technical).
• Data provided voluntarily via forms: name, surname, email address and — depending on the form — phone, postcode, age range, area of interest and message content (contact form, activism sign-up, newsletter subscription).
• Proof of consent: for newsletter subscriptions we record the date/time, IP address and user-agent at the moment consent is given, solely to demonstrate that consent was obtained (accountability principle, Art. 7 GDPR).

Purpose of processing

Personal data is processed for the following purposes:

• Responding to requests sent through the contact form.
• Managing activism sign-ups and directing you to the nearest local group.
• Managing newsletter subscriptions and sending communications about the association's activities.
• Analysing site usage in statistical form to improve functioning and content (only with consent).
• Ensuring site security and preventing abuse/spam on forms.
• Complying with legal obligations.

Legal basis

Processing is based on the following legal grounds:

• Consent (Art. 6(1)(a) GDPR): for newsletter subscription and non-technical statistical cookies/tools.
• Legitimate interest (Art. 6(1)(f) GDPR): for the technical functioning and security of the site and abuse prevention.
• Responding to a request (Art. 6(1)(b) GDPR): to reply to messages and manage sign-ups.
• Legal obligation (Art. 6(1)(c) GDPR): where required by applicable law.
• Explicit consent for special categories (Art. 9(2)(a) GDPR): if, when writing to us, you voluntarily include special-category data (e.g. political opinions or beliefs), processing is based on your explicit consent and solely to handle your request.

Special categories of data (Art. 9 GDPR)

We do not request special-category data. However, as we work in the human-rights field, a free-text message (e.g. from the contact form) may contain special-category data (political opinions, religious or philosophical beliefs, trade-union membership, health or sexual-orientation data). We ask you not to include such data unless strictly necessary. If you choose to include it, we will process it solely to handle your request, based on your explicit consent (Art. 9(2)(a) GDPR), and retain it only for as long as strictly necessary.

Minors (Art. 8 GDPR)

Our services are not primarily aimed at minors. In Italy, consent to the processing of data in information-society services is valid from the age of 14 (Art. 2-quinquies of the Privacy Code). For participation by anyone under 18 we require a consent declaration from a parent or legal guardian. For educational activities in schools (including pre-school and primary) we process the contact data of adult teaching staff and logistical/organisational data; any data relating to minor students is processed solely within the relationship with the school and retained for the periods stated above. If you believe a minor has provided us data without the required consent, contact us for its removal.

Recipients and processors

Data is not disclosed or sold to third parties for their own purposes. To deliver the service, the controller relies on suppliers acting as data processors (Art. 28 GDPR), including:

• Cloudflare, Inc. — website hosting/CDN, security and anti-abuse protection (Turnstile), aggregate statistics (Cloudflare Web Analytics, cookieless).
• Google LLC / Google Ireland — forms and collection sheets infrastructure (Google Apps Script, Google Sheets), service emails and, as a backup anti-spam system, Google reCAPTCHA.
• Mailjet / Sinch — sending newsletter emails and managing the related lists.
• OpenStreetMap Foundation — map tiles (loaded only after an explicit user action).

An up-to-date list of processors and their contact details can be requested from the controller.

Transfers to third countries (outside the EU)

Some suppliers (including Google and Cloudflare) may process data outside the European Economic Area, in particular in the United States. Where this occurs, transfers are based on appropriate safeguards under Articles 44 ff. GDPR, such as the "EU-US Data Privacy Framework" adequacy decision and/or the European Commission's Standard Contractual Clauses, with any supplementary measures.

Members' area (members, volunteers and activists)

Access to the members' area is by invitation and is intended for members, volunteers and activists. We process contact and membership data (name, email, phone, city, membership number, member category, group) and data generated by the activity (meeting minutes and attendance, planning, treasury, training, school programmes). The legal basis is the performance of the membership relationship and related obligations (Art. 6(1)(b) GDPR), together with the organisation's legitimate interest (Art. 6(1)(f)). Some minutes may contain attendance and resolutions of the association's bodies, hence special categories (e.g. opinions), processed under Art. 9(2)(d) GDPR (legitimate activities of a not-for-profit association, relating solely to its members). To deliver these services data is also processed via Google Workspace/Apps Script (sheets, documents, forms and mail), acting as processor, with possible transfer to the USA on the safeguards indicated above. Data-subject rights (including erasure and its extension to linked contributions) are exercised as described in the "Rights" section.

Data collected from third parties (Art. 14 GDPR): in carrying out our activities we may record the contact details of people other than the user — for example school contacts, project contacts or people named in the minutes. Such data is processed for organisational and reporting purposes, kept for as long as necessary and deleted/anonymised in line with the "Retention" section. These individuals may exercise their rights by writing to the contacts at the bottom of this page.

Data retention

Data is kept only as long as necessary for the stated purposes:

• Contact form: up to 24 months from the request.
• Activism sign-up: for as long as needed to manage the contact and any involvement, and in any case up to 24 months from the last contact, or until a deletion request if earlier.
• Newsletter: until consent is withdrawn or you unsubscribe (unconfirmed subscriptions are deleted within 15 days); the same "until withdrawal" criterion applies to data held by the email delivery platform (Mailjet). On unsubscribe, the proof of consent — IP address and user-agent — is deleted.
• Statistical data: for as long as needed for aggregate analysis; session identifiers last only for the session.
• Reserved area (volunteers/activists): login and profile data are kept for the duration of the membership or collaboration; security logs (access logs with IP and user-agent) are automatically deleted within 180 days, and technical anti-abuse IP addresses within 12 months.

Data subject rights

Pursuant to Articles 15-22 of the GDPR, you have the right to:

• Access your personal data and obtain a copy.
• Request rectification of inaccurate or incomplete data.
• Request erasure of personal data (right to be forgotten).
• Restrict the processing of your data.
• Object to data processing.
• Request data portability.
• Withdraw consent at any time, without affecting the lawfulness of processing based on consent given before withdrawal.
• Lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

How to exercise your rights: send a request to the contacts below, specifying the right you wish to exercise. We will respond without undue delay and in any case within 30 days (Art. 12 GDPR), extendable by two further months for complex cases with appropriate notice. Exercising your rights is free of charge. Upon an erasure request, we effectively delete data that we are not legally required to retain.

No automated decision-making: the site does not carry out processing involving automated decisions or profiling that produces legal or similarly significant effects on you within the meaning of Art. 22 GDPR. Any suggestion of the nearest local group happens on your device based on the postcode you enter and produces no decision about your rights.

Cookies

This website uses technical cookies and storage and, with prior consent, statistical tools. For details please see our Cookie Policy.

Changes to this policy

The controller may amend this policy, notifying users through this page. We recommend checking it periodically. The last-updated date is shown at the top of the page.

Contact

To exercise your rights or for any question regarding the processing of personal data you can contact:

• Email: email us
• Amnesty International Lazio — Via Ludovico di Savoia 2b (Spazio 3M), 00185 Rome, Italy