Privacy Policy

The controller of personal data is Gabriele Masetti, founder of NonProfit.it, a privately operated information service and directory of Italian nonprofit organizations. The public service is free to access and does not require an account.

For any privacy request, including the exercise of GDPR rights, write to privacy@nonprofit.it. A Data Protection Officer has not been appointed because the conditions set out in Article 37 GDPR do not apply to the current processing activities.

The information collected depends on how you use the website. We apply data minimization, do not ask visitors to create an account and collect the following categories only where the relevant interaction occurs.

• Technical browsing information, such as a minimized or pseudonymized IP address, the time of HTTP requests, pages viewed, browser and operating system. This information is used exclusively for technical operation, security and aggregate statistics. Some minimized information, such as page, browser type and country, may be sent to Umami Analytics to produce site statistics.
• Information voluntarily entered when submitting an organization: the organization’s descriptive details, such as name, address, contacts and mission, plus the submitter’s name, email address and relationship with the organization. The latter details are needed only so that we can ask for clarification about the submission and are never published.

Personal data is processed only for the following specific purposes, each under the legal basis provided by Article 6 of Regulation (EU) 2016/679 (GDPR).

• Providing the service — Article 6(1)(f), legitimate interests: operating the public directory and allowing visitors to consult organization profiles. The legitimate interest is the dissemination of public-interest information about Italy’s third sector.
• Managing submissions — Article 6(1)(a), consent: receiving, evaluating and, where approved, publishing information submitted by users. The submitter’s name and email are used only to contact that person if questions arise and are never published.
• Aggregate or minimized statistics — Article 6(1)(f), legitimate interests: analysing use of the website in aggregate or minimized form in order to improve its quality.

We keep personal data only for as long as strictly necessary for the purpose for which it was collected. Once the periods below expire, information is securely deleted or made permanently anonymous.

• Aggregate browsing statistics are retained for no longer than 12 months.
• Descriptive information about a submitted organization is retained while it is reviewed and, when approved, transferred to the public directory without being associated with the submitter.
• A submitter’s name and email address are retained only while the submission is being handled and, in every case, for no longer than 12 months after receipt. They are then deleted or made permanently anonymous.

As a data subject under the GDPR, you may exercise the following rights against the controller at any time.

Because part of the processing — operation of the service and aggregate or minimized statistics — is based on legitimate interests under Article 6(1)(f), Article 21 gives you the right to object at any time. Following an objection, processing will cease unless compelling legitimate grounds prevail under Article 21(1).

Send any request to privacy@nonprofit.it. We respond within 30 days of receipt. You also have the right to lodge a complaint with the Italian Data Protection Authority at garanteprivacy.it.

• Article 15 — Right of access: obtain confirmation as to whether personal data concerning you is being processed and request a copy.
• Article 16 — Right to rectification: ask for inaccurate data to be corrected or incomplete data to be completed.
• Article 17 — Right to erasure: ask for personal data to be deleted when it is no longer necessary or when consent has been withdrawn.
• Article 18 — Right to restriction: request that processing be restricted in the cases provided by law.
• Article 20 — Right to portability: receive information you provided in a structured format and, where technically feasible, transmit it to another controller.

NonProfit.it does not install cookies for profiling, tracking or advertising, and uses no third-party cookies for commercial purposes. In the absence of such tools, a marketing or profiling cookie banner is not normally required. This assessment takes account of the Italian Data Protection Authority’s 10 June 2021 guidelines on cookies and tracking tools.

The site uses the browser’s local storage solely for functional preferences strictly connected to the requested service. This information is not used for profiling or tracking and is not transmitted to external servers as a persistent user identifier.

Local storage remembers light or dark theme, the selected language, organizations saved without an account, and accessibility preferences such as text size, high contrast, reduced motion and a dyslexia-friendly font. The information remains exclusively on your device and can be removed at any time through browser settings.

The site uses Umami Analytics, a navigation statistics service designed to minimize the impact on personal data. Umami uses no cookies or persistent identifiers to track people across different websites. It is configured to collect only aggregate or minimized information needed to understand use of NonProfit.it and improve its quality.

Data is hosted primarily on infrastructure located in the European Union. Some technical providers may process limited information in third countries for support, maintenance or service operation.

Where an international transfer occurs, it is governed by Articles 44–49 GDPR and appropriate safeguards, including Standard Contractual Clauses where required.

To operate the service, the controller uses external technical providers acting, where applicable, as processors under Article 28 GDPR and covered by a Data Processing Agreement when required. An up-to-date list is available on request from privacy@nonprofit.it.

• Supabase Inc. provides database infrastructure and stores user submissions, including the submitter’s name and email. Under the selected service configuration, information is hosted primarily on infrastructure in the European Union.
• Netlify Inc. provides hosting and content delivery services and processes the technical browsing data needed to deliver the website. Its documentation and contractual safeguards also address possible international transfers.
• Umami Software Inc. provides privacy-focused navigation statistics. The service is configured for aggregate or minimized data, without cookies or persistent identifiers, solely to produce usage statistics.

This notice may be updated periodically to reflect changes to the service, applicable law or our processing practices. Every amendment is published on this page with its update date; material changes may also be highlighted through a visible notice on the website.

We encourage you to consult this page periodically so that you remain informed of any changes.