Privacy policy

Who is the data controller

The data controller is Edoardo Guzzi. For any question about privacy write to privacy@sonosottoattacco.org.

When you visit the site

The site does not use cookies, does not load fonts, videos or content from other sites and has no social network buttons.

The site is hosted on Cloudflare. To deliver the pages to you and protect the site from attacks, Cloudflare automatically processes your IP address and the technical data of the request (requested page, browser, date and time). We do not use this data to identify you.

Legal basis: our legitimate interest in publishing and protecting the site (Art. 6(1)(f) GDPR).

Visit statistics

To know how many people we reach and which pages are useful, we use Umami, a statistics program installed on a server managed by us, reachable through Cloudflare: the server is located in Frankfurt, Germany. Umami does not use cookies, does not store your IP address and does not follow you to other sites: it counts visits in aggregate form (pages viewed, country, device type, referring site).

If you have turned on “Do Not Track” in your browser, your visits are not counted.

Legal basis: our legitimate interest in improving the service (Art. 6(1)(f) GDPR).

When you send us a report

We process the data you choose to send us: email address, what you tell us, the accounts and channels you point out and any attachments. You can also write to us from an address created for the purpose, without telling us your name.

Reports may contain particularly sensitive data, for example about sex life or possible crimes. We process them only with your explicit consent, which you give by sending us the report after reading this policy, and only to help you (Art. 6(1)(a) and Art. 9(2)(a) GDPR). You can withdraw your consent at any time.

We use the data to reply to you, tell you who to turn to and see whether your case is linked to others. We ask your permission before putting you in touch with other victims or with a lawyer.

Reports may also contain data about other people, for example the names of the accounts harassing you. We use it only to link cases and help victims turn to the authorities. We never publish it.

Do not send us intimate images. If the material involves minors, report it only to the police.

When you apply as a volunteer

We process the data you send us (name, contact details, skills, availability) to assess your application and organise the team’s work. Legal basis: steps taken at your request before working with us (Art. 6(1)(b) GDPR).

Who can see your data

Only the volunteers assigned to handle reports, who are bound to confidentiality.

The providers we need in order to operate, as processors: Cloudflare (site hosting), the statistics server provider (in Germany) and Google (Google Workspace) (email).

Lawyers or victim support associations, only if you ask us to or agree.

The authorities, only if you agree or if the law requires us to.

We do not sell or hand over data to anyone for other purposes.

Transfers outside Europe

Cloudflare is a US company and may process data in the United States. In that case the transfer takes place with the safeguards provided by law, such as the EU-US and Swiss-US Data Privacy Framework or standard contractual clauses. [Check the safeguards in force for Cloudflare and for the email provider.]

How long we keep the data

Reports for 24 months after the last contact, unless you ask us to delete them sooner or they are needed for ongoing proceedings you have told us about.

Volunteer applications until the end of the collaboration, or 6 months if the application is not accepted.

Technical data processed by Cloudflare for the periods set by Cloudflare.

How we protect the data

Reports stay in the mailbox and in encrypted archives, accessible only to the people assigned and protected by two-step verification. The site does not collect data through forms.

Your rights

You can ask us to access your data, correct it, delete it, restrict its use, object to the processing, receive it in a readable format and withdraw your consent. Write to privacy@sonosottoattacco.org: we reply within one month.

You can also lodge a complaint with the Garante per la protezione dei dati personali (the Italian data protection authority, garanteprivacy.it) if you live in Italy, or with the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) if you live in Switzerland, or with the authority of your own country.

Automated decisions

We do not make automated decisions and we do not profile people who write to us.

Changes

If we change this policy we update the date at the top. For important changes we flag them prominently on the site.