Privacy Notice for the Processing of Users’ Personal Data

This Privacy Policy describes how the website collects, uses, stores, and protects the personal data of users who browse its pages or interact with the available services.

The processing of personal data is carried out in compliance with EU Regulation 2016/679, known as the GDPR, and applicable national legislation on personal data protection.

The purpose of this notice is to provide users with clear and transparent information regarding what data may be collected, the purposes for which it is used, how long it is retained, and the rights that may be exercised.

The data controller, hereinafter referred to simply as the “Controller,” is:

INSPIRE s.r.l.
Via Consolare Valeria, SNC – 98124 Messina (ME)
Policlinico G. Martino, PAD. G – Piano 5° – Stanze 33-34
C.F. e P.IVA: 03622420838 | amministrazione@inspire-srl.it | inspire_srl@pec.it

Subject matter, purposes, and legal basis of the processing

The Data Controller, in the course of the activities it is required to perform, processes certain personal data, including data belonging to special categories (hereinafter referred to for brevity as “sensitive data”).

Processing is always carried out in compliance with the principles of the Regulation: fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality. Depending on the processing activities and the nature of the data processed, the Data Controller acts either with or without your explicit consent, as described below.

  1. A) Consent not required: Explicit consent is not required for the processing of personal and sensitive data necessary for the performance of tasks carried out in the public interest by the Data Controller.
  2. B) Required consent: Processing operations requiring explicit consent include those related to services offered by the Data Controller and/or explicitly requested by the data subject that are not directly linked to the performance of tasks of corporate interest entrusted to the Data Controller.

The various scenarios are listed below:

Browsing data

During normal use of the site, the computer systems and software procedures responsible for its operation may acquire certain technical data, the transmission of which is implicit in the use of Internet communication protocols.

This category includes, for example:

  • IP address or technical identifiers of the device used;
  • browser type and operating system;
  • date and time of the visit;
  • pages consulted;
  • addresses of the requested resources in URI notation;
  • time spent on the site;
  • data regarding interaction with the pages.

This data is primarily used to ensure the proper functioning of the site, obtain aggregated and anonymous statistical information, enhance security, and prevent potential abuse or fraudulent activity.

Data provided voluntarily by the user

Users may voluntarily provide certain personal data, for example by writing to the email address listed on the site or by filling out contact forms.

In these cases, data such as the following may be processed:

  • first name and surname;
  • e-mail address;
  • telephone number, if provided;
  • content of the sent message;
  • any other information voluntarily provided by the user.

Providing this data is optional, but failure to do so may make it impossible to respond to the user’s requests or provide the requested service.

Comments

When visitors leave comments on the site, we collect the data shown in the comments form, as well as the visitor’s IP address and browser user agent string, to help detect spam.

An anonymized string created from your email address (also known as a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After your comment is approved, your profile picture is visible to the public in the context of your comment.

Media

If you upload images to the website, you should avoid uploading images that include embedded location data (EXIF GPS). Website visitors can download and extract any location data from the images on the website.

Cookies and tracking tools

The site may use technical cookies, statistical cookies, and third-party tracking tools. Non-technical cookies—such as statistical or marketing cookies—are used only with the user’s consent, where required by applicable law.

For the full Cookie Policy, please consult the dedicated section.

Processing of Personal Data – Website

pursuant to Art. 13 of EU Regulation 2016/679 (“GDPR”)

In accordance with the provisions of European Regulation 2016/679 (Ref. Law 1)—hereinafter referred to as the “Regulation”—and Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 (Ref. Law 2)—hereinafter referred to as the “Code”—the processing of your personal data will be based on principles of fairness and transparency and carried out through the adoption of appropriately identified technical and organizational measures designed to ensure the confidentiality, accuracy, and integrity of your data, as well as your full exercise of your rights.

1. Subject matter, purposes, and legal basis of the processing

The processing operations regarding the personal data indicated in this notice are necessary for the performance of tasks in the company’s interest, as established by Article 6, paragraph 1, point (e) of the Regulation.

Purposes of processing

The personal data collected through the site are processed for the following purposes:

  • enable the proper technical functioning of the site;
  • respond to requests sent by users;
  • provide information on the Association’s services;
  • ensure the security of the site and prevent spam, abuse, or automated access;
  • analyze site usage through aggregated statistics;
  • improve content, functionality, and the browsing experience;
  • comply with legal obligations or requests from competent authorities;
  • protect the rights and legitimate interests of the Data Controller.

Legal basis for processing

The processing of personal data is based, depending on the circumstances, on one or more of the following legal bases:

User consent: For the use of statistical cookies, non-technical tracking tools, and third-party services that require consent.

Performance of pre-contractual or contractual measures: When processing is necessary to respond to a user request or provide a requested service.

Legal obligation: When processing is necessary to comply with obligations established by laws, regulations, or requests from competent authorities.

