PRIVACY POLICY
Last updated: [October 2026]
This Privacy Policy describes how the website www.leftcom.org processes users’ personal data when they browse the website, use the services available on the website or interact with it through the relevant forms.
This Privacy Policy is provided pursuant to Regulation (EU) 2016/679 (“GDPR”) and the applicable Italian legislation on the protection of personal data.
1. Data Controller
The Data Controller is:
Associazione Internazionalista Prometeo
Via Calvairate, 1
20137 Milan (MI) – Italy
E-mail: info@leftcom.org
The Data Controller has not appointed a Data Protection Officer (DPO).
For any request concerning the processing of personal data or the exercise of the rights provided for by the GDPR, users may contact the Data Controller at the e-mail address indicated above.
2. Categories of personal data processed
The website may process the following categories of personal data.
2.1 Browsing data
During the normal operation of the website, technical information relating to browsing may be processed, including, by way of example:
IP address;
information relating to the browser and device used;
date and time of requests;
resources and pages requested;
information necessary for the operation, security and maintenance of the website.
Such data are mainly processed for technical and security purposes and to ensure the proper functioning of the IT infrastructure.
2.2 Data submitted through the contact form
When users use the contact form, the following information may be collected:
name;
e-mail address;
subject of the communication;
content of the message;
any additional information that the user voluntarily chooses to include in the message.
The Data Controller invites users not to include unnecessary personal data in their messages and, in particular, special categories of personal data within the meaning of Article 9 GDPR, unless this is strictly necessary and takes place in compliance with applicable legislation.
Data relating to requests submitted through the contact form are retained for a maximum period of 12 months, unless further retention is necessary to comply with a legal obligation or to establish, exercise or defend a legal claim.
2.3 Website registration
The new website is designed according to the principle of data minimisation.
Only the e-mail address will be required to create an account, apart from any technical data necessary for account management.
Account data will be retained for a maximum period of 12 months, unless further retention is necessary to comply with a legal obligation or to establish, exercise or defend a legal claim.
Accounts and related data held on the previous version of the website will not be transferred to the new system as part of the migration.
2.4 Event registration
Registration for events may require:
name;
e-mail address.
The data will be used exclusively to manage registration, provide information concerning the event and, where necessary, manage organisational communications relating to the event.
Data relating to event registrations will be retained for a maximum period of 12 months, unless further retention is required by law or is necessary to establish, exercise or defend a legal claim.
2.5 Comments and content submitted by users
Where the website allows users to post comments or other content, the data associated with the user account and the information contained in the published contribution may be processed.
Users are advised not to include personal data concerning themselves or third parties in comments where such data are not necessary for participation in the discussion.
If users voluntarily choose to make personal information publicly available through content published on the website, such information may be accessible to other website visitors.
3. Purposes and legal bases for processing
Personal data are processed for the following purposes:
a) Operation, security and maintenance of the website
Legal basis: the legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR.
b) Management of requests submitted through the contact form
Legal basis: the performance of pre-contractual measures or management of the data subject's request pursuant to Article 6(1)(b) GDPR, where applicable, or the legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR.
c) Management of user accounts
Legal basis: performance of the service requested by the data subject pursuant to Article 6(1)(b) GDPR.
d) Management of event registrations
Legal basis: performance of the service requested by the data subject pursuant to Article 6(1)(b) GDPR, where applicable, or the legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR.
e) Statistical analysis of website use
The website may use Google Analytics 4 exclusively for statistical purposes and to analyse website usage, without using Google Ads or advertising features. Analytics tools will be operated in accordance with the methods described in the Cookie Policy and in compliance with the choices expressed by users through the consent management system.
f) Prevention of automated or abusive use of forms
The website may use Google reCAPTCHA v3 to verify the nature of requests submitted through forms and to prevent automated or abusive activity.
4. Google Analytics
The website may use Google Analytics 4 (GA4), a statistical analysis service provided by Google.
Google Analytics will be used exclusively to understand, in statistical form, how the website is used and to improve its content and operation.
Google Ads and advertising or personalised advertising features will not be used through Google Analytics.
The website will use Google Consent Mode to adapt the behaviour of Google tools to the choices expressed by users through the consent management system.
For further information concerning data processing carried out by Google, users may consult the documentation and privacy policy published by Google.
The methods used to activate the service, the categories of cookies and any transfers of data to third countries are described in the Cookie Policy.
5. Google reCAPTCHA
The website may use Google reCAPTCHA v3 to protect forms against spam, abuse and automated requests.
The use of reCAPTCHA may involve the processing by Google of technical information relating to the connection, device and interaction of the user with the website.
The processing methods depend on the technical configuration of the service adopted by the Data Controller and are described, where applicable, in the Cookie Policy.
