Last updated: 22 July 2026
1. Data controller and contact details
The data controller is Associazione Vita Indipendente ETS della Toscana, with registered office at Via Pisana 36/B, 50018 Scandicci (Florence), Italian tax code 94048480480.
For information or to exercise data protection rights, you can write to AVITOSCANA@AVITOSCANA.ORG or call +39 055 256053.
2. Scope of this notice
This notice concerns personal data processed through https://www.avitoscana.org and the services it provides, including the contact form, newsletter subscription request, browsing and preferences selected by the user.
This notice is provided under Regulation (EU) 2016/679 (“GDPR”) and applicable Italian law. Processing complies with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, security and storage limitation.
3. Data that may be processed
Depending on how the website is used, the following categories of data may be processed:
- identification details, contact information and the content of communications voluntarily submitted through forms;
- email address and evidence of the choice expressed for the newsletter;
- browsing information generated while using the website and required for operation, security and abuse prevention;
- language, accessibility and optional-service preferences stored in the browser;
- any other information freely entered in messages. Please do not provide special-category or unnecessary data that are not relevant to the request.
4. Purposes and legal bases
Data are processed only for purposes connected with requested services and website management:
- receiving and handling contact requests, on the basis of steps requested by the data subject or the Controller’s legitimate interest in responding to communications;
- sending newsletter updates, on the basis of consent, which may be withdrawn at any time;
- ensuring the operation and security of the website and protecting the website and its users, on the basis of the Controller’s legitimate interest and applicable legal obligations;
- remembering technical and accessibility settings requested by the user and recording choices concerning optional services;
- complying with legal obligations and establishing, exercising or defending legal claims.
5. Whether data must be provided
Data marked as required in forms must be provided in order to send and handle a communication. Without those data, the request cannot be processed.
Newsletter subscription and activation of optional external services are voluntary. Refusing or withdrawing consent does not prevent use of the website’s essential functions.
6. Processing methods and security
Data are processed in ways appropriate to the stated purposes, with organisational and security measures proportionate to the risks.
Data are accessible only to authorised persons and parties that need them to perform activities connected with the website’s services.
7. Storage
Data are kept for the time needed to achieve the purposes for which they were collected and afterwards only where required by law or to protect the Controller’s rights.
- requests and related correspondence are kept for the time needed to handle the matter and provide reasonable follow-up;
- newsletter data are kept until consent is withdrawn or the subscription is cancelled, without prejudice to retaining evidence of choices for the necessary period;
- technical and security data are kept for a limited period proportionate to operational and protection needs;
- browser preferences remain available until they are changed, deleted locally or periodically renewed.
8. Recipients and transfers
Data may be processed by authorised staff and collaborators and by providers of services needed to operate the website, such as hosting, maintenance and electronic communications. Where required, those providers act as processors.
Data may also be disclosed to public authorities or other parties when required by law. Data are neither sold nor made public.
If a service involves a transfer of data outside the European Economic Area, processing takes place in accordance with the conditions and safeguards required by the GDPR. Non-essential external services are activated only after the user’s choice.
9. Data subject rights
Where provided for by the GDPR, you may ask the Controller for:
- access to your personal data and a copy of them;
- rectification or completion of your data;
- erasure or restriction of processing;
- portability of data you have provided, where applicable;
- objection to processing based on legitimate interests;
- withdrawal of consent, without affecting the lawfulness of processing carried out before withdrawal.
10. Complaints and how to exercise your rights
Requests may be sent to the Controller using the contact details in the first section. The Controller may request the information needed to verify the applicant’s identity.
You may also lodge a complaint with the Italian Data Protection Authority or seek a remedy before the competent courts.
11. Automated decisions, cookies and updates
The website does not make solely automated decisions that produce legal or similarly significant effects and does not use data for advertising profiling.
For information about browser storage and external services, please see the Cookie Policy.
This notice may be updated to reflect changes in law, organisation or services. The date of the latest revision is shown in this document.
