Skip to content

Privacy Policy

Information notice on the processing of personal data

(Arts. 13 and 14, EU Regulation 2016/679 – “GDPR”)

SMILE HOUSE FONDAZIONE ETS, with its registered office at Via Germanico 172, 00192 Rome, info@smilehousefondazione.org, Tax ID No. 97175550587, acting as Data Controller (hereinafter, “Controller”), hereby informs users of the website www.smilehousefondazione.org (hereinafter, “Website”) regarding the processing of personal data carried out through the Website.

1. Categories of data processed

The Controller processes the following categories of personal data:

  • identity and contact data (name, surname, email address, telephone number);
  • data voluntarily submitted by the user via contact forms or newsletter registration;
  • data required to manage purchases of charitable items or to process donations (shipping address, billing details);
  • browsing data (e.g. IP addresses, system logs), collected automatically.

2. Purposes and legal basis of processing

Personal data is processed for the following purposes:

a) Subscription to and dispatch of official newsletters

  • Purpose: sending informative communications regarding the Controller’s activities, initiatives and projects.
  • Legal basis: consent of the data subject pursuant to Art. 6(1)(a) GDPR.

b) Management of contact requests

  • Purpose: responding to inquiries submitted through the Website.
  • Legal basis: performance of pre-contractual measures taken at the data subject’s request (Art. 6(1)(b) GDPR).

c) Sale of charitable goods / donations

  • Purpose: order management and shipping.
  • Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

d) Compliance with legal obligations

  • Purpose: administrative, accounting and tax compliance.
  • Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).

e) Legal defense

  • Purpose: establishment, exercise or defense of legal claims.
  • Legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR).

3. Processing methods

Personal data is processed using IT and electronic tools in compliance with the principles of lawfulness, fairness, transparency and confidentiality, implementing appropriate technical and organizational security measures.

4. Provision of data

Providing personal data is:

  • optional for newsletter subscription; failure to provide data will simply make it impossible to receive the newsletter;
  • mandatory for purchases/donations; failure to provide data prevents the completion of the transaction;
  • mandatory where required to comply with legal obligations.

5. Recipients of data

Personal data may be disclosed to:

  • IT and hosting service providers;
  • newsletter management platforms;
  • payment gateway providers and financial entities;
  • couriers and logistics providers;
  • external consultants and professionals (e.g. accountants, legal advisors);
  • competent authorities, where required by law.

Payments are processed via external platforms acting as independent data controllers; users are advised to review their respective privacy notices.

6. Data transfers outside the EU

Personal data is not transferred to third countries outside the European Union.

7. Data retention period

Personal data is retained for the period strictly necessary to achieve the purposes for which it was collected:

  • newsletter: until consent is withdrawn;
  • purchase/donation data: for the duration of the contractual relationship and subsequently for the period required by applicable tax and statutory regulations;
  • contact requests: for the time necessary to process and resolve the inquiry;
  • legal obligations: in accordance with statutory retention periods.

8. Rights of the data subject

Data subjects may exercise their rights under Articles 15-22 of the GDPR at any time, including:

  • right of access to personal data;
  • right to rectification or erasure (“right to be forgotten”);
  • right to restriction of processing;
  • right to object to processing;
  • right to data portability;
  • right to withdraw consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal).

Data subjects also have the right to lodge a complaint with the competent supervisory authority (in Italy, the Garante per la protezione dei dati personali).

9. How to exercise your rights

Data subjects may exercise their rights by contacting the Data Controller using the following contact details:

10. Data Controller and DPO

The Data Controller is: SMILE HOUSE FONDAZIONE ETS, with its registered office at Via Germanico 172, 00192 Rome, info@smilehousefondazione.org.

Data Protection Officer (DPO): Stefano Capponi – dpo@smilehousefondazione.org

This privacy notice may be updated periodically; users are encouraged to review this page regularly.