This notice applies to stormproject.org and related communications described below. It should be read before subscribing, donating or sending personal information to STORM.

1. Who we are

The data controller is ASSOCIAZIONE STORM PROJECT ETS ("STORM", "we", "us" or "our"). The data controller is the organisation that decides why and how personal data is processed.

Registered office	Via Costantino 151, 00145 Roma (RM), Italy
Fiscal code	96414770584
RUNTS registration	Repertory no. 170049 — 'Altri enti del Terzo settore'
Privacy contact	storm.project@pec.it
General contact	stormprojectaps@gmail.com

For questions about this notice or the use of your personal data, contact the privacy mailbox above.

2. Scope

This notice explains how STORM processes personal data when you:

• visit or interact with stormproject.org;
• subscribe to, receive or unsubscribe from the STORM newsletter;
• make a donation using a Stripe checkout link on the website;
• contact us by email or another published contact channel; or
• express interest in volunteering, an internship or a role with STORM.

A separate notice may be provided where a particular programme, event, grant, partnership or beneficiary activity requires different information.

3. Personal data we process

Website use

When you use the website, STORM and its hosting providers may process technical information such as your IP address, date and time of access, requested page, browser and device information, referrer, and security or error logs. This is needed to deliver, maintain and protect the website.

Newsletter

• email address (required);
• preferred language — English or Italian (optional);
• subscription and double opt-in records, including timestamps, confirmation status, source form and technical evidence of consent; and
• delivery administration data, such as bounces, complaints and unsubscribe status. Brevo may also produce campaign delivery and interaction information according to the account settings. STORM does not use newsletter data for individual profiling or automated significant decisions.

Donations

If you select a donation link, you are taken to a Stripe-hosted checkout. Stripe may collect identity, contact, billing, payment, device and fraud-prevention information. STORM may receive donor contact details, donation amount, date, payment status and transaction reference. STORM does not receive or store your complete payment-card number through the website.

Enquiries and applications

If you email STORM, we process your name, contact details, message, correspondence and any attachments you choose to send. For volunteer, internship or employment enquiries, this may include a CV, experience, education, availability and other information relevant to the opportunity. Please do not send health information or other sensitive data unless it is genuinely necessary and STORM has asked for it.

4. Why we process data and our legal bases

Purpose	Data used	Legal basis
Provide, maintain and secure the website	Technical and security data	Legitimate interests — Art. 6(1)(f) GDPR
Send the monthly newsletter in English or Italian	Email, language and subscription status	Consent — Art. 6(1)(a)
Record consent, manage opt-outs and defend claims	Consent evidence and suppression records	Legal obligation — Art. 6(1)(c); legitimate interests — Art. 6(1)(f)
Process and administer a donation	Donor and transaction data	Steps requested by you — Art. 6(1)(b); legal obligations — Art. 6(1)(c); legitimate interests — Art. 6(1)(f)
Respond to enquiries	Contact details and correspondence	Legitimate interests — Art. 6(1)(f); pre-contractual steps where relevant — Art. 6(1)(b)
Assess volunteer, internship or job enquiries	Application and correspondence data	Pre-contractual steps — Art. 6(1)(b); legal obligations — Art. 6(1)(c); legitimate interests — Art. 6(1)(f)

Where we rely on legitimate interests, those interests include operating a secure and effective website, communicating with people who contact us, administering STORM's activities, preventing misuse and establishing or defending legal claims. We consider whether these interests are overridden by your rights and interests.

5. Newsletter subscriptions

The STORM newsletter is planned as a monthly email. English is the default language and subscribers may select Italian where available.

• We use double opt-in: after submitting the form, you must use the confirmation link before the subscription becomes active.
• Consent to the newsletter is voluntary and is not used as consent for unrelated purposes.
• Every newsletter includes an unsubscribe link. You may also withdraw consent by emailing storm.project@pec.it.
• Withdrawal does not affect processing that was lawful before withdrawal.
• The newsletter is intended for people aged 16 or over. A person under 16 should ask a parent or guardian to subscribe on their behalf.

6. Who receives the data

Access within STORM is limited to authorised people who need the information for their role. We also use service providers, normally acting under their own privacy terms or a data-processing agreement as appropriate:

• Vercel: website hosting, delivery, security and technical logs.
• Cloudflare: domain registration and DNS services.
• Brevo: newsletter forms, double opt-in, contact-list management and email delivery.
• Stripe: hosted donation checkout, payment processing and fraud prevention.
• Google: Gmail for the current newsletter/privacy mailbox and Google Charts resources on the transparency page.
• GitHub: website source-code hosting and collaboration; ordinary website visitors do not provide subscriber or donation data to GitHub merely by visiting the site.

