Privacy Policy

Last updated: 2026-07-06

Data controller

The data controller is Amnesty International — Italian Section, a Volunteer Organisation (OdV) registered with the Italian Single National Register of the Third Sector (RUNTS), tax code 03031110582, with offices at Via Ludovico di Savoia 2b (Spazio 3M), 00185 Rome, Italy. This website is run by the Lazio regional structure ("Amnesty International Lazio"), a territorial branch of the controller with no separate legal personality.

Email: email us

Data Protection Officer (DPO)

The controller has appointed a Data Protection Officer. You may contact the DPO on any matter relating to the processing of your personal data and the exercise of your rights, by writing to the controller at the address in the "Contact" section, marking your message "For the attention of the DPO".

Data collected

Depending on your interaction, the following categories of personal data may be collected:

• Browsing data: IP address, browser and device type, operating system, pages visited and access time, collected by technical systems and statistical tools (the latter only with consent where not strictly technical).
• Data provided voluntarily via forms: name, surname, email address and — depending on the form — phone, postcode, age range, area of interest and message content (contact form, activism sign-up, newsletter subscription).
• Proof of consent: for newsletter subscriptions we record the date/time, IP address and user-agent at the moment consent is given, solely to demonstrate that consent was obtained (accountability principle, Art. 7 GDPR).

Purpose of processing

Personal data is processed for the following purposes:

• Responding to requests sent through the contact form.
• Managing activism sign-ups and directing you to the nearest local group.
• Managing newsletter subscriptions and sending communications about the association's activities.
• Analysing site usage in statistical form to improve functioning and content (only with consent).
• Ensuring site security and preventing abuse/spam on forms.
• Complying with legal obligations.

Legal basis

Processing is based on the following legal grounds:

• Consent (Art. 6(1)(a) GDPR): for newsletter subscription and non-technical statistical cookies/tools.
• Legitimate interest (Art. 6(1)(f) GDPR): for the technical functioning and security of the site and abuse prevention.
• Responding to a request (Art. 6(1)(b) GDPR): to reply to messages and manage sign-ups.
• Legal obligation (Art. 6(1)(c) GDPR): where required by applicable law.

Recipients and processors

Data is not disclosed or sold to third parties for their own purposes. To deliver the service, the controller relies on suppliers acting as data processors (Art. 28 GDPR), including:

• Cloudflare, Inc. — website hosting/CDN, security and anti-abuse protection (Turnstile), aggregate statistics (Cloudflare Web Analytics, cookieless).
• Google LLC / Google Ireland — forms and collection sheets infrastructure (Google Apps Script, Google Sheets), service emails and, as a backup anti-spam system, Google reCAPTCHA.
• Mailjet / Sinch — sending newsletter emails and managing the related lists.
• OpenStreetMap Foundation — map tiles (loaded only after an explicit user action).

An up-to-date list of processors and their contact details can be requested from the controller.

Transfers to third countries (outside the EU)

Some suppliers (including Google and Cloudflare) may process data outside the European Economic Area, in particular in the United States. Where this occurs, transfers are based on appropriate safeguards under Articles 44 ff. GDPR, such as the "EU-US Data Privacy Framework" adequacy decision and/or the European Commission's Standard Contractual Clauses, with any supplementary measures.

Data retention

Data is kept only as long as necessary for the stated purposes:

• Contact form: up to 24 months from the request.
• Activism sign-up: for as long as needed to manage the contact and any involvement, and in any case up to 24 months from the last contact, or until a deletion request if earlier.
• Newsletter: until consent is withdrawn or you unsubscribe (unconfirmed subscriptions are deleted within 15 days). On unsubscribe, the proof of consent — IP address and user-agent — is deleted.
• Statistical data: for as long as needed for aggregate analysis; session identifiers last only for the session.
• Reserved area (volunteers/activists): login and profile data are kept for the duration of the membership or collaboration; security logs (access logs with IP and user-agent) are automatically deleted within 180 days, and technical anti-abuse IP addresses within 12 months.

Data subject rights

Pursuant to Articles 15-22 of the GDPR, you have the right to:

• Access your personal data and obtain a copy.
• Request rectification of inaccurate or incomplete data.
• Request erasure of personal data (right to be forgotten).
• Restrict the processing of your data.
• Object to data processing.
• Request data portability.
• Withdraw consent at any time, without affecting the lawfulness of processing based on consent given before withdrawal.
• Lodge a complaint with the Italian Data Protection Authority ( www.garanteprivacy.it ).

Cookies

This website uses technical cookies and storage and, with prior consent, statistical tools. For details please see our Cookie Policy.

Changes to this policy

The controller may amend this policy, notifying users through this page. We recommend checking it periodically. The last-updated date is shown at the top of the page.

Contact

To exercise your rights or for any question regarding the processing of personal data you can contact:

• Email: email us
• Amnesty International Lazio — Via Ludovico di Savoia 2b (Spazio 3M), 00185 Rome, Italy