Privacy Policy GDPR 2016/679

ADD ODV

‘Members’ treatment
Information to interested parties

Categories and Data subject to Processing
The Processing concerns people who are currently or have been members of the Association in the recent past. ADIUVARE ODV deals with children and young people with type 1 diabetes; Therefore, ‘members’ are understood firstly to be children and young people, secondly to their parents. Members can also be adults who wish to join the association and/or engage as volunteers.
The data included in the Processing are or may be:
• for minors: name, surname, date and place of birth, tax code, date of onset, code. Healthcare, Exemption Code, ASL number, attending physician (with telephone), diabetologist.
• for parents/adults: name, surname, date and place of birth, email address, telephone number, requested/paid membership fees.
The Processing does not include explicit data relating to the minor’s health (type of pathology, therapy adopted, date of onset, quality of compensation). ADIUVARE ODV is however aware of the implicit link between a member’s registration and their health condition and therefore processes the data accordingly.

Purposes for which the data are collected and purposes of the Processing
The ‘Members’ Treatment is aimed at the management of the Members’ Books, the communication to the Insurance Agency for stipulation as per legal obligations; the convening and management of Shareholders’ Meetings and statutory bodies; the correct accounting management of the Association and communication with the Members. Some data are useful for the purposes of correct bureaucratic assistance and the management of educational stays.

Treatment Methods

The Owner enters member data and membership fee payments into the Microsoft Access database of a PC/MAC. The software acts as a membership register. The Data Controller also keeps the registration forms received in a closed place, not accessible without the relevant key.

Further Treatments

The data relating to name and surname complete with place and date of birth are shared with the Insurance Company for the relevant insurance coverage.

Consent to Processing
The Processing only concerns people who have taken an active part in requesting to be accepted as members. The Data Controller has consent issued by the Interested Parties and has sent them a Communication indicating possession of the data and reporting the right of access, rectification and cancellation. In the short term it will ask all new members to sign a consent pursuant to European Regulation 679/2016 GDPR.

Exercise of access, modification and cancellation rights
The Data Controller undertakes to comply immediately or within a maximum of 5 days with requests for access, rectification and deletion of personal data or opposition to further Processing if these come from the interested party. These rights are also accessible to interested parties under 18 but over 16 years of age.

Risks for the interested party and reduction measures
In the event of data loss, the damage to the privacy of the interested party would be very limited. In the event of undue access or dissemination of information, the damage would be significant: consequently ADIUVARE ODV had already arranged and undertaken some measures aimed at limiting the risk.
The data is not subject to further Processing by third parties (with the exclusion of Processing by the Insurance Company, limited to a few data).
The data is not shared with any natural or legal person external to the Association’s Board of Directors.
Within the Association, only the President and a second formally appointed person have access to the file and the documents containing the data and/or can update it.
The form is stored in a locked place. The member’s details are also entered into a Microsoft Access database protected by a password known only to the President and some members of the Board of Directors.

Legitimacy and legal basis of data processing
Considering that:
• HELP ODV has no other purpose than the psychophysical well-being, the best assistance and the defense of the rights of Members and more generally of young people with diabetes in the Territory
• the data is necessary for the best execution of the requested services
• the data will never be shared with any other Association or legal or natural person
• Security procedures are put in place that reduce the risk of improper access or disclosure of data
• the Data Controller has a legitimate interest in organizing personal data in order to carry out the procedures required by the Statute and to communicate with members
• it is possible at any time to exercise the right to access, modify and delete data
The Data Controller deems the data processing in question legitimate and compliant with the European Regulation for the protection of personal data 679/2016 and deem sand to have the legal basis to continue it.
The Data Controller is Associazione Adiuvare ODV, ETS with registered office via D. Manin, 30 21100 Varese (VA) tel. 339 1115783 e-mail: info@adiuvare.it
Having the means and skills, the Data Controller also operates as Data Processor.
The Data Controller, given the nature and scale of the data processed, does not deem it necessary to appoint a Data Protection Officer (DPO)

ADD ODV
‘Mailing list’ treatment and ‘Members’ treatment
Communication to interested parties

