Privacy notice

1.Data Controller

The Data Controller is:

2.Categories of personal data processed

The personal data processed may include, by way of example:

• the user’s IP address and technical connection data (browser type, operating system, referring page);
• the text of messages sent to the «AI Advisor» virtual assistant and the answers generated;
• an anonymous session identifier, generated by the browser and kept in the device’s local storage;
• the e-mail address and any additional personal data contained in the message, if the user writes to the addresses published on the Website;
• for a donation: the e-mail address, the amount, the date and method of payment, the Stripe payment identifiers or the bank-transfer details (payer’s name, CRO/TRN reference);
• for a named receipt, in addition: first name, surname, codice fiscale (if you have one) and the details of the receipt issued — its number and date;
• for a personal invitation to donate: the e-mail address it was sent to.

The Data Controller invites users not to provide unnecessary personal data or data belonging to special categories pursuant to Articles 9 or 10 of the GDPR, particularly in the virtual assistant’s chat.

3.Purposes of the processing

Personal data are processed for the following purposes:

• to provide the virtual assistant’s answers and keep the context of the current conversation;
• to respond to requests for information, contact or assistance submitted by the user;
• to manage communications with the user following the submitted request;
• to keep the Website secure and prevent abuse of its automated services;
• to record donations, issue and send receipts and meet the related tax obligations;
• to send personal invitations to donate;
• to comply with legal obligations related to such communications.

4.Donations

Card, Apple Pay and Google Pay donations are received by Stripe on its own secure payment page. The Data Controller neither receives nor stores card details; Stripe processes payment data under its own privacy policy. From the Website Stripe receives only the e-mail address, the amount and the donation’s internal number — first name, surname and codice fiscale are not passed to Stripe.

The Website cannot see bank transfers: the treasurer records them from the bank statement (amount, date, payer’s name, transaction reference). If you send a receipt request after a transfer, its details are checked against the statement before the receipt is issued.

A named receipt is issued only on request. It is kept as a PDF document and sent to the address you give.

A personal invitation to donate is sent by the Congress or one of its departments to someone whose address it already has — for instance a previous donor or a participant in an event. A donation made through an invitation is marked with who sent it (the Congress, a department or a project). The invitation link carries only a random code, not your address.

A donation does not subscribe you to newsletters or marketing communications.

5.Legal basis for the processing

For the «AI Advisor» chat the legal basis is the legitimate interest of the Data Controller in responding to incoming requests and protecting the service from abuse (Article 6(1)(f) GDPR). No contractual relationship arises with a chat user, so pre-contractual measures are not invoked here.

For e-mail correspondence the legal basis is the performance of pre-contractual measures taken at the request of the data subject (Article 6(1)(b) GDPR) — for instance where cooperation or joining an association is concerned — alongside the same legitimate interest (Article 6(1)(f) GDPR).

Donations and receipts are handled at your request (Article 6(1)(b) GDPR), while keeping the accounting and tax records is required by law (Article 6(1)(c) GDPR).

In short, for each activity:

«AI Advisor» chat

Legal basisLegitimate interest (Article 6(1)(f) GDPR)

RetentionKept in our database with no automatic deletion; technical counters and the answer cache up to 24 hours

E-mail correspondence

Legal basisPre-contractual measures at your request (Article 6(1)(b) GDPR) — cooperation, joining an association; legitimate interest (Article 6(1)(f) GDPR)

RetentionKept in our database with no automatic deletion

Donation by card or bank transfer

Legal basisPerformance of your request (Article 6(1)(b) GDPR); accounting and tax obligations (Article 6(1)(c) GDPR)

RetentionKept in our database with no automatic deletion — at least for the record-keeping period set by Italian law (as a rule 10 years, Article 2220 of the Italian Civil Code)

Named receipt (ricevuta) for tax relief

Legal basisYour request for the receipt (Article 6(1)(b) GDPR); tax obligations (Article 6(1)(c) GDPR)

RetentionLikewise — no automatic deletion, at least 10 years

Personal invitation to donate

Legal basisLegitimate interest (Article 6(1)(f) GDPR)

RetentionTogether with the donation records, with no automatic deletion

Website security and abuse prevention

Legal basisLegitimate interest (Article 6(1)(f) GDPR)

RetentionUp to 24 hours; Cloudflare’s technical logs according to that provider’s policy

6.Methods of processing

Personal data are processed using electronic and/or telematic tools, according to logic strictly related to the purposes indicated and in compliance with the principles of lawfulness, fairness, transparency and data minimisation.

Appropriate technical and organisational security measures are adopted to prevent unauthorised access, loss or unlawful use of the data.

7.Provision of data

The provision of personal data is optional and at the discretion of the user; however, failure to provide the data indicated as necessary will make it impossible for the Data Controller to respond to the user’s request.

