Privacy Policy

1. Controller and scope

The data controller is READING RETREATS IN RURAL ITALY A.P.S. (the “Association”, “we”, “us”), Codice Fiscale 91154310378, RUNTS registration no. 122511. Registered office: c/o Savi Consulting SRL - STP, Via Pietro Nenni 6/B, 46100 Mantova (MN), Italy. Operational location: Via Macchina Fissa 107, 46034 Borgo Virgilio (MN), Italy.

This notice applies to readingretreats.com, membership and event workflows, stay and internship enquiries, visits, newsletters, donations, and related communications. It is provided under Articles 12–14 of Regulation (EU) 2016/679 (“GDPR”) and applicable Italian data-protection law.

2. Data we process and where it comes from

• Identity and contact data: name, email, telephone number, address, city, postcode, country, nationality, date and place of birth, and Italian tax code where required.
• Membership data: application, membership number, dates and status, declarations accepting the Statute and applicable terms, and internal admission or governance records.
• Minor and guardian data: the minor’s details and the guardian’s identity, relationship, contact details, tax code, signature, and consent where a paper application is submitted.
• Event, visit, stay, and internship data: selected event, visit date or time, arrival and departure dates, number of guests, interests, experience, motivation, messages, attendance, and related organisational information.
• Payment and donation data: amount, currency, payment status and method, transaction, order or capture identifiers, fee and contribution breakdown, and refund status. Card and bank credentials are entered directly with PayPal and are not stored by us.
• Communications and consent data: messages, email delivery information, newsletter preference, consent source and text version, timestamps, unsubscribe events, and limited evidence needed to demonstrate the choice.
• Technical and security data: IP address and approximate location available to our hosting or security providers, request headers, browser and device information, user agent, timestamps, form-security results, short-lived rate-limit identifiers, and server or error logs.
• Media and content: photographs, recordings, testimonials, or other material supplied or authorised for association communications.
• Administrator data: account identifiers, role, authentication and multi-factor status, session-security events, and audit information for authorised Association personnel.

We normally obtain data directly from you or, for minors, from a guardian. We may also receive transaction status from PayPal, unsubscribe or delivery events from EmailOctopus, and records created by authorised Association personnel. Please do not place health information, political or religious views, or other special-category data in free-text fields unless we specifically request it and explain the applicable basis.

3. Purposes and legal bases

Where we rely on legitimate interests, we assess necessity, proportionality, and the effect on your rights. You may ask for information about that assessment and object as explained below.

4. Required and optional information

Fields marked as required are needed to answer the request, verify eligibility, process an application or payment, satisfy legal duties, or organise an activity. Without them, we may be unable to process the request, admit a member, confirm a registration, or issue the required records. Newsletter consent, publication consent, non-required messages, and any donation above zero are optional and do not determine membership admission.

5. Automated checks and decisions

The site performs automated validation, duplicate, age, payment-status, reservation-expiry, capacity, fraud, and security checks. These support the requested workflow but are not used to make decisions based solely on automated processing that produce legal or similarly significant effects under GDPR Article 22. Membership admission is decided by the Association’s competent body or delegate in accordance with the Statute.

6. Recipients and service providers

Access is limited to authorised Association personnel and the following recipients to the extent necessary:

We may also disclose data to accountants, legal or technical advisers, insurers, banks, public authorities, RUNTS or other bodies where necessary and lawful. Links to social media, accommodation providers, PayPal, Google Maps, or other external sites are user-initiated; the third party’s own notice applies after you follow the link. We do not sell personal data.

7. International transfers

Some providers and subprocessors may process data outside the European Economic Area. Where we are responsible for the transfer, we use an applicable adequacy decision, including the EU–US Data Privacy Framework where valid and applicable, European Commission Standard Contractual Clauses, and supplementary contractual, organisational, or technical safeguards. Provider locations and subprocessors can change. You may request information about the applicable transfer mechanism and a copy of the relevant safeguards, subject to necessary redactions.

8. Retention

At the end of the relevant period, data is deleted, anonymised, or access is restricted. A documented legal hold overrides ordinary deletion only for as long as necessary.

9. Cookies and similar technologies

We use strictly necessary cookies, local storage, session storage, and security technologies. Google Maps is blocked until you consent. We do not use website analytics or advertising pixels. Names, purposes, durations, and controls are described in our Cookie Policy.

10. Minors

Online membership and event forms are intended for adults. A person under 18 must use the dedicated paper procedure countersigned by a parent or legal guardian. We limit minor and guardian data to admission, safety, participation, and legal requirements. We do not knowingly send direct marketing to minors or publish an identifiable minor’s image without the required guardian authorisation and a lawful basis.

11. Security

We use role-based access, administrator multi-factor authentication, short sessions, transport encryption, database access policies, input validation, anti-bot and rate-limit controls, restricted backups, and provider contracts. No internet service can guarantee absolute security. Please notify us promptly if you believe your information or an Association communication has been compromised.

12. Your rights

Subject to the GDPR’s conditions and exceptions, you may:

• request access to and a copy of your data;
• request correction, completion, erasure, or restriction;
• receive data you provided in a structured, commonly used, machine-readable format and request portability where applicable;
• object, on grounds relating to your situation, to processing based on legitimate interests, and object at any time to direct marketing;
• withdraw consent at any time without affecting processing already lawfully performed; and
• not be subject to a solely automated decision with legal or similarly significant effects where Article 22 applies.

Contact us using the details below. We may ask for proportionate identity verification and normally respond within one month; the GDPR permits an extension of up to two further months for complex or numerous requests, with notice. Rights may be limited where the law requires retention or protects another person’s rights.

You may also lodge a complaint with the Italian Data Protection Authority (Garante) or another competent supervisory authority, and you retain the right to a judicial remedy.

13. Changes to this notice

We may update this notice when our activities, providers, or legal duties change. The date at the top is a manually maintained publication date and does not change automatically. Material changes will be highlighted through an appropriate channel where required. Previous processing remains governed by the notice and legal basis applicable at that time.