With the entry into force of the new European privacy legislation (General Data Protection Regulation 2016/627) we must remind you that we have some data (name, surname, e-mail address) that we use to send you newsletters and email communications.
• If you are also a member of ADIUVARE ODV, we remind you that we also have data relating to both the minor patient and possibly one or both of his parents, namely:
• for minors: name, surname, date and place of birth, tax code, date of onset, code. Healthcare, Exemption Code, ASL number, attending physician (with telephone), diabetologist.
• for parents/adults: name, surname, date and place of birth, email address, telephone number, requested/paid membership fees.
It is not necessary for you to renew the consent given. If you wish, you can read the information which will give you more information.
Obviously now and at any time you can ask us to:
• know which personal data we process about you;
• modify them;
• delete them in whole or in part.
We will carry out your instructions immediately.
In any case, you can easily cancel your subscription by activating the option included at the bottom of these communications.
The Data Controller is Associazione Adiuvare ODV, ETS with registered office via D. Manin, 30 21100 Varese (VA) tel. 339 1115783 e-mail: info@adiuvare.it
Responsible for the processing of the mailing list is WordPress c/o Automattic Ine. 60 29th Street #343 San Francisco,
Any reason for dissatisfaction may be reported by you to the Guarantor Authority for the protection of personal data, piazza Venezia 11 – 00187 Rome, tei.: 06.696771, e-mail: garante@gpdp.it.

ADD ODV
Treatments: ‘Members’, ‘mailing list and newsletter’, ‘WhatsApp and mail’
Consent form pursuant to European Regulation 679/2016 (GDPR)
1) 1 Data Controller will record the following data relating to the minor in the Shareholders’ Register (in electronic and paper version): name, surname, tax code, date of birth and residence. Failure to consent makes registration impossible.
2) We believe it is useful, although not essential, to process the following data relating to the minor: date of onset, code. Healthcare, Exemption Code, ASL number, attending physician (with telephone), diabetologist.
3) ADIUVARE ODV will record the following data relating to the member’s parents in the Members’ Register: name, surname, date of birth, tax code, postal address, requested/paid membership fees. Failure to consent to this registration makes registration impossible.
4) ADIUVARE ODV also wishes to process the e-mail address of one or both parents (and/or of the member if an adult) for the purpose of sending him communications on the Association’s activities. The email address will be used to send a newsletter or for individual communications. Failure to consent makes registration impossible
5) ADIUVARE ODV also wishes to process the mobile and/or landline telephone number of one of the two parents or both (and/or of the member if an adult) both to contact him individually and for the purpose of sending him communications via SMS or Whatsapp on the activities of the ‘Association.
6) ADIUVARE ODV would like to be able to send you letters and communications about its activity to your home. Letters may indicate the sender’s name on the envelope. Failure to consent makes it impossible to send you formal communications from the Association
7) ADIUVARE ODV must keep a paper copy of these same consent forms for a period of 10 years. Failure to consent to this Processing makes registration impossible.

We would also like to remind you that:
• now and at any time you can consult or request the Information relating to the various data processing at our office
• the data processed will not be shared with any other natural or legal person nor subject to further processing or processing.
• we reserve the right to use your home address or email address or telephone number only in a very moderate manner.
• at any time you can ask us to know what personal data we have about you, modify them, delete them in whole or in part. We will carry out your instructions immediately.
(Parent’s name and surname) _________________________________________
Born on ____/____/_____, in ______ ___________________in the province of (___),
Resident in _______________ _ _____________________in the province of (___),
Identification document__________________________
As a parent/guardian of the minor:
(Name and surname of the minor) ____________________________________________
Born on _/___ /___in__________________________________, in the province of (___),
Resident in __________________________________________, in the province of (__),
The Data Controller is Associazione Adiuvare ODV, ETS with registered office via D. Manin, 30 21100 Varese (VA) tel. 339 1115783 e-mail: info@adiuvare.it
Any reason for dissatisfaction may be reported by you to the Guarantor Authority for the protection of personal data, piazza Venezia, 11 -00187 Rome, tei.: 06.696771, e-mail: garante@gpdp.it.

ADD ODV

‘Mailing list and Newsletter’ processing
Information to interested parties

Categories and Data subject to Processing
The Processing concerns natural persons who
1) send to accounts with domain @adiuvare.it
2) receive individual emails from accounts with the @adiuvare.it domain
3) are present on a mailing list and receive periodic communications via e-mail from ADIUVARE ODV
The data included in the Processing are or may be:
 name, surname
 email address

Purposes for which the data are collected and purposes of the processing
The e-mail address is strictly necessary for sending the newsletter and for receiving or sending communications.
The name and surname allow the Data Controller to identify the interlocutor. The processing has the purpose of allowing the sending of the newsletter to the interested parties.
The majority of data were collected by ADIUVARE ODV with specific consent. The data is not subject to further Processing by third parties.

Processing carried out by the Owner
ADIUVARE ODV informs members and stakeholders about its activities and maintains dialogue with them through mailing lists. The data processed in these mailing lists are name, surname and email address. These mailing lists allow you to send communications to specific groups of interlocutors or to all interlocutors.

Consent to the data currently processed
Considering that
• the personal data was collected during registration and upon signing a consent form in accordance with the laws in force at the time
• the reception/sending/storing of messages is a foreseeable premise or consequence of every e-mail communication
• receiving periodic communications from the Association is one of the advantages of registering with ADIUVARE ODV
The Data Controller does not deem it strictly necessary to request new consent from the interested parties nor to subordinate the processing to the presence of explicit consent. It will take an active part in notifying all interested parties:
 which has certain categories of personal data relating to them
 the purposes of this Processing and its legitimacy
 the possibility for interested parties to know these data, modify them or request their cancellation

Consent to the data that will be processed
The Owner has drawn up a GDPR compliant consent form which will be submitted to all new members. The form will include a specific section and an independent consent for subscribing to the newsletter.

Exercise of rights
The Data Controller undertakes to comply within a maximum of 5 days with requests for access, rectification and deletion of personal data if these come from the interested party and has prepared a form available at its headquarters for this purpose. However, he will accept requests – provided they are written and signed – that reach him in any other way.

Risks for the interested party
In the event of destruction of the mailing list, the damage to the privacy of the interested party would be very limited. In case of improper access or dissemination of information, the damage would still be limited.

Risk minimization measures
The mailing list and email messages are accessible only through a secure and frequently changed password known to only two people in the Association.

Data breach
In the event that the Data Controller suffers theft of data and has reason to believe that these have been disclosed (data breach), he will activate – if necessary – a report to the Guarantor Authority and communicate the incident to all interested parties.

Legitimacy of Data Processing
The Processing in question involves an unlikely and very small risk to the customer’s privacy. However, considering that:
• the Owner has a legitimate interest in carrying out this activity which coincides with the interest of the Members and stakeholders
• through the newsletter the interested party receives information of interest to him free of charge
• the data processed are very few and necessary for the execution of the requested services
• the interested parties have been informed of the existence of processing of their personal data
it is possible at any time to exercise the right to access, modify and delete data
Owner believes that the data processing in question is legitimate and compliant with the spirit and letter of the European Regulation for the protection of personal data 679/2016 and believes it has the legal basis to continue it.

Owner, DPO Manager
The Data Controller is Associazione Adiuvare ODV, ETS with registered office via D. Manin, 30 21100 Varese (VA) tel. 339 1115783 e-mail: info@adiuvare.it
Having the means and skills, the Data Controller also operates as Data Processor.
The Data Controller, given the nature and scale of the data processed, does not deem it necessary to appoint un Data Protection Officer (DPO).

ADD ODV

‘School camps’ treatment
Information on Processing

Owner, Manager
The Data Controller is Associazione Adiuvare ODV, ETS with registered office via D. Manin, 30 21100 Varese (VA) tel. 339 1115783 e-mail: info@adiuvare.it
The joint controller of the Processing is the Pediatric Operational Unit of the F. del Ponte di Varese ASST Sette Laghi Hospital. Having the means and skills, the Controller also operates as Data Controller.
The Data Controller, given the scale of the data processed, does not deem it necessary to appoint a Data Protection Officer (DPO).

