Information Privacy
Last updated: 10 October 2026
This notice explains how personal data are processed when you visit csmbr.fondazionecomel.org (the “Website”), the website of the Centre for the Study of Medicine and the Body in the Renaissance (CSMBR), Domus Comeliana, Pisa, or when you use the services linked from it. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended). It does not cover other websites you may reach through links, which have their own notices.
1. Data controller
The Website and the CSMBR are run by Institutio Santoriana – Fondazione Comel (the “Foundation”), registered office Via F.lli Maggiolini 1, 20122 Milan, Italy, tax code 97117040150, which is the data controller.
Contact for any privacy matter: segreteria@fondazionecomel.org.
2. Data we process, purposes and legal bases
2.1 Browsing data
The servers and software that run the Website automatically collect certain data whose transmission is implicit in the use of internet protocols. These include the IP address of your device, the date and time of the request, the address of the page requested, the method and result of the request, the size of the response and information about your browser and operating system.
These data are used only to operate the Website, to keep it secure (for example, to detect and block attacks) and to produce aggregated statistics. The legal basis is the Foundation’s legitimate interest in providing a working and secure website (Article 6(1)(f) GDPR). They may be made available to the competent authorities if needed to investigate offences against the Website.
2.2 Data you send us by e-mail
No page of the Website contains a form that collects personal data: the forms for the newsletter, membership, event registration and applications are hosted by the third-party services described in sections 2.3 and 2.4. If you write to us at the e-mail addresses shown on the Website, for example info@csmbr.fondazionecomel.org, we receive your e-mail address and any other personal data you include in your message, including any documents you attach.
We use these data only to reply to you and to deal with your request. The legal basis is the performance of steps you request (Article 6(1)(b) GDPR) and our legitimate interest in answering correspondence (Article 6(1)(f) GDPR).
2.3 Newsletter
The “Subscribe” button opens a sign-up page that is not part of the Website: it is hosted on the MailUp e-mail marketing platform (address e3e2b.emailsp.com). On that page we ask for your e-mail address, first name, surname and affiliation, and we send you an e-mail asking you to confirm your subscription.
We use these data only to send you the CSMBR newsletter about our events, lectures and publications. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time, without affecting earlier processing, through the unsubscribe option provided with our e-mails or by writing to us.
The mailing list is kept on the MailUp platform, operated by TeamSystem S.p.A. (Italy), in an account held by Ancis S.r.l. (Italy). The sign-up page is protected by Google reCAPTCHA, which sends Google technical data about your device and your use of the page in order to tell people from automated programs. The sign-up page is run by the platform operator, sets its own technical cookies and is also covered by that operator’s privacy notice.
2.4 Membership, event registration and applications
Some pages link to forms hosted by Jotform Inc. (form.jotform.com): to become a member of the CSMBR, to register for some events, and to apply for grants and fellowships. Depending on the form, we ask for your name, e-mail address, telephone number, postal address, nationality, affiliation and, optionally, the address of your Facebook profile; for applications, your CV and supporting documents; for some events, your dietary requirements and whether you agree to be filmed. One event page links instead to a form hosted by Google (Google Forms).
We use these data to manage your membership, your registration or your application, including the selection procedure, and to contact you about it. The legal basis is the performance of a contract or of steps you request before entering into one (Article 6(1)(b) GDPR) and, for payment records, compliance with our legal obligations (Article 6(1)(c) GDPR). Where a form asks whether you wish to receive updates about CSMBR events or grants, we send them only if you answer “Yes” (consent, Article 6(1)(a) GDPR).
Membership and registration fees are paid to the Foundation, either through PayPal, which processes your payment data under its own privacy notice, or by bank transfer, in which case the form asks you to upload the payment receipt.
A registration form may ask whether you have a disability, a health condition or a food allergy we should know about. If you choose to answer, we use the information only to make the arrangements you need, on the basis of your explicit consent (Article 9(2)(a) GDPR), and you may withdraw it at any time by writing to us.
2.5 Cookies
The Website does not use cookies for analytics, advertising or profiling. On article pages it sets one cookie of its own, named mkd-post-views_ followed by the number of the article. It contains only that number and is used by the Website’s theme to count article views. It is not shared with anyone. It is set to expire far in the future; Chrome-based browsers limit its duration to 400 days. You can delete it at any time from your browser settings, and the Website works without it.
Technical cookies are also set for users who log in to the Website’s administration area.
2.6 Content from third parties
To display the Website, your browser downloads some content directly from third-party servers. When this happens, those providers receive your IP address and the technical data your browser normally sends:
- Google Fonts (Google Ireland Limited / Google LLC), used for the Website’s typefaces, on all pages;
- YouTube (Google Ireland Limited / Google LLC), on the pages that show videos. Videos are embedded in YouTube’s privacy-enhanced mode (youtube-nocookie.com): when the player is displayed, your browser contacts Google’s servers. No cookies are set when the page loads, but the YouTube player stores some information in your browser’s local storage even before you start a video, and may store or read further information if you play one.
See Google’s privacy policy. Links to social networks and to other websites do not transfer any data until you follow them.
3. How data are processed and who receives them
Data are processed electronically by staff and collaborators authorised by the Foundation, with security measures designed to prevent loss, misuse and unauthorised access.
They may also be processed by the Foundation’s technical service providers, acting as data processors under Article 28 GDPR: the hosting provider of the Website (Register S.p.A., Italy), the e-mail provider (Microsoft), and the IT consultants who maintain the Website.
For the services described in sections 2.3 and 2.4, data are also received by TeamSystem S.p.A. and Ancis S.r.l. (newsletter, MailUp platform), by Jotform Inc. (forms), by Google (reCAPTCHA and Google Forms) and by PayPal (payments).
Data are not sold and are not disclosed to other third parties, except where required by law.
4. Transfers outside the European Economic Area
Our e-mail provider, Microsoft, stores and processes the data of its European business customers within the European Union under its EU Data Boundary, with limited exceptions. Google, which provides the services described in sections 2.3, 2.4 and 2.6, and Jotform Inc., which hosts the forms described in section 2.4, may process data in the United States. Any transfer outside the European Economic Area relies on the European Commission’s adequacy decision for the EU–US Data Privacy Framework or, where applicable, on standard contractual clauses (Article 46 GDPR).
5. Retention
Browsing data in server logs are deleted automatically on a rolling basis, unless needed for longer to investigate a security incident.
E-mail correspondence is kept for as long as needed to deal with your request and is then deleted, unless we must keep it by law.
Newsletter data are kept until you unsubscribe or ask for their erasure; after you unsubscribe, your address is kept only with its unsubscribed status, so that you are not contacted again.
Membership and registration data are kept for the duration of the membership or of the event and of the related activities; applications are kept for as long as needed to run the selection and to document its outcome. Payment records are kept for ten years, as required by Italian law on accounting records (Article 2220 of the Civil Code).
6. Your rights
You have the right to access your personal data and to obtain their rectification, erasure or restriction of processing. You also have the right to data portability where applicable, and the right to object to processing based on legitimate interest (Articles 15–22 GDPR). Where processing is based on consent, you may withdraw it at any time without affecting earlier processing.
To exercise your rights, write to segreteria@fondazionecomel.org.
You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the EU country where you live or work.
7. Whether you must provide data
Apart from browsing data, providing personal data is voluntary. If you do not provide the data a form marks as required, we may not be able to process your membership, registration or application, or to reply to you.
8. Automated decisions
No decisions based solely on automated processing, including profiling, are taken.
9. Changes
This notice may be updated. The date of the latest version is shown at the top.