Transparency · Browsing and dialogue
How we safeguard your data
Visiting the website, asking for information and proposing a collaboration are different ways to contact the Foundation. We use the data necessary for these activities with care for your privacy, without turning an enquiry into a promotional subscription.
Last updated · 21 September 2026
The controller and contact details
The data controller is Fondazione I Custodi della Terra ETS, Italian tax code 05616620265, RUNTS register no. 174420. You can contact us at info@icustodidellaterra.org or by certified email (PEC) at FONDAZIONEICUSTODIDELLATERRA@LEGALMAIL.IT. This part of the notice covers browsing icustodidellaterra.org and general enquiries received by the Foundation; the following sections describe statistics and donations separately.
Browsing and website security
The systems that make the website available process technical data needed for connection and operation, such as IP address, date and time, requested resource, request outcome and information sent by the browser. Technical logs help identify errors, prevent abuse and protect the service: the Foundation does not use them to profile visitors.
The legal basis is the legitimate interest in website security and continuity (Article 6(1)(f) GDPR). Transmission of necessary technical data is inherent in connecting to the website; it is separate from optional consent to Analytics.
Hosting is provided by Register S.p.A., which processes data entrusted to it to deliver the service under the relevant data processing agreement. Website log retention is configured in the control panel to 3 days; hosting-service statistics are disabled. This period applies to the website logs governed by that setting, not indiscriminately to every infrastructure log held by the provider. Any additional retention for incidents, authority requests or applicable obligations concerns only the necessary data and the respective purposes.
When you write to us
We process your email address, name if provided, any organisation you belong to, and the contents of your enquiry and necessary attachments. These are used to respond, assess proposals and maintain the dialogue you initiated. Providing data is optional; without contact details and essential information, we may be unable to reply.
For general, press and collaboration enquiries, the basis is our legitimate interest in responding to communications received (Article 6(1)(f) GDPR). Where an enquiry concerns steps you ask us to take before entering into a contract, Article 6(1)(b) applies instead. Any legal obligations fall under point (c) of the same Article.
Enquiries that do not lead to a subsequent relationship are retained for a maximum of 12 months after closure, then deleted or anonymised. Ongoing relationships, documentation obligations and disputes follow the purposes and periods relevant to that relationship: this does not extend retention of all correspondence indiscriminately. Administrative and accounting donation records follow the separate 10-year period described in the dedicated section.
Do not send passwords, complete card details, unrequested identity documents, personal health information or confidential details about other people. An enquiry does not subscribe you to Foundation updates. You can contact us by email or through the Contact page form, described in the dedicated section below. Public accounts and forms for collecting civic testimonies are not active. Optional Foundation updates are described in the dedicated Guardians privacy notice below.
Access, providers and confidentiality
Data are accessible to people authorised by the Foundation and, as necessary, appointed professionals and technical hosting and email providers. Authorities may receive them where required by law. We do not publish messages received or the contact details of people who write to us. Any publication of testimonies or contributions requires a separate process.
Backups are intended for recovery and follow a technical cycle separate from records used day to day; they are not used to extend ordinary use of deleted data. You may ask us about providers, applicable safeguards and any transfers outside the European Economic Area. For Google and donation platforms, see the specific sections, which also describe international transfers.
Your rights
Where provided by the GDPR, you may request access, rectification, erasure, restriction and portability, object to processing based on legitimate interests and withdraw any consent. Write to info@icustodidellaterra.org: we normally respond within one month, subject to justified extensions permitted by law. You may lodge a complaint with the Italian Data Protection Authority or the competent authority. The Foundation does not use these contacts for solely automated decisions producing legal or similarly significant effects.
Transparency · Your visit, your choices
Privacy, cookies and website statistics
Knowing which content is useful helps us explain our work better. Respecting your choice comes first: you can visit the website without accepting statistics.
In brief
- Google Analytics activates only after you accept.
- Declining does not limit reading the website or prevent you from supporting the Foundation.
- You can change your mind through “Cookie preferences” at the bottom of the website’s pages.
- Consent to statistics does not subscribe you to newsletters or authorise promotional messages.
1. Who is responsible for your data
The data controller is Fondazione I Custodi della Terra ETS, Italian tax code 05616620265, RUNTS register no. 174420. For information or to exercise your rights, write to info@icustodidellaterra.org or to the certified email address FONDAZIONEICUSTODIDELLATERRA@LEGALMAIL.IT.
