Privacy

PRIVACY NOTICE

What is the purpose of this document?

Palazzo Foundation (hereafter referred to as “PF”) is committed to protecting the privacy and security of your personal data.

This notice describes how we, as a foundation registered at RUNTS, collect and use personal data received directly from individuals and companies in accordance with the Data Protection Laws. While this notice is provided to both individuals and companies, it is directed toward and addresses to other individuals or companies whose personal data may be processed.

As such, all references to “you” or “your” that follow refer to the individual whose personal data may be processed by us.

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are aware of and understand how and why we are using such information and how your personal data is processed and managed.

Controller

PF is a “data controller”. This means that we are responsible for deciding how we hold and use personal data about you. We are required under the General Data Protection Regulation (“GDPR”) to notify you of the information contained in this privacy notice.

Our Data Protection Coordinator

Our Data Protection Coordinator oversees compliance with and questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact our Data Protection Coordinator using the details set out below.

Giandomenico Corradino

Palazzo Foundation ETS

Via San Bartolomeo degli Armeni 5, 16122 Genoa, Italy

Email: giandomenico.corradino@palazzo-foundation.org

Changes to this Privacy Notice and Your Duty to Inform us of Changes

This notice may be updated from time to time. This version is dated April 2025.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Defined Terms

In this notice:

we, us or our refers to PF. You or your, refers to the individual or company whose personal data may be processed by us.

Contents of this Privacy Notice

This notice sets out the following:

1 – THE DATA WE MAY COLLECT ABOUT YOU (YOUR PERSONAL DATA)

2 – WHERE WE MIGHT COLLECT YOUR PERSONAL DATA FROM

3 – THE PURPOSES, CATEGORIES, LEGAL GROUNDS AND RECIPIENTS, OF OUR PROCESSING OF YOUR PERSONAL DATA

4 – DATA SECURITY

5 – DATA RETENTION

6 – YOUR RIGHTS AS AN INTERESTED PARTY

7 – GDPR & PRIVACY CODE TERMS

SECTION 1: THE DATA WE MAY COLLECT ABOUT YOU (YOUR PERSONAL DATA)

PF needs to collect and process personal data about you.

The types of personal data that are processed may include:

Individual details

Name, address, other contact details (e.g., email and telephone numbers).

Financial information

Bank account or payment card details.

Marketing and communications data

Your preference in receiving marketing from us and your communication preferences

Personal data does not include data where the identity has been removed (anonymous data).

SECTION 2: WHERE WE MIGHT COLLECT YOUR PERSONAL DATA FROM

PF might collect your personal data from various sources, including:

you (e.g. by corresponding with us by mail, phone, email or otherwise);
your employer;
publicly available sources.

Which of the above sources apply will depend on your particular circumstances.

For example, we might collect your personal data where:

you logged our website in order to make a donation to PF;
you subscribe to PF newsletter;
you attend an event (conference, meeting) in which video/photographs are taken;

SECTION 3: THE PURPOSES, CATEGORIES, LEGAL GROUNDS AND RECIPIENTS, OF OUR PROCESSING OF YOUR PERSONAL DATA

We set out below the purposes for which we might use your personal data:

‍

Purposes:
To manage your donations ►	Entering payment details
Marketing ►	To make suggestions to you about events or services that may be of interest to you

Please note that in addition to the disclosures we have identified against each purpose, we may also disclose personal data for those purposes to our service providers, third parties used by PF.

MARKETING

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We have established the following personal data control mechanisms:

We may contact you for marketing purposes, using your e-mail address. We will do so only if you have previously given us your consent to your data being processed for marketing purposes.

You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting our Data Protection Coordinator at any time.

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase, product/service experience or other transactions.

