Privacy Notice issued by Fondazione AVSI – ETS pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) and Article 122 of Legislative Decree No. 196/2003 (“Privacy Code”)
In brief
Some AVSI e-mails contain an invisible image (pixel) and links that tell us whether you open the message and what you click on. For users subscribing from 29 October 2026 onwards, we use them for individual measurement purposes only with consent; for users who were already subscribed, the provisions set out in Section 4 apply. You may receive our e-mails without tracking at any time through the “E-mail Preferences” link at the bottom of each message, without any consequences for the communications you receive.
1. Who processes your data
Data Controller: Fondazione AVSI – ETS — registered office: Via Padre Vicinio da Sarsina 216, 47521 Cesena (FC), Italy; administrative office: Via Donatello 5/b, 20131 Milan, Italy — Tax Code: 81017180407
Privacy contact: [email protected]
Data Protection Officer (DPO): Consulenti Privacy S.r.l. — Paolo Rosetti - [email protected]
2. What pixels are and what data we collect
A pixel is a very small image, usually transparent, embedded in an e-mail. When you open the message, your e-mail client downloads it from the servers of the sending platform and, through this request, transmits certain information. Tracked links work in a similar way: before directing you to the destination page, they pass through an address that records the click.
We collect:
- message opening data: whether and when you open the message and how many times;
- clicks on links contained in the message;
- IP address;
- device type, operating system and e-mail client;
- a randomly generated identifier linked to your e-mail address only within the sending platform.
3. Why we use pixels and the legal basis for processing
a) Anonymous and aggregated statistics
- Purpose: to measure how many campaign emails are delivered and opened, in order to check that email delivery is working properly.
- Legal basis: consent is not required, as measurement is carried out solely on an aggregated basis, using the same pixel for all recipients of a campaign, with IP addresses and device data anonymised. Article 6(1)(f) GDPR: our legitimate interest in verifying the successful delivery of our emails.
- Data retention: anonymous aggregated data: retained indefinitely. Technical data before anonymisation: 48 months.
b) Individual tracking
- Purpose: to know whether you open our emails and which links you click on, so that we can improve the content, relevance and frequency of our communications (for example, by avoiding resending a message to someone who has already read it).
- Consent: Article 122 of the Privacy Code and Article 6(1)(a) GDPR. For people who subscribed before 29 October 2026, see Section 4.
- Data retention: 48 months, after which data will be deleted or anonymised.
c) Evidence of your choices
Purpose: to record consent and its withdrawal.
Legal basis: Article 6(1)(c) GDPR, in connection with Article 7(1) GDPR.
Data retention: for the duration of your subscription and for 48 months following withdrawal of consent or unsubscribing.
Service communications (subscription confirmations, donation receipts, privacy notice updates and security alerts) do not contain tracking pixels.
4. Is consent mandatory? Your choices
- Consent to tracking is optional and separate from your consent to receive our emails. If you do not give consent, you will continue to receive the same communications, without pixels or tracked links and without any restrictions.
- Subscriptions from 29 October 2026 onwards: we ask for your consent when you subscribe, through a dedicated, unticked checkbox.
- Subscribers before 29 October 2026: we have informed you through a dedicated communication. Individual tracking (purpose b) will continue until you deactivate it, which you can do at any time with a single click.
5. Who we share your data with
a) AVSI personnel authorised to process data
- Role: Authorised persons (Article 29 GDPR; Article 2-quaterdecies of the Privacy Code).
- Purpose: Management of communications.
b) Diennea S.r.l.
- Role: Data Processor (Article 28 GDPR).
- Purpose: Sending emails and tracking opens and clicks on behalf of AVSI.
c) Public authorities, where required by law
- Role: Independent Data Controllers.
- Purpose: Compliance with legal obligations.
Data are not made public or disclosed to third parties for their own purposes, except as indicated above.
6. Transfers outside the European Economic Area
Data are processed within the European Economic Area. Should transfers to third countries become necessary, they will be carried out in accordance with the applicable legal provisions.
7. How we protect your data
Each recipient is associated with a random, non-intelligible and non-sequential code. The link between the code and the e-mail address remains within an internal and separate layer of the sending platform: your e-mail address is not transmitted within the pixel request. Access to the data is restricted to authorised personnel.
Information regarding your interactions may be used to better understand your interests in AVSI initiatives. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).
8. How to change your preferences
At the bottom of every AVSI email, you will find:
- Tracking preferences: to deactivate tracking only while continuing to receive emails;
- Unsubscribe: to stop receiving our communications.
You can also write to [email protected]. Your choice applies across all systems used by AVSI to send emails. After withdrawing your consent, you will receive messages without pixels or tracked links. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
9. Your rights
Subject to the limits provided for by law, you have the right to:
- access your personal data and obtain a copy (Article 15 GDPR);
- request their rectification (Article 16) or erasure (Article 17);
- request restriction of processing (Article 18);
- receive your data in a structured format and transmit them to another controller, where processing is based on consent (Article 20);
- object to processing based on legitimate interests (Article 21);
- withdraw your consent at any time, as easily as you gave it (Article 7(3)).
To exercise these rights, write to [email protected] or to the DPO ([email protected]). We will respond within one month. This period may be extended by a further two months in complex cases, in which case we will inform you of the reasons for the extension (Article 12(3) GDPR).
10. Complaints
If you believe that the processing of your personal data infringes applicable data protection law, you may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it), pursuant to Article 77 GDPR, or bring legal proceedings before the competent judicial authority (Article 79 GDPR and Article 152 of the Privacy Code).
11. Updates
We reserve the right to amend this privacy notice as necessary. We invite you to review this page periodically should you wish to keep track of any changes.
This privacy notice was last updated on 29 October 2026.