Categories and Data subject to Processing
The Treatment concerns children and young people, mostly minors, who take part – or have taken part in the recent past – in educational stays (school camps) organized by the U.O. of Pediatrics together with ADIUVARE ODV and possibly other subjects.
The Pediatric Diabetology Center selects eligible subjects and ensures the medical and healthcare management of the intervention, while ADIUVARE ODV collaborates in its organization and communication with families. Families are not necessarily members of ADIUVARE ODV.
The data included in the Processing are or may be:

for minors
• name and surname:
• sex:
• date of birth:
• Tax ID code:
• class:
for the parent:
• name and surname
• address
• Telephone and mobile phone
• email

ADIUVARE ODV takes care of submitting the Informed Consent forms specific for this intervention to the parents’ signature, also drawn up with the collaboration of the Pediatric Diabetology Centre, as well as keeping them safe. At the same time, ADIUVARE ODV requires explicit consent for the processing of this data and any photographic and video recordings.

Data collected but not processed
The Association, in order to lighten the bureaucratic and organizational burden that would otherwise fall on the pediatric team, is responsible for collecting in the name and on behalf of the medical team:
• health data (personal, physical or for example specific and use of devices by each member) via the SCHOOL CAMP HEALTH CARD form.

• Data relating to registration for the camp using the specific form
• authorization for healthcare personnel to carry out all medical interventions, including emergency ones
These forms, once completed before the school camp itself, are delivered to the medical team. The Association does not keep a copy or record of it. The Association understands that the medical team also destroys them at the end of the school camp itself.
The brevity of the data retention by ADIUVARE ODV and the absolutely ancillary role it plays means that there is therefore no processing of these personal data as described by the European Regulation 679/2016 (GDPR).
Purposes for which the data are collected and purposes of the Processing
Name and surname are obviously necessary. The date of birth and place of birth and residence are necessary in order to take out insurance for children for the period relating to the School Camp. It is also necessary to know telephone numbers and email addresses to be able to contact parents by telephone or with WhatsApp messages.

Treatment Methods
Personal data is recorded on the hard disk of the Owner’s portable PC/MAC. The data is also transcribed onto paper for the duration of the school camp. All informed consent/parental authorization forms are kept in a binder at the operational headquarters of ADIUVARE ODV.

Consent to the data currently processed
The Data Controller has a specific consent issued by the Interested Parties which summarily includes:
• the methods of Treatment
• the purposes of this Processing and its legitimacy
• the rights of the interested party (access, rectification, cancellation)

Exercise of rights
The Data Controller undertakes to comply immediately – or at the latest within 5 days – with requests for access, rectification and deletion of personal data or opposition to further Processing if these come from the interested party and has prepared for this purpose a form available at its headquarters . However, he will also accept requests – provided they are written and signed – that reach him in another way. These rights are also accessible to interested parties under 18 but over 16 years of age.

Risks for the interested party
In the event of data loss, the damage to the privacy of the interested party would be very limited. In the event of improper access or dissemination of information, the damage would be significant.

Risk minimization measures
Consequently, ADIUVARE ODV had already arranged and undertaken some measures aimed at limiting the risk.
The data is not subject to further Processing by third parties (with the obvious exclusion of the Medical Team). The data is not shared with any other external natural or legal person.
Inside the Association only the President and a second formally appointed person have access to the file and the documents containing the data and/or can update it.
To access the personal computer containing the data, a password known only to two people in ADIUVARE ODV is required, which is secure and changed frequently.
The personal computer is protected with the best and most up-to-date antivirus software.
The consents are kept in a locked place.

Duration of data processing
Personal data is destroyed three years after the School Camp

Data Breach
In the event that the Data Controller suffers data theft and has reason to believe that sensitive personal data has been disclosed (data breach) he will activate – if necessary – a report to the Guarantor Authority and communicate the incident to all interested parties. .

