Privacy Policy

Last updated: 25 September 2026.

1. Introduction

This notice explains how personal data of visitors to officinafilarmonica.it and of people taking part in the Association’s activities are processed. It is provided under Article 13 of Regulation (EU) 2016/679 (“Regulation” or “GDPR”) and Italian Legislative Decree 196/2003 (“Italian Privacy Code”).

This notice applies only to this website and not to any other websites that may be reached through links.

2. Data Controller

The Data Controller is the Association “Officina Filarmonica – ETS” (“Officina Filarmonica”), based at Via Carlo Mirabello 34, 00195 Rome, Italy, Tax Code 96615960588. Email: officinafilarmonica @ gmail.com. For any request concerning your personal data, you can write to this address.

3. What data we process

Browsing data. During normal operation, the website’s IT systems collect some data whose transmission is implicit in the use of Internet protocols. This includes:

  • IP address;
  • date and time of the request;
  • resources requested;
  • server response code;
  • information about the browser and operating system.

This data is used to ensure the website works properly and securely and to detect any misuse.

Data provided through forms and email. When you send a contact request, an application, or a request to join as a member or volunteer, we collect the data you enter: first and last name, contact details, musical instrument and level of experience, and any other information you choose to provide.

Audition videos. To take part in the selections, you can send us videos showing your image and your musical performance. Videos can be sent via WeTransfer, email or WhatsApp.

Members’ and volunteers’ data. Personal details, tax code, contact details and the data needed to keep the register of members and the register of volunteers, and to provide volunteers with insurance cover.

Donation data. First and last name, email, amount and, if a receipt for tax benefits is requested, tax code and address. Payments are handled by Stripe. Card details are entered directly on Stripe’s systems and are never stored by Officina Filarmonica.

WhatsApp groups. We may use WhatsApp groups to organise rehearsals, courses and events. In these groups, your telephone number, name and any profile picture are visible to the other members.

Images of rehearsals, concerts and events. Photos and videos may be taken during activities, showing participants and sometimes the audience.

Newsletter data. Email address and, where applicable, your name, only if you have consented to subscribe.

Minors’ data. Minors may also take part in the activities. Their data is provided, or authorised, by the holders of parental responsibility.

Cookies and analytics tools. These are described in the Cookie Policy, which forms an integral part of this notice.

4. Purposes and legal bases

Contact requests. We process data to reply to requests sent through the website, by email or via social media. Legal basis: pre-contractual measures taken at your request (Art. 6.1.b GDPR).

Applications and auditions. We process data and videos to assess applications and select participants for musical activities. Legal basis: pre-contractual measures taken at your request (Art. 6.1.b GDPR).

Participation in activities. We process data to organise and manage rehearsals, courses, concerts and events, and to send you related communications. Legal basis: performance of the membership relationship or participation agreement (Art. 6.1.b GDPR).

WhatsApp groups. We process your telephone number to add you to the WhatsApp groups used to organise activities. You are only added with your agreement and you can leave the group at any time. Legal basis: consent (Art. 6.1.a GDPR).

Members and volunteers. We process data to manage the membership relationship, keep the register of members and the register of volunteers, and insure volunteers, as required by the Italian Third Sector Code (Legislative Decree 117/2017). Legal basis: performance of the membership relationship (Art. 6.1.b GDPR) and legal obligation (Art. 6.1.c GDPR).

Donations. We process data to receive donations, issue receipts and fulfil tax obligations. Legal basis: performance of the donor’s request (Art. 6.1.b GDPR) and legal obligation (Art. 6.1.c GDPR).

Publication of photos and videos of participants. We publish on the website and on our social media profiles images of rehearsals, concerts and events showing participants, to document and promote the Association’s activities. Legal basis: consent (Art. 6.1.a GDPR), collected through a specific release form. For minors, consent is given by the holders of parental responsibility. Consent may be withdrawn at any time.

Images of the audience. During public concerts and events, general images showing the audience may be taken, without focusing on individuals. Legal basis: the Association’s legitimate interest in documenting its activities (Art. 6.1.f GDPR). Anyone who recognises themselves in an image may request its removal.

