Information on the processing of personal data
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
Last updated: 2026-07-11
1. Data Controller
The Data Controller for personal data is:
ANFOSC – Associazione Nazionale Formaggi Sotto il Clileo Registered office: Via San Leonardo 62/A Tax Code 96021430762 Email: info@anfosc.it ] Website: www.anfosc.it
For any questions regarding the processing of their personal data, the data subject may write to the email address indicated above.
The Association has not appointed a Data Protection Officer (DPO), as the conditions set out in Art. 37 of the GDPR do not apply.
2. Types of data processed
Depending on the interaction with the site and the Association, ANFOSC may process the following categories of data:
2.1 Navigation data
The computer systems and software procedures used to operate the site acquire, during their normal operation, some data whose transmission is implicit in the use of Internet communication protocols: IP addresses, type of browser and operating system, domain names, request times, pages visited.
This data is used for the sole purpose of obtaining anonymous statistical information on the use of the site and to monitor its correct functioning.
2.2 Data provided voluntarily for membership
To request membership as a member, the data subject provides the following data:
- First and last name
- Tax code
- Date and place of birth
- Residential address (street, city, postal code, province)
- Telephone number
- Email address
- Membership category (producer, researcher, restaurateur, distributor, professional, enthusiast)
- Company or organization (optional)
- Access credentials for the reserved area (username and password)
2.3 Data relating to the payment of the membership fee
Payment of the fee is made via the Stripe platform. ANFOSC does not collect or store full payment card data, which is processed directly by Stripe as an independent controller/processor. ANFOSC only receives the outcome of the transaction and the data necessary for the accounting registration of the payment.
2.4 Data provided via contact forms
The optional sending of messages via contact forms involves the acquisition of the sender’s email address and any further personal data included in the message.
2.5 Data for sending the newsletter
Email address and any personal data provided at the time of subscription to the newsletter.
3. Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Management of the membership request and the associative relationship (registration, maintenance of the members’ register, institutional communications, calling of meetings) | Execution of a contract / associative relationship to which the data subject is a party — Art. 6, par. 1, point (b) GDPR |
| Management of the payment of the membership fee and accounting and tax fulfillment | Execution of the associative relationship and fulfillment of legal obligations — Art. 6, par. 1, points (b) and (c) GDPR |
| Provision of services reserved for members (access to the reserved area, consultation of confidential documents) | Execution of the associative relationship — Art. 6, par. 1, point (b) GDPR |
| Responding to requests sent via contact forms | Consent of the data subject / pre-contractual measures — Art. 6, par. 1, points (a) and (b) GDPR |
| Sending the newsletter and informative and promotional communications about the Association’s activities | Free, specific, and revocable consent of the data subject — Art. 6, par. 1, point (a) GDPR |
| Statistical analysis of site usage | Consent of the data subject (for non-technical cookies) / legitimate interest (for aggregate and anonymous statistics) |
| Ensuring site security and preventing abuse | Legitimate interest of the Controller — Art. 6, par. 1, point (f) GDPR |
The provision of data marked as mandatory in the membership form is necessary for the completion of the registration: refusal to provide it makes it impossible to follow up on the membership request.
The provision of data for the newsletter is optional and failure to provide consent does not in any way affect the possibility of becoming a member.
4. Processing methods
Data is processed using computer and electronic tools, and to a residual extent on paper, with logic strictly related to the purposes indicated and adopting technical and organizational measures adequate to ensure a level of security appropriate to the risk, in accordance with Art. 32 of the GDPR.
Data is stored on servers located within the European Union and access is allowed only to authorized personnel of the Association and the subjects indicated in paragraph 6 below.
5. Retention period
- Member data: for the entire duration of the associative relationship and, following termination, for the period provided for by applicable civil and tax regulations (usually 10 years), as well as for the time necessary to protect the Association’s rights.
- Accounting and tax data relating to fees: 10 years from registration, in accordance with current tax legislation.
- Data provided via contact forms: for the time necessary to process the request and, unless otherwise required, for a maximum of 24 months.
- Data for the newsletter: until the data subject withdraws consent (which can be exercised at any time via the unsubscribe link present in every communication).
- Navigation data and cookies: as indicated in the Cookie Policy.
6. Data recipients
Personal data may be communicated to the following subjects, who act as Data Processors pursuant to Art. 28 of the GDPR or as independent controllers:
- Hosting and web infrastructure service providers (SiteGround), for the technical provision of the site;
- Email service providers (Aruba S.p.A. for institutional mail; Brevo for sending transactional communications and the newsletter);
- Stripe Payments Europe Ltd., for the management of electronic payments, as an independent data controller regarding payment data;
- Tax, accounting, and legal consultants of the Association, for legal compliance;
- Public authorities and supervisory bodies, in cases provided for by law.
Data is not subject to dissemination or transfer to third parties for independent commercial purposes.
Transfers outside the EU
Some of the providers indicated may process data outside the European Economic Area. In such cases, the transfer takes place on the basis of adequate guarantees provided for by Articles 44 et seq. of the GDPR, such as Standard Contractual Clauses approved by the European Commission or adequacy decisions.
7. Rights of the data subject
The data subject may exercise at any time, pursuant to Articles 15-22 of the GDPR, the following rights:
- Access to their personal data and information on the processing;
- Rectification of inaccurate data or integration of incomplete data;
- Erasure of data (“right to be forgotten”), in the cases provided for;
- Restriction of processing;
- Portability of data, receiving it in a structured and commonly used format;
- Objection to processing based on legitimate interest;
- Withdrawal of consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal;
- Complaint to the Supervisory Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
Requests should be addressed to: info@anfosc.it
The Controller provides a response within one month of receiving the request, extendable by two months in cases of particular complexity.
8. Cookies
The site uses technical cookies, necessary for its operation, and — subject to the user’s consent — analytical and third-party cookies.
For detailed information on the types of cookies used, the purposes, and the methods for managing preferences, please refer to the Cookie Policy.
The user can change their preferences at any time via the consent management panel available on the site.
9. Minors
The services offered through the site are not intended for individuals under the age of 16. The Controller does not knowingly collect personal data of minors. If the collection of data relating to a minor is detected in the absence of the consent of the holder of parental responsibility, such data will be promptly deleted.
10. Automated decision-making
The Controller does not carry out processing consisting of automated decision-making processes, including profiling, pursuant to Art. 22 of the GDPR.
11. Changes to this policy
The Controller reserves the right to modify or update this policy, also as a result of regulatory changes. Changes will be published on this page with an indication of the last update date. The data subject is invited to periodically consult this policy.
Document drafted in accordance with Regulation (EU) 2016/679 and Legislative Decree 196/2003 as amended by Legislative Decree. 101/2018.
This post is also available in:
