Privacy notice
Last updated: September 2026
This notice explains how Associazione NaturaLink processes the personal data of the people who use this site: donors, volunteers, people hosted through the justice-system agreements and visitors (EU Regulation 2016/679, "GDPR", art. 13 and 14).
1. Data controller
Associazione NaturaLink, Via Grado, 28 — 34075 Terranova (GO) — tax code 90041320319. Contacts: associazione.naturalink@gmail.com · certified email (PEC) naturalink@pec.it.
2. Which data we process
• Account: name, email and profile photo received from Google when you sign in. • Donors: first and last name, tax code, email, amount, date and method of the donation. • Volunteers: personal details, tax code, contacts, address, dates of membership and attendance log. • People in justice-system programmes (community service, probation, social inclusion): personal details, contacts, programme, hours of service and the documents you upload — including judicial documents, which are data relating to criminal convictions (GDPR art. 10). • Technical data: cookies and, only with your consent, usage statistics (see the cookie policy).
3. Purposes and legal bases
• Recording donations and issuing the tax receipt: legal obligations (art. 6.1.c; D.Lgs. 117/2017 and tax law). • Keeping the volunteer register and the attendance log: legal obligations of a Third-Sector entity (D.Lgs. 117/2017, art. 17) and your membership (art. 6.1.b). • Managing justice-system programmes: the agreements with the Court and the UEPE and the related legal provisions (art. 6.1.c and art. 10 GDPR); data are used only for the programme and the reports due to the referring office. • Answering your requests: your request (art. 6.1.b). • Usage statistics: only with your consent (art. 6.1.a), which you can withdraw at any time. Providing the data is necessary for each service: without it we can't record the donation, the membership or the programme.
4. Who processes the data
The data are handled by the association's authorised staff (board and secretariat). Technical providers act as data processors: Google (sign-in, file storage and — with consent — statistics via Firebase), MongoDB (database hosting), Brevo (transactional emails) and the site hosting provider. Where the law requires it, data are shared with public authorities (e.g. the Revenue Agency, the Court or the UEPE for justice-system programmes). Data are never sold or used for advertising.
5. Transfers outside the EU
Some providers (Google, MongoDB) may process data in the United States. Transfers rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.
6. How long we keep the data
• Donations and receipts: 10 years, as required for accounting and tax records. • Volunteer register and attendance: for the whole membership and then for the time required by law. • Justice-system programmes: until the programme ends and the related reports and certificates are delivered, then for the time required by the agreements. • Statistics: at most 14 months.
7. Your rights
You can ask for access to your data, their rectification or erasure, the restriction of processing, data portability, and you can object to processing or withdraw your consent at any time (GDPR art. 15–22). Write to associazione.naturalink@gmail.com or naturalink@pec.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
8. Changes to this notice
We may update this notice when the services or the law change. The date at the top shows the latest version.