This section of the notice, provided under Article 13 of Regulation (EU) 2016/679, concerns Google Analytics 4 and preference management on icustodidellaterra.org. Browsing, contact and donations are described in other sections of this page; linked editorial websites have their own notices.
2. Why we use statistics
We use Google Analytics 4 to measure visits, referrals from other websites and editorial campaigns, page views and interactions with public links and documents, to improve the website’s clarity and usefulness. The legal basis is your optional consent under Article 6(1)(a) GDPR; tracking tools are used only after your choice under Article 122 of the Italian Privacy Code.
We do not use this integration for personalised advertising, assessing individual donors or making automated decisions that produce legal or similarly significant effects on people. We do not connect statistics to lists of Guardians.
3. What information is processed
After acceptance, Analytics may process pseudonymous browser and session identifiers, the page and title viewed, time and technical visit data, device and browser characteristics, language, operating system, and session and engagement information. Granular device and geographical data collection remains enabled: information such as the city inferred from the connection may therefore be available, rather than GPS location requested by the website.
The IP address is necessarily used in communication with servers. According to Google’s documentation, for traffic originating in the EU it is used to derive geographical information and then discarded before Analytics data are logged. This does not make all processing anonymous: identifiers and browsing information remain data that require protection. Google’s information on processing European data.
Our integration sends the canonical address and public title of the page, without fragments or additional parameters. To identify referrals, it sends only the referring website domain and protocol, without its path, parameters or fragments. It also sends the source, medium and name of editorial campaigns listed in the Foundation’s approved catalogue. Visits with parameters other than these campaigns or the predefined contact categories are excluded from measurement. We do not send names, email addresses, IBANs, donation amounts or message and form contents to Analytics.
We measure the referring website domain, approved editorial campaigns, scrolling to 90%, clicks on external links and links to contact and support pages, and clicks on institutional PDFs. We do not send referring website paths or parameters, link text or form fields. A click does not prove a completed download, a sent message or a completed donation. Google Signals and automatic enhanced measurement remain disabled. We record these events with parameters limited to predefined categories, external link domains and the names of the four institutional PDFs. User-ID, user-provided data, advertising signals and the four optional Analytics account data-sharing settings remain disabled for this integration. Extended measurement requires renewed acceptance: previous refusals that are still valid continue to be respected. Technical session and engagement events generated by the service are distinct from events configured on the website.
4. What is stored in your browser
Technical local storage is used to respect and remember your choice; it does not require acceptance of statistics. This processing is necessary to manage preferences and meet consent obligations under Article 6(1)(c) GDPR and Article 122 of the Italian Privacy Code, not to measure browsing.
| Tool | Purpose | Configured duration |
|---|---|---|
icdt-consent-v1 |
This website’s local storage: choice, date and version. It is not an Analytics cookie and contains no name or email address. | The choice is valid for 180 days and is replaced if you change it. After expiry, it is no longer considered valid. |
_ga |
Pseudonymous identifier used by Google Analytics to distinguish browsers. | 180 days from creation, without automatic renewal on each visit; only after consent. |
_ga_* |
Session information for the website’s Analytics property. | 180 days from creation, without automatic renewal on each visit; only after consent. |
Your browser may apply shorter periods or prevent storage. In that case, your choice may not be remembered on subsequent visits. Local storage does not have automatic deletion equivalent to a cookie’s expiry: an expired choice may remain in the browser, but does not enable Analytics and is replaced when you make your next choice. You can remove it through your browser settings.
5. Accepting, declining or changing your mind
On your first visit, you can choose “Accept statistics”, “Decline” or close without accepting. Scrolling or continuing to browse does not constitute consent. Before acceptance, we do not load the Google tag or send even denied-consent signals to Analytics.
To withdraw consent already given, open “Cookie preferences” and choose “Decline”. We stop further transmissions, remove this website’s Analytics cookies and reload the page to deactivate the library. Closing a reopened panel does not change your previous choice: if you accepted, you must choose “Decline” to withdraw consent.
Withdrawal does not affect the lawfulness of earlier processing and does not itself delete data already received by Google. You can contact us about a request relating to those data. Your preference applies to the browser and device used; it must be managed separately on other browsers or devices.