Newsletter. We process data to send you our newsletter with information about activities and events. Emails contain a pixel that measures opens and clicks, as described in the Cookie Policy. Legal basis: consent (Art. 6.1.a GDPR), which may be withdrawn at any time.

Website security. We process data to ensure the security of the website and prevent misuse. Legal basis: legitimate interest of the Association (Art. 6.1.f GDPR).

Legal claims and requests from authorities. We process data to establish, exercise or defend legal claims in court or administrative proceedings, and to respond to requests from public authorities. Legal basis: legitimate interest of the Association (Art. 6.1.f GDPR) and legal obligation (Art. 6.1.c GDPR).

5. Whether providing data is required

Applications, participation in activities, joining as a member or volunteer, donations. Providing data is necessary. Without it, we cannot assess your application, you cannot take part in activities or join the Association, and we cannot issue a donation receipt.

WhatsApp groups, publication of images and newsletter. Consent is optional. Refusing has no effect on your participation in activities.

Contact form. Fields marked as mandatory are required in order to reply to your request.

6. How data is processed and security

Data is processed electronically and, where necessary, on paper, only by authorised persons. Appropriate technical and organisational measures are in place to protect it against loss, unlawful use and unauthorised access.

No decisions are made based solely on automated processing, including profiling.

7. Retention periods

Contact requests. Requests that do not lead to an application or membership are kept for 12 months from receipt.

Applications and audition videos. These are kept until the selection is completed. If the outcome is negative, they are deleted within 6 months of completion. If the outcome is positive, they are kept for the duration of participation in the activities.

Participants’ data. This data is kept for the duration of participation and for the following 2 years, to organise future activities and handle any disputes.

Members’ and volunteers’ data. This data is kept for the duration of the relationship and, after it ends, for the period required by Third Sector legislation and civil law obligations, and in any case for no longer than 10 years.

Donations. Data is kept for 10 years, for tax and civil law purposes (Art. 2220 of the Italian Civil Code).

Published photos and videos. These remain published as long as they document the Association’s activities, unless consent is withdrawn or removal is requested.

Newsletter. Data is kept until you unsubscribe or withdraw your consent.

Server logs. Logs are kept for 30 days, unless needed to investigate computer crimes.

In the event of a dispute, data may be kept for as long as necessary to resolve it.

8. Recipients of data

Data may be disclosed to the following categories of recipients:

  • providers of technical services acting as data processors (Art. 28 GDPR): website hosting and maintenance, email (Google), and the newsletter delivery platform based on Amazon Web Services;
  • WhatsApp (Meta), for activity organisation groups and for receiving audition videos; WeTransfer and email, for receiving videos;
  • Stripe, for processing donations;
  • the insurance company, for volunteers’ insurance cover;
  • professionals providing tax and accounting advice;
  • public authorities, to fulfil legal obligations.

For certain processing activities, such as fraud prevention and anti-money laundering obligations, Stripe acts as an independent controller, in accordance with its own privacy policy.

Photos and videos published on social networks are publicly visible and are also processed by the platform operators in accordance with their own privacy policies. Apart from this publication, data is not made public.

9. Transfers of data outside the European Union

Some providers (Google, Meta, Stripe and Amazon Web Services) belong to groups headquartered in the United States. Data may therefore be transferred to, or accessed from, outside the EU.

Such transfers take place on the basis of the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework, to which these providers adhere, and of the standard contractual clauses approved by the Commission (Articles 45 and 46 GDPR).

10. Your rights

You may exercise the rights provided by Articles 15-22 GDPR at any time:

  • access to your data;
  • rectification;
  • erasure;
  • restriction of processing;
  • data portability;
  • objection to processing based on legitimate interest, including the publication of images of the audience.

You may withdraw any consent you have given at any time, for example for WhatsApp groups, the newsletter or the publication of images. For the newsletter, you can also use the unsubscribe link included in every email. Withdrawal does not affect the lawfulness of processing carried out before it.

To exercise your rights, write to officinafilarmonica @ gmail.com.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

11. Changes

This notice may be updated. The current version is always published at https://officinafilarmonica.it/en/privacy-policy, together with the date of the last update.