Legitimacy of Data Processing
The Processing in question involves a risk that is unlikely but sensitive to the customer’s privacy. However, considering that:
• HELP ODV has no other purpose than the psychophysical well-being, the best assistance and the defense of the rights of Members and, more generally, of young people with diabetes in its territory
• the data is necessary for the best execution of the school camps
• the data will never be shared with any other Association or legal or natural person
• Security procedures are put in place that reduce the risk of improper access or disclosure of data
• the Data Controller has a legitimate interest in organizing personal data in order to carry out the procedures required by the Statute and to communicate with members
• a detailed information has been prepared and made available to the interested parties and they have been asked to sign a consent pursuant to the GDPR
• it is possible at any time to exercise the right to access, modify and delete data
The Data Controller believes that the data processing in question is legitimized and complies with the spirit and letter of the European Regulation for the protection of personal data 679/2016 and believes it has the legal basis to continue it.

ADD ODV

‘Events’ treatment

Information to the interested party
The Treatment concerns ADIUVARE ODV members who register for one of the events directly organized by the Association. The data processed are the name and surname of the person who will participate in the event. The purpose is ex ante organizational and ex post verification of attendance.

Treatment Methods
1 member of ADIUVARE ODV who wishes to register communicates this, mainly via email, to the Association, giving only her name and surname. ADIUVARE ODV does not make or intermediate any bookings of hotel or transfer services.
Participation in the events is reserved for ADIUVARE ODV members and is free, therefore there is no accounting treatment.
ADIUVARE ODV keeps track of the names of the members who have registered and the people who will accompany them on an Excel sheet in order to size the spaces for the event. A paper copy of the registration list is printed on the day of the event.
If requested, ADIUVARE ODV draws up single copy certificates which certify the presence of the interested party at the event and which it delivers to the interested party. Uncollected Certificates are destroyed the following day.

Duration of Treatment
The list, in the paper version, is destroyed at the end of the event. The computer version is deleted two years after the event itself. Emails requesting registration and related confirmation emails are destroyed after three years.

Consent to the data currently processed
Data processing is implicit in the very choice to join the event. The Data Controller therefore does not believe it is necessary to proceed with requesting new consent from the people who participated. Considering the very short duration of the Processing and the limited number of data processed, the Data Controller does not intend to ask for consent even at the time of registration and will simply indicate this Processing in the registration forms that he will have signed.

Exercise of rights
The Data Controller undertakes to comply immediately or within a maximum of 5 days with requests for access, rectification and deletion of personal data or opposition to further processing if these come from the interested party and has prepared a form available at its headquarters for this purpose. However, he will also accept requests – provided they are written and signed – that reach him in another way.

ADD ODV

Treatment School camps the / Images
Consent form pursuant to European Regulation 679/2016 (GDPR)

ADIUVARE ODV (the Data Controller) collaborates with the U.O. of Pediatrics at the F. del Ponte Hospital in Varese in the organization of educational stays (school camps). Among other things, ADIUVARE ODV deals with:
1) Ensure the best communication with patients’ families. For this purpose it collects, shares (only with the staff present at the school camp) and holds for three years with rigorous security measures:
• for minors: name and surname, date of birth, tax code, class;
• for parents: name and surname, address, telephone and mobile phone, e-mail

The processing will take place electronically. Registration for the school camp requires your consent.
® I agree/we consent to your processing of this data.
2) HELP ODV would be pleased to take photographs and videos during the school camp or other events. In these images, despite the lack of captions with name and surname, your child may be recognisable. These images could be shared through social media or websites in contexts that still allow your child to be linked to the pathology. It cannot be ruled out that the image is ‘tagged’ by third parties and is therefore accessible via a search engine. Enrollment in the school camp is possible even without your consent to this Treatment.
® We consent to the Processing of photos and videos of our child. ® We do not agree
We would also like to remind you that:
• Now and at any time you can consult or request the Information relating to the various data processing at our office.
• At any time you can ask us to know the data we have in our possession, modify them or delete them in whole or in part. We will carry out your instructions immediately. However, it may not be possible to exercise this right from third parties who have shared the images on other social and web platforms.
• By signing this I/we declare that I have been able to access the Information for the Interested Party
Name and surname of the minor________________________________
(Father’s name and surname)________________________________
Signature. ________________
(Mother’s name and surname) ______________________________
Signature __________________
The Data Controller is Associazione Adiuvare ODV, ETS with registered office via D. Manin, 30 21100 Varese (VA) tel. 339 1115783 e-mail: info@adiuvare.it
Having the means and skills, the Data Controller also operates as Data Controller.
Any reason for dissatisfaction may be reported by you to the Guarantor Authority for the protection of personal data, piazza Venezia, 11 – 00187 Rome, tei.: 06.696771, e-mail: garante@gpdp.it.
The Data Controller, given the nature and scale of the data processed, does not deem it necessary to appoint a Data Protection Officer (DP0).