Legitimate interest of the Data Controller: To ensure the security of the site, prevent abuse, handle potential disputes, and improve the functioning of the services offered, while always respecting the user’s fundamental rights and freedoms.

Below are the details regarding the types of data collected.

Browsing data

The IT systems and software procedures responsible for the operation of the Institute’s website acquire, during their normal course of operation, certain personal data the transmission of which is implicit in the use of Internet communication protocols.

This category of data includes the IP addresses or domain names of the devices used by users, the URI/URL addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server’s response, and other parameters regarding the user’s operating system and computing environment.

This data is processed solely for the purpose of obtaining anonymous statistical information regarding the use of the services or to verify their proper functioning.

Data provided by the user

The optional, voluntary, and explicit sending of messages to the Institute entails the acquisition of the sender’s contact details (email address) as well as any personal data included in the communications. Messages are stored in the Institute’s email archive, and the information contained therein is used solely for the purpose of responding; use for marketing purposes is excluded.

Users

The personal data of users registered on the Institute’s website (first name, surname, email address, and username) are subject to processing.

Each user can view, edit (with the exception of the username, which cannot be changed), or delete their personal data at any time. Site administrators can view, edit, and delete this data.

Mailing list or newsletter

Upon registration for the mailing list or newsletter, the User’s email address is automatically added to a contact list to which emails containing information—including information of a commercial and promotional nature—regarding this Website may be sent.

The User’s email address may also be added to this list as a result of registering on this Website.

Interaction with social networks and external platforms

If implemented, these types of services allow for interactions with social networks or other external platforms directly from the pages of this Website.

Interactions and information obtained through this Website are, in any case, subject to the User’s privacy settings on each social network.

If a social network interaction service is installed, it is possible that the service may collect traffic data regarding the pages where it is installed, even if Users do not use the service.

Cookies and other tracking technologies

The Institute’s website uses session cookies (non-persistent) strictly limited to what is necessary for secure and efficient web browsing. The storage of such cookies on devices or in browsers is under the user’s control, whereas on the servers, upon the conclusion of HTTP sessions, cookie information is recorded in service logs.

2. Source, processing methods, and access to data

The processing of personal data belonging to website users is carried out in accordance with the principles set forth in Article 5 of the Regulation. Processing is performed using electronic and digital tools, employing methods designed to ensure the security, integrity, and confidentiality of personal data at all times. In particular, security measures have been implemented to prevent unauthorized access to, disclosure, alteration, or destruction of the data.

To prevent the risk of accidental loss of personal data, the hosting service provider performs a daily data backup. In addition, a periodic manual backup is carried out.

Personal data processing operations are carried out at the premises of the Data Controller and the Data Processors, wherever they are located, provided they are within the European Union.

Personal data are processed for the time necessary to fulfill the purposes described in this notice or, in any event, within the timeframes prescribed by the regulations applicable to the aforementioned activities.

Processing methods

Personal data is processed using electronic and telecommunications tools, employing organizational methods and logic strictly related to the purposes indicated in this notice.

The Data Controller implements appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction.

Access to the data may be granted, within the limits of their respective duties and purposes, to:

  • parties authorized by the Data Controller;
  • technical service providers;
  • hosting provider;
  • companies or professionals assisting the Data Controller in managing the website;
  • third-party service providers integrated into the site.

Where necessary, such parties shall be appointed as Data Processors pursuant to Art. 28 of the GDPR.

3. Communication and dissemination of data: recipients and categories of recipients

The personal data collected may be processed by the company’s personnel or collaborators who, in the performance of their duties, act based on specific instructions regarding the purposes and methods of processing—as set out in the documents designating them as persons authorized to process data, pursuant to Art. 4, point 10 of the Regulation.

The primary recipient of the data processed following access to and browsing of the website is the designated hosting service provider, appointed as an external data processor pursuant to Article 28 of the Regulation. The provider’s personal data processing policy is published on its own website.

4. Place of processing and data transfer to a third country and/or an international organization

Personal data is stored on servers located within the European Union. The Data Controller excludes the transfer of data to servers located outside the EU.

The data is processed at the Data Controller’s operating offices and on the servers or infrastructure of the service providers used.

Certain third-party services—particularly those provided by Google, Vimeo, or other technology providers—may involve the transfer of data to countries located outside the European Economic Area.

In such cases, the transfer takes place in compliance with the safeguards provided for by the GDPR, such as adequacy decisions, standard contractual clauses approved by the European Commission, or other appropriate measures provided for by applicable law.

In the specific case of Google Analytics 4, Google states that data from devices located in the European Union is collected via domains and servers within the EU before being forwarded to Analytics servers for processing.