A card donation needs only an e-mail address. First name, surname and codice fiscale are needed only for a named receipt: without them that receipt cannot be issued, but the donation itself still can.

8.Data retention

Conversations with the virtual assistant are kept in our database and are not deleted automatically.

The technical counters that limit request frequency and carry the anonymous session identifier do not outlive their own window: 24 hours at most.

Requests to the language model and their answers pass through the Cloudflare AI Gateway, which caches them for up to 24 hours so the same request is not run twice.

Technical logs of the Cloudflare infrastructure carry the session identifier and the reformulated search query, and are retained according to that provider’s policy.

Donation records and issued receipts are accounting records. They are kept in our database and are not deleted automatically; Italian law requires keeping them for at least 10 years. An issued receipt is never altered or withdrawn.

Other personal data are likewise kept in our database and are not deleted automatically. You can ask for your data to be deleted at any time — see the section on your rights.

9.Communication and disclosure of data

Personal data will not be disclosed.

They may be communicated to external subjects acting as data processors pursuant to Article 28 GDPR, duly appointed by the Data Controller, exclusively for purposes related to the technical management of the Website, communications and receiving donations, as well as to the payment provider Stripe, which processes payment data under its own policy. At present these are:

Video thumbnails are loaded only on project pages that carry a map; the YouTube player itself starts only after the user clicks.

10.Transfer of data outside the EU

Two activities involve a transfer to the United States of America: the text of messages sent to the virtual assistant is transmitted to OpenAI, L.L.C., and donation e-mails (including the receipt, which carries the codice fiscale) are sent through the Resend, Inc. service.

Such transfers take place under the safeguards of Chapter V GDPR: on the basis of the European Commission’s adequacy decision (EU–U.S. Data Privacy Framework) for recipients certified under it, or of standard contractual clauses pursuant to Article 46 GDPR. Information on the safeguards applied, and a copy of them, may be requested at info@congressouait.com.

For this very reason users are asked not to enter unnecessary personal data into the chat. The other processing operations described in this notice take place within the European Union or under the same safeguards.

11.Automated decisions and artificial intelligence

The virtual assistant’s answers are generated automatically by a language model on the basis of the material published by the Congress.

This is not automated decision-making within the meaning of Article 22 GDPR: the answer is purely informational, produces no legal effects concerning the user and does not affect their rights. No profiling is carried out.

An answer may contain inaccuracies and does not replace advice from a lawyer or a doctor, nor an application to the competent authority.

12.Cookies and local storage

The Website uses no analytics, profiling or marketing tools.

Only strictly necessary technical means are used:

• the «cnaui_lang» cookie, which remembers the language you picked in the switcher. It lasts a year and exists only so the home page opens in that language instead of being negotiated afresh from your browser settings each time;
• Cloudflare Turnstile, the anti-abuse check that precedes the first message sent to the virtual assistant and the submission of the donation forms, which may set a technical cookie of its own;
• four local-storage entries of the virtual assistant: the anonymous chat session identifier, the outcome of the anti-abuse check, the dismissal of the chat prompt and the chat window size you chose;
• if you open a personal invitation to donate, a local-storage entry with its code, so the invitation is not lost if you come back later. It holds only the code, not your address;
• while you pay on Stripe’s page, the amount and e-mail address in the tab’s session storage, so the form reopens filled in after a cancelled payment. The entry is deleted as soon as you return to the Website, and in any case when the tab is closed.

These can be removed at any time by clearing the site data in the browser settings. They serve only to provide the service you are using, so no consent is required. Stripe’s own cookies apply on Stripe’s payment page, under its policy.

13.Minors

The Website and the virtual assistant are not directed at persons under 14 years of age (Article 2-quinquies of the Italian Personal Data Protection Code).

The Data Controller does not knowingly collect personal data of minors. Should a parent or guardian believe that a minor has provided such data, it is enough to write to the address above and the data will be deleted.

14.Rights of the data subject

The data subject may exercise at any time the rights provided for by Articles 15–22 GDPR, including:

• the right of access to personal data;
• the right to rectification or erasure;
• the right to restriction of processing;
• the right to object to processing;
• the right to data portability, where applicable.

Requests may be sent to the Data Controller at info@congressouait.com. Data the law requires us to keep — donation records and issued receipts — are not deleted before that period ends (Article 17(3)(b) GDPR); the rest is deleted or anonymised.

One point is raised separately: you have the right to object at any time to processing based on the Data Controller’s legitimate interest, including the processing of your messages in the chat (Article 21 GDPR).

15.Right to lodge a complaint

The data subject has the right to lodge a complaint with the competent Supervisory Authority — in Italy the Garante per la protezione dei dati personali — in accordance with Article 77 GDPR, should they consider that the processing of their personal data infringes the applicable legislation.