We may also disclose personal data where required by law, to public authorities with lawful powers, or where reasonably necessary to establish, exercise or defend legal claims. We do not sell personal data.

7. International data transfers

Some providers or their subprocessors may process personal data outside Italy or the European Economic Area. Where required, STORM relies on an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful transfer safeguard, together with supplementary measures where appropriate.

Brevo states that its contact databases are hosted in the European Union, although its subprocessors and supporting services may involve other locations. Vercel, Stripe, Google, GitHub and Cloudflare operate internationally. Their current notices and contractual safeguards should be consulted using the links in section 16.

8. Retention

STORM keeps personal data only for as long as reasonably necessary for the purposes described above, including applicable legal, accounting and claims requirements. Our working retention periods are:

Record	Retention period
Unconfirmed newsletter sign-up	Up to 30 days, then deleted or anonymised
Active newsletter subscription	Until you unsubscribe or STORM ends the newsletter
Consent and suppression record	Up to 5 years after withdrawal or the last relevant communication, where needed to demonstrate compliance and respect the opt-out
General enquiry	Normally up to 24 months after the enquiry is closed, unless a longer period is needed for an ongoing relationship or claim
Unsuccessful volunteer, internship or job application	Normally 6 months after the process ends; up to 12 months only with separate consent for future opportunities
Donation and accounting record	Normally 10 years, where required for Italian accounting, tax or legal obligations
Website security and technical logs	For the provider's operational period and no longer than reasonably necessary, unless retained for an incident, legal obligation or claim

A record may be kept longer where law requires it or a specific dispute, investigation or legal claim makes this necessary. It may be deleted sooner when no longer needed.

9. Your rights

Subject to the conditions and exceptions in data-protection law, you may ask STORM to:

• give you access to your personal data and information about its use;
• correct inaccurate or incomplete data;
• erase your data;
• restrict its processing;
• provide certain data in a portable format;
• object to processing based on legitimate interests; and
• record the withdrawal of consent at any time.

Send a request to storm.project@pec.it. We may ask for information reasonably necessary to verify your identity. You also have the right to complain to the Garante per la protezione dei dati personali in Italy.

10. Whether providing data is required

Newsletter subscription is voluntary. An email address and confirmation are necessary to receive it; language is optional and English is used if no preference is selected. Information marked as required in a donation checkout or application process is needed to complete that request. If you do not provide it, STORM or the relevant provider may be unable to proceed.

11. Cookies and similar technologies

At the date of this notice, STORM's audit of the public website did not identify advertising or audience-analytics tools on the STORM pages inspected. The website uses the following non-essential technologies: a newsletter sign-up form provided by Brevo and Google's reCAPTCHA technology to prevent automated sign-ups, both present on the homepage, and a YouTube video embedded on the "Our Story" page. The newsletter form and reCAPTCHA load when you visit the homepage, but testing did not find them to set cookies before you interact with the form. The YouTube video is initially shown as a static preview; the actual content only loads, via the privacy-enhanced youtube-nocookie.com domain, if you choose to play it, and testing did not find cookies being set even after playback. The website also uses technical hosting resources and loads Google Charts resources on the transparency page. If you follow a Stripe donation link, Stripe's separate site may use cookies and similar technologies under its own notice.

If STORM later adds non-essential analytics, embedded media, advertising or similar technology, we will update this notice and, where required, request consent before activating it. Browser and provider behaviour can change, so this statement is reviewed when the website changes.

12. Security

STORM uses proportionate technical and organisational measures designed to protect personal data. These include limiting access, using account security controls, maintaining consent and suppression records, and selecting providers with appropriate contractual and security commitments. No website or email system can be guaranteed completely secure.

13. Automated decisions

STORM does not use the processing described in this notice to make solely automated decisions that produce legal or similarly significant effects about you.

14. External links

The website contains links to third-party websites and services. Once you follow an external link, that provider's privacy notice applies to its own processing. STORM is not responsible for the content or privacy practices of an independent third-party site.

15. Changes to this notice

We may update this notice when the website, newsletter, providers or legal obligations change. The current version will be published on stormproject.org with its revision date. If a change materially affects processing based on consent, we will take appropriate steps, which may include asking for consent again.

16. Contacts and provider information

Privacy questions and rights requests: storm.project@pec.it

Postal address: ASSOCIAZIONE STORM PROJECT ETS, Via Costantino 151, 00145 Roma (RM), Italy

• Italian supervisory authority: Garante per la protezione dei dati personali
• Brevo: Privacy Policy and legal terms
• Vercel: Privacy Notice
• Stripe: Privacy Policy
• Google: Privacy Policy
• GitHub: Privacy Statement
• Cloudflare: Privacy Policy