Privacypolicy

The Data Controller is Associazione Algopolio, with its address at Via Augusto Anfossi 36, 20135 Milan, Italy, which can be contacted by email at associazione@algopolio.com.

The site may process the following types of data:

• Browsing data. As with any website, the hosting provider’s systems may record connection data in technical logs (IP address, browser type, requested page, date and time), solely to keep the service running and secure. Our own software does not store IP addresses.
• Usage statistics, without cookies. We measure how the site is used with our own system, without cookies and without third-party services: the data is pseudonymous, contains no IP address and is viewed in aggregate, as described in section 3.
• Data you provide voluntarily. Name, email address, phone number (optional) and the information contained in the reports sent through the “Tell us your story” form or in email messages (for example the description of the facts, the platforms and links involved), as described in section 4; the first name, last name and email you give to register for events and webinars, as described in section 5.
• No cookies for visitors. The site sets no cookies, neither technical nor profiling ones, and uses no pixels, fingerprinting or identifiers stored in your browser. That is why there is no cookie banner. The only technical cookie exists in the private administration area, used solely by the Association’s authorised staff to keep their login session.
• No third-party resources. Fonts, images, videos and scripts are hosted on the site’s own domain: browsing the pages makes no requests to third-party servers (external fonts, CDNs, embedded content, social networks). Links to external sites open only if you select them; from that moment the destination site’s policy applies.

To understand which content is useful and to improve the site, we collect pseudonymous usage statistics, viewed in aggregate, with a system we host ourselves, without cookies and without any third-party service.

What we record for each page view:

• the page visited (address and title) and the page of this site viewed just before, the referring site (for example a search engine or a newspaper) and any campaign parameters;
• the country, derived from the time zone set in the browser or from the country the hosting service infers from the connection’s IP address (we store only the country code; we use no geolocation databases and do not store the IP address);
• the device category (computer, tablet, smartphone), the browser and operating-system family, the language and a screen-size range;
• active reading time, how much of the page was read and page-speed measurements;
• actions such as a click on a button or on an external link and the step reached in the report form, never any content you type.

We do not record IP addresses or the full user-agent, and we store nothing in your browser. To count unique visits we compute a pseudonymous code (hash) from the IP address, the user-agent and a secret value that changes every day and is overwritten: on the same day the pages viewed by the same browser are grouped into visits, but the same visitor cannot be linked from one day to the next and the code does not contain the IP address. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, we record nothing.

Statistics can only be viewed by the Association’s authorised staff in the private area, in aggregate or as single events without identifiers (for example “a visit from Italy, on a smartphone, to this page”), and are deleted after 25 months.

When you submit the “Tell us your story” form, the report is stored on the Association’s server. Name, email, phone, your story, links, the date of the facts and any other platform you mention are encrypted (AES-256-GCM) and can only be read by the Association’s authorised staff, in the password-protected private area.

Kept in clear, for case management only: the reference code, the date of submission and of consent, the form language, the categories and platforms you selected, whether you had already sent removal requests, the number of links, the length of the story, the case status with the dates it was first opened, last updated and closed, the staff member assigned, the version of this policy you accepted and a keyed fingerprint (HMAC with a secret key) of your email address, used only to find your reports if you exercise your rights.

The form uses no cookies and sends no data to third parties. Your IP address is not stored: to prevent abuse we keep only a pseudonymous code derived from the IP address (keyed hash), automatically deleted within 24 hours. After submitting you receive a reference code to quote in later contacts.

If the server cannot be reached, the form composes a message that opens in your own email program, addressed to associazione@algopolio.com: in that case you decide whether and when to send it.

Reports may contain special categories of data (for example intimate images or health information): we process them only on the basis of your explicit consent, given by ticking the consent box in the form, and solely to assess your case.

If email notifications are enabled, the Association receives an alert containing only the reference code, the categories, the platforms and a link to the private area: never personal data or the text of your story.

To register for an event or webinar you give us your first name, last name and email. We use them to manage your registration, send you the confirmation with your personal link to attend, reminders and communications about that event (for example a change of time or the programme). We also record the date of registration and, if any, the channel that brought you to the page (for example a social network), without personal data. The personal link is tied to your registration: you can also cancel it from there.

