Draft — to be reviewed and approved by INAF’s Data Protection Officer before publication. Last updated: [date].
This notice explains how personal data are processed when you visit this website or write to VisIVO LAB, under Article 13 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 as amended.
Data controller and Data Protection Officer
The data controller is the Istituto Nazionale di Astrofisica (INAF), [Viale del Parco Mellini 84, 00136 Roma], represented by its President. VisIVO LAB is part of INAF — Osservatorio Astrofisico di Catania, Via Santa Sofia 78, 95123 Catania.
INAF’s Data Protection Officer (RPD) can be reached at [RPD email address].
What we process, why, and on what legal basis
- Browsing data. The web server records technical data for every request (IP address, date and time, requested page, browser type) to deliver the site, keep it secure and investigate abuse. Legal basis: performance of a task carried out in the public interest (Art. 6(1)(e) GDPR). Kept for [N] days, unless needed to investigate an incident.
- Contact and visit forms. Name, email, organisation, the topic, the group size and your message are sent by email to visivolab.oact@inaf.it, only to reply to you or organise the visit you ask for. They are not stored in the website database; if a submission has errors, what you typed is kept for up to 10 minutes so you do not have to type it again. Legal basis: steps taken at your request (Art. 6(1)(b)) and INAF’s public tasks of research dissemination and technology transfer (Art. 6(1)(e)). Emails are kept for [N months/years] or as long as the correspondence requires.
- Protection against abuse. To limit automated submissions, the site keeps a one-way hash of your IP address and a counter for at most two hours. The hash cannot be used to identify you and is deleted automatically.
- Content from third parties. The map (OpenStreetMap) and videos (e.g. YouTube, shown via youtube-nocookie.com) load only if you click to allow them. From then on the provider receives your IP address and may set cookies under its own privacy policy, as an independent controller. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time in the cookie policy.
The site does not use profiling or advertising cookies, analytics services or social-network plugins. [If web analytics are added — e.g. Web Analytics Italia — describe them here.]
Who receives the data
INAF staff authorised to handle the request, and the hosting provider [name of the provider / INAF infrastructure], acting as data processor under Article 28 GDPR. Data are not disseminated or sold. INAF does not transfer data outside the European Economic Area; third-party content you choose to load may involve transfers by its provider, under that provider’s safeguards.
Providing data
Fields marked with an asterisk in the forms are needed to reply; without them the message cannot be sent. Everything else is optional.
Your rights
You can ask for access to your data, rectification, erasure, restriction of processing, and object to processing (Articles 15–21 GDPR) by writing to [RPD email address]. You also have the right to lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it).