6. Google Search Console
The Data Controller may use Google Search Console to monitor the indexing of the website and the way in which the website appears in Google search results.
Search Console is a service used by the Data Controller for the technical analysis of the website's presence in search engines and does not, in itself, constitute a tracking tool installed on visitors' devices.
7. YouTube and social networks
The website may contain links to videos or pages available on external platforms, including YouTube and social networks.
YouTube videos on the new website will be made available through external links and will not be embedded directly into the website pages.
Similarly, links to social networks will be provided through simple external links and not through embedded widgets or tracking tools.
When users follow such links, they access the relevant third-party platform directly, which will process their data in accordance with its own privacy policy and terms of use.
8. Donations
The website may contain links to external services used to make contributions or donations, including PayPal.
The website will not directly collect the data required for transactions through an embedded payment form.
Any data required to make a donation will be entered directly on the platform of the relevant provider.
Data processing carried out by PayPal is governed by its own privacy policy and the terms applicable to the service.
9. Newsletter
At the time of publication of this Privacy Policy, the newsletter service is not active.
The Data Controller may activate a newsletter service in the future, potentially using MailerLite.
If activated, subscription will be voluntary and may involve the collection of the following data:
e-mail address;
name or nickname, if voluntarily provided by the data subject;
preferred language selected by the data subject.
The selected language will be used to direct users to the corresponding newsletter among the five main languages of the website.
The Data Controller does not intend to use the newsletter service to profile users.
Users may unsubscribe at any time through the relevant unsubscribe mechanism included in communications or by contacting the Data Controller.
Before the service is actually activated, updated information concerning the provider used and the specific processing methods will be made available.
10. Processing methods
Personal data are processed using electronic and telematic means and, where necessary, paper-based means.
Processing is carried out in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality.
Data are processed by persons authorised by the Data Controller and appropriately instructed in relation to the activities entrusted to them.
11. Hosting and parties that may process personal data
The website is currently hosted by Aruba.
As part of the planned migration, the new website will be hosted by Artera.
Hosting providers and technical service providers may process personal data to the extent necessary to provide infrastructure, maintenance, security and technical support services.
Where required under Article 28 GDPR, the relationship with such parties will be governed by an appropriate data processing agreement.
12. Technical logs
For security, operation and maintenance purposes, technical information relating to access to and activities performed on the website may be recorded.
Drupal logs and technical server logs will be retained for a maximum period of 12 months, unless further retention is required for security reasons, by law, or to establish, exercise or defend a legal claim.
13. Transfers to third countries
Some of the technological services used by the website, particularly those provided by international companies, may involve the processing or transfer of personal data outside the European Economic Area.
Where such transfers take place, the Data Controller will verify their compliance with applicable legislation and the existence of an appropriate transfer mechanism under the GDPR.
Specific information concerning third-party services will be provided, where necessary, in this Privacy Policy and in the Cookie Policy.
14. Special categories of personal data
The website does not require users to provide special categories of personal data within the meaning of Article 9 GDPR.
Given the nature of the content published on the website, users are advised not to enter information relating, for example, to their political opinions or other special categories of personal data in contact forms, comments or other free-text fields where such information is not necessary.
If users voluntarily choose to make certain personal information public through content published on the website, the relevant processing will be assessed in accordance with the applicable legislation, including Article 9 GDPR where relevant.
15. Automated decision-making and profiling
The Data Controller does not carry out, through the website, automated decision-making processes that produce legal effects or similarly significant effects concerning the data subject.
The Data Controller does not profile users for advertising or commercial purposes.
16. Data subjects' rights
Data subjects may exercise, where applicable, the rights recognised under Articles 15–22 GDPR, including:
obtaining confirmation as to whether or not personal data concerning them are being processed;
obtaining access to their personal data;
requesting the rectification of inaccurate data;
requesting the erasure of data in the cases provided for by law;
requesting restriction of processing;
objecting to processing where provided for by law;
receiving their data in a structured, commonly used and machine-readable format where the right to data portability applies;
withdrawing consent previously given, where processing is based on consent.
Requests may be sent to:
The Data Controller will respond within the time limits established by applicable legislation.
17. Right to lodge a complaint
Data subjects who believe that the processing of their personal data infringes applicable data protection legislation may lodge a complaint with the competent supervisory authority.
In Italy, the competent supervisory authority is:
Garante per la protezione dei dati personali
Piazza Venezia 11
00187 Rome
Italy
www.garanteprivacy.it
18. Security
The Data Controller adopts appropriate technical and organisational measures in relation to the nature of the data processed and the risks associated with processing, with particular attention to account security, infrastructure security, prevention of unauthorised access and backup management.
19. Updates to this Privacy Policy
This Privacy Policy may be amended or updated in response to regulatory, technical or organisational changes, or to the introduction of new services on the website.
The updated version will be published on the website with the date of the latest update.