Speakers only see the names of the people registered for their own event, never their contact details.

Webinars stream live on this website through LiveKit, a real-time video service: during the stream your browser connects to LiveKit’s servers, which process your IP address and the technical data of the connection only to deliver audio and video to you. Viewers use no camera or microphone and are not visible to other participants. The questions you send the speakers are kept with your registration and, if the moderator shows one live, it appears with your first name and the initial of your last name.

The newsletter is optional: you receive it only if you tick the box and confirm from the link we email you. It tells you about the Association’s upcoming events and initiatives, and every message contains a link to unsubscribe at any time.

The registration form uses no cookies and, like the report form, keeps only a pseudonymous code derived from the IP address to prevent abuse, deleted within 24 hours. Our emails contain no tracking pixels and no open or click tracking.

Data is processed in order to:

• allow you to browse the site and keep it secure;
• produce aggregated statistics on how the site is used, from pseudonymous data collected without cookies, to improve its content and functioning;
• receive, assess and answer the reports and requests sent through the form or by email;
• manage registrations for events and webinars and the related communications;
• send the newsletter, only to people who asked for it and confirmed;
• fulfil any legal obligations.

The site carries out no profiling and shares no data with third parties for commercial purposes.

Processing is based on: your consent, including explicit consent for special categories of data, for reports sent through the form (Arts. 6(1)(a) and 9(2)(a) GDPR); your registration request, for managing events and webinars (Art. 6(1)(b) GDPR); your consent for the newsletter (Art. 6(1)(a) GDPR), which you can withdraw at any time; the Association’s legitimate interest for usage statistics (pseudonymous data, no cookies) and for the security of the site (Art. 6(1)(f) GDPR); the Controller’s legal obligations (Art. 6(1)(c) GDPR).

Data is processed with IT tools, using security measures suitable for ensuring confidentiality and integrity: encryption of report data, a password-protected private area with login-attempt limits, a log of the operations carried out on reports (without their content), encrypted connections.

• Statistics: 25 months, then deleted automatically.
• Reports: for as long as needed to handle the case. Closed cases are deleted 24 months after closing and reports classified as spam after 30 days: the private area flags them as “to be deleted” and staff delete them permanently, including internal notes; the operations log keeps the reference code and the list of actions taken (without any content) for 24 months after the deletion, then it is deleted automatically.
• Event and webinar registrations: up to 12 months after the event date, then deleted automatically.
• Newsletter: until you unsubscribe; after that we keep only the address, so as not to write to you again. Requests not confirmed from the emailed link are deleted after 30 days.
• Sending log (reminders, messages to registrants, newsletters): recipient, subject and outcome of each email, for 30 days.
• Email messages: for as long as needed to answer and handle the request.
• Form anti-abuse codes: up to 24 hours.

Data is not disclosed to the public. It may be processed, as data processors, by the providers of the technical services the site needs: Vercel Inc. (hosting, with processing in the European Union, in Frankfurt), Neon Inc. (database, servers in Frankfurt) Resend Inc. (sending service, event and newsletter emails, servers in Ireland) LiveKit Inc. (video delivery of live streams, through the servers closest to each viewer) and Google Ireland Ltd (Google Workspace: the Association’s mailbox, which receives the messages written to @algopolio.com addresses). Notifications of new reports contain no personal data.

Personal data may be transferred to countries outside the EU only if an adequate level of protection is guaranteed under the GDPR.

You may exercise at any time the rights set out in Articles 15-22 of Regulation (EU) 2016/679, including:

• Access, rectification or erasure of data;
• Restriction of or objection to processing;
• Data portability;
• Withdrawal of consent.

Requests can be sent to the Data Controller by writing to associazione@algopolio.com. For a report, quote the reference code you received or the email address you used in the form. Statistics contain no name, email or IP address and are not used to identify people.

This is without prejudice to the right to lodge a complaint with the competent supervisory authority (in Italy, the Garante per la protezione dei dati personali).

The Data Controller reserves the right to make changes to this policy at any time by publishing the updated version on this page.