Risks for the interested party
In the event of loss or disclosure of data, the damage to the privacy of the interested party would be very limited. In any case, various measures are aimed at limiting the risk.
The data is not subject to further Processing by third parties.
The data does not reside nor is it backed up on external servers.
The data is not shared with any natural or legal person external to the Association.
Within the Association only specific formally indicated people have access to the file and the documents containing the data and/or can update it.
The PC/MAC containing the Excel file is protected by the most up-to-date antivirus software.

Legitimacy of Data Processing
The Processing in question involves a risk that is unlikely but sensitive to the customer’s privacy. However, considering that:
• the data is necessary for the best execution of the requested services
• the data will never be shared with any other legal or natural person
• Security procedures are put in place that reduce the risk of improper access or disclosure of data
• the Data Controller has a legitimate interest in organizing personal data in order to guarantee the organization of the event and that this interest coincides with that of the interested party
• a detailed information notice has been prepared and made available to interested parties
• it is possible at any time to exercise the right to access, modify and delete data
the Data Controller believes that the data processing in question is legitimate and compliant with the spirit and letter of the European Regulation for the protection of personal data 679/2016 and believes it has the legal basis to continue it.

Owner, Manager
The Data Controller is the Adiuvare ODV Association, ETS with registered office via D. Manin, 30 21100 Varese (VA) tel. 339 1115783 e-mail: info@adiuvare.it Having the skills and tools, the Data Controller also operates as Data Processor. ‬
The Data Controller, given the nature and scale of the data processed, does not deem it necessary to appoint a Data Protection Officer (DPO).

ADD ODV
‘WhatsApp’ data processing

Information to the interested party
ADIUVARE ODV (the Owner) usually uses the WhatsApp messaging platform for the purpose of exchanging messages with parent or adult members. Periodically the Owner uses WhatsApp to send the same message to multiple people.

Categories and Data subject to Processing
The Processing concerns adults who are currently or have been in the recent past members of the Association. The data is name, surname and mobile telephone number.

Purpose and Method of Data Processing
The data is recorded on the Owner’s smartphone. They are not shared with any other natural or legal person. The purpose of the Processing is to use a convenient, fast and welcome method of communication between the Association and Members. There is no further data processing.

Consent to Processing
The Data Controller only processes data of members. The Data Controller has requested express consent from the interested parties.

Transfer of data outside the European Union
The Owner does not currently have precise information on the exact location of the servers used by WhatsApp. Whatsapp servers do not retain messages or any attachments but only the metadata, i.e. the information relating to the fact that a message has been exchanged between two users.

Risks for the interested party and reduction measures
Improper access or disclosure of personal data contained in messages or the address book itself could lead to damage to your privacy.
Some risk reduction measures are already offered by the WhatsApp platform, for example the platform does not keep a copy of the messages exchanged and the messages travel with end to end encryption and are therefore impossible to intercept.
Furthermore, the Owner, if possible, deletes the surnames of the members from the address book on the smartphone. The Owner’s smartphone can only be opened by entering a password. Entering the password is required after a standby period.

Duration of data processing
The duration of the Treatment is limited. The Owner undertakes to delete all messages older than one year from the memory of his smartphone and to delete members who are no longer active after two years.

