Privacy Policy

Privacy Policy

for the processing of personal data according to articles 13 and 14 of EU Regulation no. 2016/679 (GDPR)

Premise

Lama Gangchen Kiurok Tsochun Help in Action Onlus with registered office in Italy in Milan, Via Marco Polo 13, Fiscal Code 97197120153 (hereinafter “Holder”) is aware of the importance of safeguarding privacy and the rights of persons and undertakes to respect the legislative decree 30 June 2003, n° 196 (Code regarding the protection of personal data, hereinafter “Privacy Code”), the legislative decree n.101/2018 and the EU Regulation no. 2016/679 (European Union Regulation concerning the protection of individuals with regard to the processing of personal data, hereinafter referred to as “GDPR”) and to maintain rules of conduct that guarantee a secure, controlled and confidential navigation on its site.

It also adopts suitable security measures to safeguard the confidentiality, integrity, completeness and availability of your personal data.

You are, therefore, invited to read this information, date in accordance to art. 13 of the Privacy Code and art.13 GDPR, and to consult it periodically because the rules in force to protect the confidentiality of personal data are subject to changes over time, depending on legislative changes and regulations on the matter.

Basic principles of the privacy policy of Lama Gangchen Kiurok Tsochun Help in Action Onlus:

  • Treat the data exclusively for the purposes and according to the methods illustrated in the information presented to the user who accesses a section of the site where the provision of personal data is required;
  • Use only data that has been released spontaneously by the user; (the legal basis of the processing is consent);
  • Make data available to third parties exclusively for instrumental purposes that are expressly requested and carefully selected by us;
  • Communicate data to third parties exclusively for activities related to what is of interest or if this is required by law, regulation or legislation;
  • Transfer data to Third Countries only and exclusively if this is linked to specific activities or duties related to the assignments received or in any case to which the data relate or if this becomes necessary in compliance with the rules;
  • Respond to requests for access to personal data, rectification or deletion, modification, integration of data provided, limitation or opposition to the processing of data if processed in violation of the law, oblivion, opposition to the processing of data for purposes of informative communications on our projects and requests for financial contributions to support our institutional activities;
  • Ensure correct and lawful processing of data, safeguarding your privacy, and apply appropriate security measures to protect the confidentiality, integrity and availability of data;
  • Keep the data in its paper or electronic form for the time strictly necessary for carrying out the activities agreed with the person concerned, to fulfil legal obligations or until the consent of the interested party is revoked;
  • use technical cookies to facilitate navigation on the site and use analytical cookies for statistical purposes;
  • to not use profiling cookies.
  • The installation of cookies operated by third parties through the services used on the site (for example, payment via Paypal, access to our Facebook page) can not be technically controlled by the Holder. You are therefore invited to consult the relative privacy policy:
  • In addition to what is indicated in this document, the user can manage preferences related to cookies directly within his browser and prevent, for example, that third parties can install.

1. Object of the Policy

The Holder uses the personal data, identification (for example, name, surname, company name, address, telephone, email, bank and payment details) – hereinafter “personal data” or “data” – in order to be able to respond to requests expressed by the users themselves.

2. Purpose of the Policy

All activities of collection and subsequent processing of data provided spontaneously are aimed at the pursuit of the institutional purposes of the Holder and in particular for:

  • donations, made in various ways (credit card, Paypal, bank or postal transfer, postal order);
  • subscription to our newsletter;
  • request for information;
  • adherence to projects.

Your personal data are processed:

2A) without your express consent (Article 24 letter a), b), c) Privacy Code and art. 6 lett. b), e) GDPR), for the following Service Purposes:

  • conclude the contracts for the Services of the Holder;
  • fulfil the pre-contractual, contractual and tax obligations deriving from relations with you in existence;
  • fulfil the obligations established by law, by a regulation, by community legislation or by an order of the Authority (such as for anti-money laundering);
  • exercise the rights of the Holder, for example the right to defence in court;

2B) Only subject to your specific and distinct consent (articles 23 and 130 of the Privacy Code and art.7 GDPR), for the following purposes:

  • send you via e-mail or mail newsletters, information, communications on the activities and services offered by the Holder;

Please note that if you are already our supporters, we may send you information about the activities carried out or to be carried out by the Holder similar to those you have previously supported or related to services offered similar to those already used, except if you do not give your consent for communication. (Article 130 paragraph 4 of the Privacy Code).

3. Processing methods

All the processing of data carried out within this site will be carried out both on paper and by electronic or telematic and/or automated means, relating to the purposes for which the data were collected and in compliance with the current security regulations, for the purposes specified from time to time in the information presented to the user.

The processing of your personal data is carried out by means of the operations indicated in Article 4 of the Privacy Code and Article 4 n.2) GDPR and precisely: collection, registration, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and destruction of data.

4. Data storage period

The Holder will process the personal data for the time necessary to fulfil the aforementioned purposes and in any case for no more than 10 years from termination of the service for the purposes of services considering the need for filing or communication to third parties for the fulfilment of legal obligations (eg tax).

To maintain contact with supporters on the initiatives and activities of the Holder, the data will be processed until your consent is revoked.