CHANGE OF PURPOSE

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. In such case, we will notify you accordingly and, if you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact our Data Protection Coordinator.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

LEGAL GROUNDS FOR PROCESSING

We will only use your personal data when the law allows us to. In particular, we will rely on the following legal grounds to use your personal data:

‍

For processing personal data not including “special categories of personal data”, such as data concerning health, sexual orientation, religious or political affiliations or beliefs, trade union membership
Legal ground	Details
Performance of our contract with you	Processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract
Compliance with a legal obligation	Processing is necessary for compliance with a legal obligation to which we are subject
In the public interest	Processing is necessary for the performance of a task carried out in the public interest
For our or third party legitimate business interests	Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular where you are a child. These legitimate interests are set out next to each purpose below

DISCLOSURES OF YOUR PERSONAL DATA

We may have to share your personal data with the parties set out below for the purposes set out in the table above. We will always share the minimum amount of data necessary for the purpose on a need-to-know basis. With the exception of service providers, who may be appointed as data processors pursuant to the GDPR, such parties will process your data as independent data controllers.

External third parties:

Service providers who provide IT and system administration services. Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services;
Anti-fraud and sanctions database providers;
Banks;
Solicitors;
Experts;
Police;
Courts;
Regulators;

THE PURPOSES, CATEGORIES, LEGAL GROUNDS AND RECIPIENTS, OF OUR PROCESSING OF YOUR PERSONAL DATA

We have set out below, in a table format, a description of some of the ways we plan to use your personal data, including the categories of personal data and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate, and the third parties with whom we need to share your personal data.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your personal data. Please contact our Data Protection Coordinator if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

‍

Purpose:
DONATIONS
Complying with our legal or regulatory obligations

Categories of Data:
Personal Data:
– Individual details
– Identification details
– Marketing and communications data

Legal Grounds:
Personal Data:
– Compliance with a legal obligation

Recipients:
– Police
– Regulatory Authorities
– Lawyers/Legal advisors

Purpose:
MARKETING
Making suggestions and recommendations to you about products, services or events that may be of interest to you

Categories of Data:
Personal Data:
– Individual details

Legal Grounds:
Personal Data:
– Consent

Recipients:
–

SECTION 4: DATA SECURITY

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

SECTION 5: DATA RETENTION

We will keep your personal data only for so long as is necessary and for the purpose for which it was originally collected.

SECTION 6: YOUR RIGHTS AS AN INTERESTED PARTY

If you have any questions about this privacy notice or in relation to our use of your personal data, you should first contact our Data Protection Coordinator. Under certain conditions, you may have the right to require us to:

provide you with further details on the use we make of your personal data;
provide you with a copy of your personal data processed by us in a structured, commonly used and machine-readable format; you have, also, the right to transmit those data to another data controller;
update any inaccuracies in the personal data we hold;
delete any personal data that we no longer have a lawful ground to use;
where processing is based on consent, to withdraw your consent so that we stop that particular processing;
object to any processing based on the legitimate interests ground unless our reasons for undertaking that processing outweigh any prejudice to your data protection rights; and
restrict how we use your personal data in the circumstances indicated by the GDPR.

In certain circumstances, your exercise of the above rights may be restricted in order to safeguard the public interest (e.g., the prevention or detection of crime), our interests (e.g., the maintenance of legal privilege) or those of a third party (e.g. where the exercise of your rights prejudices the rights and freedoms of such third party).

If you wish to exercise any of the rights set out above, please contact our Data Protection Coordinator.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Your Right to Complain to a Supervisory Authority

If you are not satisfied with our use of your personal data or our response to any request by you to exercise any of your rights in Section 6: Your Rights, or if you think that we have breached the GDPR, then you have the right to lodge a complaint with a member state supervisory authority for data protection issues. You can find all details of the Italian supervisory authority (Autorità Garante per la Protezione dei Dati Personali) on its website www.garanteprivacy.it.

We would, however, appreciate the chance to deal with your concerns before you approach the supervisory authority, so please contact us in the first instance.

SECTION 7: GDPR & PRIVACY CODE TERMS

Data protection key terms and regulations

Data Protection Laws means all laws and regulations relating to the processing of personal data, including the GDPR, as the same may be in force from time to time.

GDPR is the EU General Data Protection Regulation (EU) 2016/679. In Italy, data protection is also regulated by Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 (“Privacy Code”).

Data Controller is an entity which collects and holds personal data. It decides what personal data it collects about you and how that personal data is used.

Personal Data is any data from you which can be identified, and which relates to you. It may include data about any claims you make.

Processing of personal data includes collecting, using, storing, disclosing or erasing your personal data.

‍