Information on the processing of personal data

1. Date controller

The data controller is:

For requests concerning personal-data protection, please write to:

privacy@onirion.it

The Association may appoint one or more internal contacts to handle privacy matters operationally, without being required to publish their names, unless a Date Protection Officer is formally appointed in the cases provided for by law.

2. Categories of data processed

The following categories of data may be processed as part of the pre-registration procedure:

• first name, surname, date and place of birth;
• citizenship, residence and address;
• tax code for Italian citizens or identification-document number for foreign citizens, including the national document of the country of citizenship, identity card, passport, driving licence or residence permit where applicable;
• email address and telephone number;
• information concerning legal age;
• sex, stated preferences and information voluntarily entered in the form;
• special requirements communicated by the data subject;
• answers to the questionnaire;
• documents and images uploaded for identity verification;
• information concerning the application for admission and its status;
• optional consents and evidence that the notice has been read;
• technical procedure data, such as date and time, IP address, security logs, technical identifiers and one-time tokens;
• data required for subsequent formalisation and, if admitted, for management of the membership relationship.

3. Purposes and legal bases

3.1 Receipt and assessment of the application

The data are processed to:

• receive the pre-registration;
• check that it is complete;
• assess the application for admission;
• request any corrections or additions;
• manage any review of the application;
• prepare the formalisation of the application;
• enable the authorised bodies or personnel to make the final decision.

The legal basis is the performance of pre-membership measures requested by the data subject pursuant to Article 6(1)(b) GDPR.

3.2 Verification of identity and legal age

Identification data and any documents are processed to verify the declared identity, legal age and accuracy of the information required for the application.

The legal basis is the performance of the measures requested by the data subject and, where applicable, compliance with legal obligations pursuant to Article 6(1)(b) and (c) GDPR.

3.3 Operational communications

The email address and other contact details may be used for communications strictly connected with the application, such as:

• confirmation of receipt;
• requests for additions or corrections;
• communication of the outcome;
• sending personal review links;
• instructions concerning formalisation;
• communications required to manage the membership relationship.

The legal basis is the performance of the measures requested by the data subject and management of the pre-membership or membership relationship pursuant to Article 6(1)(b) GDPR.

Choosing to receive these communications by email concerns the communication channel and does not constitute consent to receive promotional communications.

3.4 Management of the membership relationship

If the application is accepted, the necessary data will be processed for:

• management of the member record;
• issue and management of the membership card;
• management of admissions and services;
• administrative, civil-law, tax and accounting obligations;
• institutional communications connected with Association life.

The legal bases are performance of the membership relationship and compliance with legal obligations pursuant to Article 6(1)(b) and (c) GDPR.

3.5 Security and protection of the Association

Certain data and logs may be processed to:

• prevent fraudulent use of the system;
• protect accounts, documents and IT infrastructure;
• check anomalous access and operations;
• establish, exercise or defend the Association’s rights.

The legal basis is the Association’s legitimate interest in the security of its systems, people and assets pursuant to Article 6(1)(f) GDPR, in accordance with the principle of proportionality and after balancing that interest against the rights of data subjects.

3.6 Promotional communications

Only with separate, optional consent may contact details be used to send promotional or informational communications concerning Association activities, initiatives and events that are not strictly necessary for managing the relationship.

The legal basis is consent pursuant to Article 6(1)(a) GDPR.

Consent:

• is not mandatory;
• is not preselected;
• may be withdrawn at any time;
• does not affect submission or assessment of the application;
• does not affect necessary operational communications.

4. Questionnaire

Answers provided in the questionnaire may be processed using IT tools, including AI-based tools, only where the Association has identified an appropriate legal basis and the applicable safeguards are in place.

The processing is intended to provide authorised personnel with indicators that support their reading of the answers and overall assessment of the application.

The analysis:

• does not automatically determine acceptance or rejection;
• does not automatically change the status of the application;
• does not replace staff assessment;
• does not by itself produce final decisions;
• is performed, where possible, without transmitting directly identifying data to the provider;
• is subject to human oversight.

The final decision is always made by authorised persons within the Association.

5. Nature of the provision of data

Providing the data marked as mandatory is necessary to submit and assess the application.

Failure to provide the data may prevent:

• identification of the applicant;
• verification of legal age;
• assessment of the application;
• management of the procedure;
• formalisation of any membership relationship.

Reading the notice and declaring that the data are complete and truthful are necessary to complete the procedure.

Tueketing consent is optional.

Any consent to AI support, where provided as optional, does not affect the ability to submit the application, which will be assessed directly by authorised personnel.