5. Access to data

Your data may be made accessible for the purposes referred to in Article 2A) and 2B):

  • to the volunteers and collaborators of the Holder in their capacity as agents and/or internal managers of the policy and/or system administrators;
  • to third-party companies or other subjects (example: professional and accounting firms, IT consultants, mail carriers, hosting providers), also appointed, if necessary, external managers of the policy by the Holder. The updated list of the Managers can always be requested from the Holder

6. Communication of data to third parties

For purposes related to the provision of the service to which the user has accessed, the data could be made available to third parties, who will act as independent Holders of the policy, and who provide services that satisfy the user’s request (for example, companies that perform postal delivery services, insurance companies, freight companies, tax consultants) or to whom the communication of data is necessary to comply with the law or regulations.

Without the need for express consent (in accordance to article 24 letter a), b), d) Privacy Code and article 6 letter b) and c) GDPR), the Holder may communicate your data for the purposes referred to in art. 2.A) to Supervisory Bodies, Judicial Authorities, as well as to those subjects to whom the communication is mandatory by law for the accomplishment of the purposes indicated.

These subjects will process the data in their capacity as independent policy holders.

Your data will not be disclosed to the public.

7. Data storage, data transfer in Italy and abroad

Lama Gangchen Kiurok Tsochun Help in Action Onlus collects and stores computer data on its premises, accessible only to a select and limited number of volunteers and collaborators.

The databases are on AWS (compliance GDPR, located in the EU).

For some activities of the Holder to which you have joined or decide to join, communication or data transfer may be provided between the various legal or operational offices of the Holder and among various collaborators and/or employees of the Entity.

Your data will be communicated abroad in cases where this is required for the execution of a specific relationship with the Holder or for the completion of agreed activities or if this is required by law.

It is possible that in some non-EU countries European protection standards are not guaranteed and in this case your consent will be the legal basis for the transfer and consequent assumption of risks.

8. Provision of data and consequences of refusing it

The forms to be filled out include both data that are strictly necessary to comply with what is of interest and the failure to give it does not allow the request to proceed, as well as optional data.

The provision of data for the purposes referred to in art. 2A) is mandatory. In their absence, we can not guarantee the Services.

The provision of data for the purposes referred to in art. 2.B) is optional. You may therefore decide not to provide any data or to subsequently deny the possibility of processing data already provided: in this case, you will not be able to receive newsletters and informative communications about the activities performed and the services offered by the Holder.

The Holder will not use the data provided for purposes other than those related to the service to which the user has subscribed.

9. Rights of the interested party

In your capacity as an interested party, you have the rights referred to in Article 7 of the Privacy Code and Article 15 of the GDPR and specifically the rights to:

  • obtain confirmation of the existence or not of personal data concerning you, even if not yet registered, and its communication in intelligible form;
  • obtain indications of: a) the origin of personal data; b) of the purposes and methods of the policy; c) of the logic applied in case the policy is carried out with the aid of electronic instruments; d) of the identification details of the Holder, of the responsible and of representatives eventually designated in accordance with article 5, paragraph 2 of the Privacy Code and article 3, paragraph 1, GDPR; e) of the subjects or categories of subjects to whom the personal data may be communicated or who may learn about them as appointed representative in the territory of the State, managers or agents;
  • obtain: a) updating, rectification or, if interested, integration of data; b) cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data whose storage is unnecessary for the purposes for which the data were collected or subsequently processed; c) the attestation that the operations referred to in letters a) and b) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except in the case in which such fulfilment proves impossible or involves a use of means disproportionate to the protected right;
  • to object, in whole or in part: a) for legitimate reasons, to the processing of personal data concerning you, even if pertinent to the purpose of the collection; b) to the processing of personal data concerning you for the purpose of sending informative communications. Therefore, the interested party may decide to receive only communications using traditional methods or only automated communications or none of the two types of communication.
  • Where applicable, also has the rights referred to in articles 16-21 GDPR (right of rectification, right to be forgotten, right to limitation of treatment, right to data portability, right of opposition), as well as right of complaint to the Guarantor Authority for the protection of personal data.

10. How to exercise your rights

You can exercise your rights at any time by sending:

  • a registered letter in Italy: Lama Gangchen Help in Action Onlus, Piazza IV Alpini 14, 28813 Albagnano di Bèe (VB), Italy

or

11. Holder of the policy

Lama Gangchen Help in Action Onlus, registered office Via Marco Polo 13, 20124 Milan, is the holder of the policy in accordance to and for the purposes of Legislative Decree 30 June 2003, No.196, since it may decide in what way and for what reasons, communicated in the specific information, to collect and use the personal data provided by the user, as well as with which tools to process them and which security procedures to activate to guarantee their integrity, confidentiality and availability.

12. Credit card and secure financial information

The transmission of payment information and online donation takes place through the highest security standard and is guaranteed by PayPal: the data of the buyer’s credit card will be totally illegible to third parties. Lama Gangchen Help in Action Onlus does not have access to the information in question.

For more information about this, please refer to the Paypal privacy policy:

https://www.paypal.com/it/webapps/mpp/ua/privacy-full

If you make a bank transfer, the bank notifies the holder of the name of the donor and not his address and contacts.