Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree No. 196 of 30 June 2003, as amended by Legislative Decree No. 101 of 10 August 2018, this notice describes the methods of processing personal data collected within the framework of the project Connecting Power: Scaling and Sharing Sub-Granting Experiences to Prevent and Combat Gender-Based Violence Across Europe (CoPower), funded by the European Union.
This notice describes the processing of personal data within the general framework of the CoPower project. For specific project activities, the organisation responsible will provide a supplementary privacy notice containing more detailed information on the relevant processing of personal data, the recipients of the data, retention periods, the modalities for exercising data subjects’ rights, its privacy contact details and, where appointed, the contact details of the Data Protection Officer (DPO).
1. Who Processes Personal Data
The organisations involved in the project are:
The organisations involved in the project process personal data within the scope of their respective activities and may operate, depending on the circumstances, as independent data controllers, joint controllers or data processors pursuant to the GDPR. The role actually performed depends on the activities carried out and the responsibilities assigned to each organisation.
Where one of the organisations independently determines the purposes and means of processing personal data within the scope of its own activities, it will act as an independent data controller for those activities.
Where, instead, an organisation processes personal data exclusively on behalf of another organisation and on the basis of documented instructions, it will act as a data processor pursuant to Article 28 GDPR. Any joint controllership arrangements or appointments as data processor are governed by specific agreements compliant with the applicable legislation.
2. Purposes of the Processing
Personal data are processed in order to:
Personal data will not be used for commercial or marketing purposes.
3. Categories of Data Processed
Depending on the activities carried out, the following may be collected and processed:
Where strictly necessary, special categories of personal data pursuant to Article 9 GDPR may also be processed, including information relating to:
4. Legal Basis for the Processing
The processing of personal data is carried out on the basis of one or more of the following conditions:
5. Processing Methods
Personal data are processed by means of paper-based and electronic tools in compliance with the principles of the GDPR and through appropriate technical and organisational measures aimed at ensuring their security and confidentiality. Access to the data is permitted only to authorised persons and solely for purposes connected to project activities.
6. Disclosure of Data
Personal data may be shared with the following entities, exclusively for the purposes of the project:
For the implementation of project activities, the organisations involved may make use of suppliers and external entities that operate, depending on the circumstances, as data processors or sub-processors, in compliance with the GDPR and the agreements applicable between the parties.
Such entities are bound by appropriate contractual obligations and are required to adopt suitable measures to ensure the security and confidentiality of the personal data processed.
The updated list of data processors and any sub-processors may be requested from the competent organisation.
Where possible and compatible with the monitoring and reporting requirements of the project, aggregated, anonymised or pseudonymised data will be used.
7. Data Retention
Personal data will be retained for the time necessary to achieve the purposes for which they were collected. Thereafter, they may be retained for a period of up to 10 years following the conclusion of the project or for such different period as may be required by applicable legislation and obligations connected to European Union funding, including reporting, control, audit, verification and record-keeping requirements.
At the end of the applicable retention periods, the data will be securely deleted or anonymised.
8. Transfers of Data to Third Countries
Personal data are normally processed within the European Economic Area.
Should it become necessary to transfer data to third countries or international organisations, such transfers will take place in compliance with Articles 44 et seq. of the GDPR and the safeguards required by the applicable legislation.
9. Rights of Data Subjects
To exercise their rights, data subjects may contact the organisation responsible for the activity within which their personal data were collected.
They also have the right to lodge a complaint with the competent Data Protection Authority or to seek judicial remedies before the competent courts.
10. Contact Details
For any information concerning the processing of personal data or to exercise the rights granted under the GDPR, the data subject may contact the organisation managing the activity within which the data were collected.
For matters relating to the overall coordination of the CoPower project, it is possible to contact:
Oxfam Italia ETS
Email: privacy@oxfam.it