Legitimacy and legal basis of data processing
Considering that:
• the Data Controller has a legitimate interest in adopting a fast, convenient and free way to contact individual members and to send the same message to multiple members
• the members have given consent, even if not in compliance with the law, to be contacted via WhatsApp
• at any time, using the features of the platform, members can decide not to receive messages from the Owner
• WhatsApp offers maximum security in communications
• the Owner’s smartphone requires a password
• there are no further data processing
• a detailed information notice has been prepared and made available to interested parties
• the interested parties have been informed of the existence of processing of their personal data
• it is possible at any time to exercise the right to access, modify and delete data
the Data Controller believes that the data processing in question is legitimate and compliant with the spirit and letter of the European Regulation for the protection of personal data 679/2016 and believes it has the legal basis to continue it.

Owner and Data Processor
The Data Controller is Associazione Adiuvare ODV, ETS with registered office via D. Manin, 30 21100 Varese (VA) tel. 339 1115783 e-mail: info@adiuvare.it
Having the means and skills, the Data Controller also operates as Data Controller.
The Data Controller, given the nature and scale of the data processed, does not deem it necessary to appoint a Data Protection Officer (DPO).

ADD ODV
Treatment ‘Images
Information to interested parties
Owner, Manager, Dpo

The data controller called ‘Images’ is the Adiuvare ODV Association, ETS with registered office via D. Manin, 30 21100 Varese (VA) tel. 339 1115783 e-mail: info@adiuvare.it
Having the means and skills, the Data Controller also operates as Data Controller.
The Data Controller, given the scale of the data processed, does not currently consider it necessary to appoint a Manager and for data protection (DPO).
Categories and Data subject to Processing
The Processing concerns images (photos or videos) of children and young people, mostly of minor age. They are often accompanied by the name, never the surname. The object of the Processing is also the consent form signed by the parents.

Purpose and methods of processing
The images are taken by people specially appointed by the Owner who deliver them to the Association to a single person specifically appointed. These people undertake to delete the images from their media once they have been delivered to the Association.
The person in charge selects the images by deleting those that include minors from whose parents she has not received authorization, unnecessarily large images, where the minors are clearly associated with the pathology and in general duplicates.
The remaining images are kept on the Association’s PC/MAC or in a folder protected by a second password known to only 2 people in the Association. Any images shared on electronic media will be deleted as soon as possible (six months) after publication.
The consent forms are kept in paper form in a special filing cabinet at the ADIUVARE ODV headquarters and are instead destroyed if they are not published.

Consent to the data currently processed
The Data Controller has specific consent issued by the interested parties. Soon ADIUVARE ODV will request specific GDPR consent from both parents.

Exercise of access, modification and cancellation rights
At any time, through a specific form or in the way you prefer, you can ask us if we have your personal data and which ones, to modify them or delete them in whole or in part. We will immediately carry out what you request. These images could be shared through social media or websites even without the authorization of ADIUVARE ODV and it may be impossible to delete them.

Risks for the interested party
The images published could, through context, link the minor to the diabetic pathology.
In these images the person with diabetes is recognizable and although ADIUVARE ODV never mentions them with their name and surname (and often not even with their name), it happens that the image is ‘tagged’ by the interested parties themselves or by third parties and is therefore immediately associated with other images, other content and a name and surname.
Given that ADIUVARE ODV believes that both discrimination and reluctance and any form of “shame” associated with type 1 diabetes must be overcome, the choice to share this aspect of one’s life selectively must still be respected.
It is possible that these images are shared through social media or third-party websites even without the authorization of ADIUVARE ODV. It is also possible for images to be indexed by search engines. This identification may be unwelcome and may remain possible even when the minor reaches the age of majority.

Risk reduction measures
HELP ODV in requesting consent from both parents warns them and asks them to expressly take note of the criticality and risks that this data processing entails.
ADIUVARE ODV is ready to immediately delete the images from its social and web pages upon request of parents.
ADIUVARE ODV will also process cancellation requests from interested parties under the age of 18 but over 16 years of age and will seriously consider requests also received from persons of a younger age.
The request will be executed even if the image portrays other people besides the requester.
ADIUVARE ODV, having received a cancellation request, will take an active part in notifying the request to the third-party Data Controllers who have processed the image.

Duration of data processing
The vast majority of images are deleted from social pages 6 months after their publication.