5. Nature of the provision of data and consequences of refusing to respond

Unless otherwise specified, all data requested by this Website is mandatory. If the User refuses to provide it, it may be impossible for this Website to provide the Service. In cases where this Website specifies that certain data is optional, Users are free to refrain from providing it without any consequences on the availability or operation of the Service.

6. Rights of the data subject and procedures for exercising them

In your capacity as the data subject, you have the rights set forth in Article 15 of the Regulation, specifically the rights to:

  1. obtain confirmation as to whether or not personal data concerning you exist, even if not yet recorded, and their communication in an intelligible form;
  2. obtain the indication:
    1. the source of the personal data;
    2. of the purposes and methods of the processing;
    3. of the logic applied in the case of processing carried out with the aid of electronic tools;
    4. of the identifying details of the controller, the processors, and the designated representative pursuant to Article 3, paragraph 1, of the GDPR;
    5. of the persons or categories of persons to whom the personal data may be communicated or who may become aware of them in their capacity as designated representative within the territory of the State, data processors, or persons in charge of processing;
  3. obtain:
    1. the updating, rectification, or—where there is an interest—the supplementation of the data;
    2. the erasure, anonymization, or blocking of data processed in violation of the law, including data whose retention is unnecessary in relation to the obligations incumbent upon the Data Controller;
    3. confirmation that the operations referred to in points (a) and (b) have been notified—including with regard to their content—to those to whom the data were communicated or disseminated, unless this proves impossible or involves an effort that is manifestly disproportionate to the right being protected;
  4. object, in whole or in part, on legitimate grounds, to the processing of personal data concerning you, even if relevant to the purpose of collection, subject to the consequences described in Section 6 of this document;
  5. withdraw consent previously granted for processing for a specific purpose.

To exercise your rights, you may contact either the Data Controller or the Data Protection Officer—without observing any particular formalities—using the contact details previously indicated. You also have the right to lodge a complaint with the Supervisory Authority.

Right to object

When processing is based on the Controller’s legitimate interest, the user has the right to object to the processing on grounds relating to their particular situation.

Should the data be processed for direct marketing purposes, the user would have the right to object at any time, free of charge and without providing a reason. In such a case, the data will no longer be processed for those purposes.

Minors

The site is not specifically aimed at minors and does not knowingly collect personal data relating to minors.

Should the Data Controller become aware of the inadvertent collection of personal data concerning minors, it will take reasonable measures to delete such data, unless otherwise required by law.

7. Data retention period

Personal data are retained for the time strictly necessary to achieve the purposes for which they were collected.

In particular:

  • data submitted via contact requests is retained for the time necessary to handle the request and any subsequent requirements;
  • technical and security data are retained for the time necessary to ensure the proper functioning and protection of the site;
  • data collected via statistical tools are stored in accordance with the settings of the services used;
  • data processed based on consent is retained until consent is withdrawn, subject to legal obligations or the need for further legitimate retention.

At the end of the retention period, the data will be deleted or anonymized, unless legal obligations require longer retention.

8. Third-party services used by the site

The site uses certain services provided by third parties. These services may collect personal or technical data in accordance with their respective privacy policies.

8.1 Google Site Kit

The site uses Google Site Kit, Google’s official WordPress plugin, to connect and manage certain Google services directly from the site’s administration panel.

Google Site Kit can be used to integrate services such as:

  • Google Analytics 4;
  • Google Search Console;
  • any other Google tools connected to the site.

Google identifies Site Kit as the official WordPress plugin for setting up the Google tag and connecting to existing Google Analytics properties.

The use of Site Kit does not in itself alter the purposes of data processing, but enables the site to integrate Google services for analytics, technical monitoring, and usage statistics.

8.2 Google Analytics 4

The site uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, to collect statistical information on site usage.

Google Analytics 4 enables the Data Controller to understand, in aggregate form, how users interact with the site, which pages are visited, the devices used for browsing, and which content proves most useful or frequently viewed.

Google Analytics 4 can process, among others, data relating to:

  • pages visited;
  • navigation events;
  • interactions with the site;
  • device used;
  • browser and operating system;
  • approximate geographical area;
  • session duration;
  • traffic source;
  • aggregated statistics on site usage.

Google states that Google Analytics 4 does not log or store IP addresses.

Google Analytics 4 is used on the site subject to user consent—where required—obtained via a cookie banner and the management of tracking preferences.

8.3 Google Consent Mode v2

The site may use a configuration compatible with Google Consent Mode v2 to communicate to Google the user’s consent status regarding the use of cookies and tracking tools.

Google Consent Mode allows Google tags to adjust their behavior based on user choices. Specifically, it can handle signals regarding features such as analytics storage, ad storage, and consent for data usage for advertising purposes. Official Google documentation lists `analytics_storage`, `ad_storage`, `ad_user_data`, and `ad_personalization` among the Consent Mode parameters.