6. Processing methods and security

Date are processed using electronic tools and, where necessary, administrative documentation.

The Association adopts technical and organisational measures designed to:

• restrict access to authorised personnel;
• protect documents from direct public access;
• manage roles and permissions;
• protect communications through secure connections;
• prevent unauthorised access, loss, alteration or disclosure;
• perform backups and security checks;
• record relevant administrative operations, where provided for.

The measures are updated with regard to the nature of the data, the purposes, the state of the art and the risks to the persons concerned.

7. Recipients and authorised persons

Date may be processed by:

• members of the Board, within the limits of their respective responsibilities;
• authorised staff and collaborators;
• personnel responsible for managing pre-registrations and members;
• personnel responsible for system security and administration;
• administrative, tax and legal advisers, where necessary;
• technical providers responsible for the management system, hosting, communications, OTP, backups and any AI services.

Internal persons may access only the data required for their respective duties.

Date are not publicly disclosed.

8. External processors and providers

Certain providers may process data on behalf of the Association as processors pursuant to Article 28 GDPR.

Categories of providers may include:

• hosting and database providers;
• email providers;
• SMS or OTP providers;
• IT service providers;
• providers of artificial-intelligence tools;
• backup and technical-support providers;
• consultants with access to personal data.

An up-to-date list of external processors may be requested by writing to:

privacy@onirion.it

9. Retention

Date are retained for periods proportionate to the purposes for which they were collected.

Unless legal obligations, disputes or the need to protect rights require otherwise, the following criteria apply:

• incomplete pre-registrations: 30 days from the last activity;
• pre-registrations definitively rejected: 6 months from closure of the application;
• documents relating to rejected applications: 60 days from definitive rejection;
• review tokens and related metadata: 6 months from use, revocation or expiry;
• duplicate data from pre-registrations converted into memberships: minimisation within 30 days of conversion;
• active-member data: for the duration of the membership relationship;
• ordinary data of former members: up to 12 months after termination, unless otherwise required;
• administrative and accounting data and documents: for the period required by applicable law, normally up to 10 years;
• copies of identity documents of former members: deletion within 60 days of termination, unless required by obligations or disputes;
• questionnaires and AI results for rejected applications: 6 months from the final decision;
• questionnaires and AI results for accepted applications: 12 months from admission, unless there is a justified need;
• data used for promotional communications: until consent is withdrawn, with verification at least every 24 months;
• security and access logs: normally 6 months, extendable in the event of incidents or investigation needs.

At the end of the retention period, data are erased, anonymised or reduced to what is strictly necessary.

Erasure may be suspended solely for the data required where there are:

• legal obligations;
• disputes;
• requests from authorities;
• a need to establish, exercise or defend a right.

10. Transfers outside the European Economic Area

Date are processed within the European Economic Area wherever possible.

If a provider entails a transfer to a country outside the European Economic Area, the Association will verify that one of the safeguards provided for by the GDPR is in place, such as:

• an adequacy decision by the European Commission;
• standard contractual clauses;
• additional technical and organisational measures;
• another condition provided for by law.

A list of the providers concerned and the safeguards applied may be requested from privacy@onirion.it.

Note: before final publication, this section must be verified against the AI provider, email provider and other providers actually used.

11. Date-subject rights

In the cases provided for by law, the data subject may exercise the rights to:

• access personal data;
• rectify inaccurate data;
• complete incomplete data;
• erasure;
• restriction of processing;
• object;
• data portability, where applicable;
• withdraw optional consents;
• request information about processing carried out;
• obtain human intervention in relation to any applicable automated processes.

Requests may be sent to:

privacy@onirion.it

The Association may request information necessary to verify the identity of the requester.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Withdrawal of marketing consent does not affect operational communications concerning the application or membership relationship.

The controller must effectively facilitate the exercise of data-subject rights, rather than merely listing them in the notice.

12. Communication and disclosure

Date are neither sold nor publicly disclosed.

They may be communicated to:

• strictly necessary providers and advisers;
• competent authorities where required by law;
• persons to whom communication is necessary for legal obligations or protection of rights.

13. Updates to the notice

This notice is identified by a code, version, effective date and content hash.

For each pre-registration, the system records:

• notice code;
• version;
• hash;
• date and time when the notice was read;
• IP address used, within the applicable limits;
• declarations and optional consents provided.

Future changes do not alter the version of the notice previously provided.

If substantial changes are made to the processing, the Association will make a new version available and, where necessary, inform data subjects again or request a new expression of their wishes.