Legitimacy and legal basis of data processing
The Processing in question entails a significant risk for the minor’s privacy. However, ADIUVARE ODV has a legitimate interest in reporting on its social pages images of children and young people with diabetes who participate in its initiatives or who in any case express positive emotions and serenity. ADIUVARE ODV believes that – in addition to the legitimate pride and satisfaction of the parents (and sometimes of the minors themselves) – the publication of these images represents a message of hope and support for parents who, especially at the onset of the disease, doubt the quality of life that awaits their children.
Given that the presence of these images ensures a preponderant share of the traffic on its social pages, ADIUVARE ODV believes it has a legitimate interest in keeping the number of accesses high also to ensure the necessary feedback on its communications and own first activities
Considering these legitimate interests which coincide with those of the parents who submit the images for publication and considering that:
ADIUVARE ODV received consent and an explicit and specific request for publication from both parents
The duration of publication is limited
The images will never be shared with any other association or legal or natural person (unless prior authorization from the parents)
The minor’s parents were asked to sign a GDPR consent document listing the risks associated with publication
it is possible at any time to exercise the right to access, modify and delete data according to the European Regulation for the protection of personal data 679/2016 and believes it has the legal basis to continue it
The Data Controller is Associazione Adiuvare ODV, ETS with registered office via D. Manin, 30 21100 Varese (VA) tel. 339 1115783 e-mail: info@adiuvare.it
Having the skills and tools, the Data Controller also operates as Data Processor.
The Data Controller, given the nature and scale of the data processed, does not deem it necessary to appoint a Data Protection Officer (DPO)

“Online courses” treatment on the adiuvare.it web platform
Information to interested parties

Categories and Data subject to Processing
The Processing concerns natural persons who
1) send to accounts with domain @adiuvare.it
2) receive individual emails from accounts with domains @adiuvare.it and @gmail.it
3) register through the web platform for online courses on the platform
The data included in the Processing are or may be:

name surname
email address
Home school
Purposes for which the data are collected and purposes of the processing
The email address is strictly necessary for shipping to receive or send communications.
The name and surname allow the Data Controller to identify the interlocutor. The processing has the purpose of allowing access to the course to the interested parties.
The majority of data were collected by ADIUVARE ODV with specific consent. The data is not subject to further Processing by third parties.

Processing carried out by the Owner
ADIUVARE ODV can send information to subscribers via the email provided. The wordpress platform, hosted at Netsons s.r.l. manages registration and login including data storage.

Consent to the data currently processed
Considering that:
• the personal data were sent voluntarily through the appropriate registration form, having previously accepted the Adiuvare privacy policy
• the reception/sending/storing of messages is a foreseeable premise or consequence of every e-mail communication

The Data Controller does not deem it strictly necessary to request new consent from the interested parties nor to subordinate the processing to the presence of explicit consent. It will take an active part in notifying all interested parties:

which has certain categories of personal data relating to them
the purposes of this Processing and its legitimacy
the possibility for interested parties to know these data, modify them or request their cancellation
Consent to the data that will be processed
The Data Controller has drawn up a consent form in accordance with the GDPR which is subjected to acceptance during the registration phase

Risks for the interested party
In the event of destruction of the database, the damage to the privacy of the interested party would be very limited. In case of improper access or dissemination of information, the damage would still be limited.

Risk minimization measures
The database is accessible only through a secure and frequently changed password known to only two people in the Association.

Data breach
In the event that the Data Controller suffers theft of data and has reason to believe that these have been disclosed (data breach), he will activate – if necessary – a report to the Guarantor Authority and will communicate the incident to all interested parties.

Legitimacy of Data Processing
The Processing in question involves an unlikely and very small risk to the customer’s privacy. However, considering that:
• the Owner has a legitimate interest in carrying out this activity which coincides with the interest of the members
• through the online course the interested party receives information of interest to him free of charge
• the data processed are very few and necessary for the execution of the requested services
• the interested parties have been informed of the existence of processing of their personal data and that it is possible at and moment exercise the right to access, modify and delete data at any time, the
Owner believes that the data processing in question is legitimate and compliant with the spirit and letter of the European Regulation for the protection of personal data 679/2016 and believes it has the legal basis to continue it.