For users in the European Economic Area, the United Kingdom, and Switzerland, Google requires that appropriate information be provided and consent obtained—where required—for the use of cookies or other local storage technologies and for the collection, sharing, and use of personal data.

The user can accept, reject, or modify their preferences via the cookie banner or the consent management panel on the site.

8.4 Google reCAPTCHA

The site may use Google reCAPTCHA, a service provided by Google Ireland Limited, to protect forms, pages, or features against spam, bots, and malicious automated use.

Google reCAPTCHA analyzes certain information regarding the user’s interaction with the site in order to distinguish human access from automated access.

The service may process data such as:

  • IP address;
  • browser information;
  • technical data of the device;
  • page interactions;
  • mouse movements, clicks, or other signals useful for protection against automated traffic.

8.5 Google and Adobe Fonts

The site may use Google Fonts, a service provided by Google Ireland Limited, to display typefaces and enhance the visual appearance of the pages.

When Google Fonts are loaded from Google servers, the user’s browser may establish a connection with Google’s servers and transmit technical data necessary for loading the font, such as the IP address and browser information. The Data Controller also commits to hosting Google Fonts and other types of fonts, such as Adobe Fonts, locally whenever possible.

8.6 Google Maps

The site may embed interactive maps via Google Maps, a service provided by Google Ireland Limited.

Google Maps allows you to view places, routes, maps, and geographic information directly within the site’s pages.

When the user views a page containing a Google map, Google may collect technical data and information regarding interaction with the service, in accordance with its privacy policy.

8.7 Vimeo and YouTube

The site may embed videos hosted on the Vimeo and YouTube platforms, managed by Vimeo, LLC and Google Ireland Limited, respectively.

When a user views a page containing an embedded video, platforms may collect technical data and usage data related to the viewing of the content.

9. Cookie Policy and consent management

The site uses cookies and tracking tools for various purposes.

Cookies can be classified as follows:

Technical cookies

They are necessary for the proper functioning of the site and do not require user consent. They enable, for example, navigation, security, preference management, and the operation of essential features.

Statistical cookies

They are used to collect aggregated information about site usage, for example via Google Analytics 4.

These cookies are activated only with the user’s prior consent, except in cases where configurations render them fully anonymous in accordance with applicable regulations.

Third-party cookies

These are cookies or tools set by external services integrated into the site, such as Google Maps, Vimeo, Google reCAPTCHA, or other similar services.

Users can manage their preferences via the cookie banner on the site. In particular, they can:

  • accept all cookies;
  • reject non-essential cookies;
  • customize preferences;
  • modify or withdraw consent at any time.

To better align with Google policies, the cookie banner should clearly indicate the presence of Google services, explain the purposes—such as analytics/statistics and, where applicable, advertising—and prevent the loading of non-essential tags prior to obtaining consent. Indeed, Google specifies that, to comply with the EU User Consent Policy, consent must be obtained where required for cookies or other forms of local storage, as well as for the collection, sharing, and use of personal data.

Loading non-essential tags prior to consent. Google specifies that, to comply with the EU User Consent Policy, it is necessary to obtain consent—where required—for cookies or other forms of local storage, as well as for the collection, sharing, and use of personal data.

Links to external sites

The site may contain links to external websites, platforms, or services not directly managed by the Data Controller.

The Data Controller is not responsible for the privacy practices adopted by such third parties. Users are encouraged to consult the respective privacy policies before providing personal data or using such services.

10. Data security

The Data Controller implements appropriate technical and organizational measures to protect the personal data processed through the site.

Such measures are aimed at preventing:

  • unauthorized access;
  • loss or alteration of data;
  • unauthorized disclosure;
  • improper uses;
  • compromise of computer systems.

Despite the implementation of appropriate security measures, no computer system can guarantee absolute security. Users are therefore advised to use secure devices, reliable networks, and adequately protected credentials when interacting with the site.

11. System logs and maintenance

For reasons related to the site’s operation, security, and maintenance, system logs—files recording technical events and interactions with the site—may be collected.

Logs may contain data such as the IP address, date and time of the request, requested page, browser used, and any technical errors.

The original text already provided for the possibility that the site and third-party services collect system logs for operational and maintenance purposes.

Regulatory references

Leg. Ref. 1
EU Regulation 2016/679 “General Data Protection Regulation”

Leg. Ref. 2
Legislative Decree 101/2018 “Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)”

Leg. Ref. 3
Presidential Decree 445/2000 “Legislative provisions concerning administrative documentation”

UPDATES TO THIS PRIVACY AND COOKIE POLICY

The Data Controller reserves the right to make changes to the Site and to this Privacy Policy and Cookie Policy at any time.

The user must always refer to the text published online as the current version.
Changes will become effective upon their publication on the Site.
Continued use of the Site by the user following a change will be deemed acceptance of such changes.

All users may check the latest updated version of the Privacy Policy and Cookie Policy at any time by visiting the Site.