6. How long data are retained
In the Foundation’s Analytics property, retention of detailed user and event data is set to 2 months, without renewal upon new user activity. Deletion follows the service’s technical cycles; this is not the cookie duration. Standard aggregated reports are not subject to the same setting and may remain available beyond two months. How Google applies data retention.
7. Who can access data and where they are processed
Access to the Foundation’s statistics is restricted to authorised people and any appointed professionals, according to their respective roles. The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which processes Analytics data on the controller’s behalf under its data processing terms, using the subprocessors provided for in those terms.
Processing may involve transfers outside the European Economic Area, including to the United States. Google states that it uses the EU–US Data Privacy Framework for transfers covered by the relevant adequacy decision and, where applicable, the European Commission’s Standard Contractual Clauses. Safeguards and related documents can be consulted on Google’s international transfers page; you can request further information from the Foundation. We do not promise that all data remain in Europe.
Please also consult Google’s privacy policy. Consent given here concerns only our website’s statistics and does not replace choices requested by Google for its other services.
8. Your rights
In the cases and within the limits provided by Articles 15–22 GDPR, you may request access, rectification, erasure, restriction and portability of your data, and object to processing where the relevant conditions apply. You may withdraw consent at any time and lodge a complaint with the Italian Data Protection Authority or the competent authority in the country where you live or work.
Write to info@icustodidellaterra.org. We will normally respond within one month, subject to justified extensions permitted by the GDPR. Since we do not associate visits with your name or email address, we may need strictly necessary information to locate the data or verify the request: do not send unrequested passwords, documents or payment details.
9. Services separate from statistics
Google Search Console is verified through a DNS record: this verification installs neither cookies nor tracking code in visitors’ browsers. The Donorbox link opens an external website; we do not embed a Donorbox form or script here. Analytics consent does not authorise newsletters, is not required to donate and does not change the privacy notices applicable to donations.
This notice will be updated if tools, purposes or relevant settings change; a new choice will be requested where necessary. It should be read alongside the notices covering the Foundation’s other processing activities.
Privacy and donations: how we safeguard your data
Notice under Articles 13 and 14 of Regulation (EU) 2016/679. Updated on 20 September 2026. It concerns donations to the “Diventa Custode — un futuro per le tartarughe” (Become a Guardian — a future for tortoises) campaign and enquiries addressed to the Foundation.
Who processes the data
The controller is Fondazione I Custodi della Terra ETS, Italian tax code 05616620265, RUNTS 174420. For information and to exercise your rights: info@icustodidellaterra.org; certified email (PEC): FONDAZIONEICUSTODIDELLATERRA@LEGALMAIL.IT.
Which data and for what purposes
We process first name, surname, email address, donation amount, date, frequency, outcome and reference, received from you and payment providers; we also process information you provide for assistance or donation acknowledgements, including tax details where necessary. Do not email complete card numbers, security codes or login credentials.
We use these data to execute and manage the donation and related enquiries (Article 6(1)(b) GDPR), fulfil administrative and tax obligations (Article 6(1)(c)), prevent abuse and protect our rights (legitimate interests, Article 6(1)(f)). Required fields are necessary to complete this process; without them, the online donation cannot be processed. Further data are requested only where necessary for the specific enquiry.
Who may access the data
Data may be accessed by people authorised by the Foundation, professionals appointed to fulfil obligations and, where required by law, competent authorities. Donorbox (Rebel Idealist Inc.) manages the platform as processor for data processed on our behalf. It may act as controller for its own purposes. Stripe and PayPal process payments and also carry out independent processing, for example for security and regulatory obligations.
The Foundation does not receive complete card numbers or card security codes. Providers may collect technical data and further information necessary for the transaction under their own privacy notices.
External services and transfers
The campaign page is hosted by Donorbox, not the Foundation’s website. Providers may also process data outside the European Economic Area, including in the United States. Their notices describe the safeguards used, such as Standard Contractual Clauses and adequacy decisions where applicable. You can request information and copies of relevant safeguards through providers’ privacy contacts or the Foundation.
Consult the privacy notices of Donorbox, Stripe and PayPal for their respective processing, cookies, anti-fraud checks and retention.
Retention periods
The Foundation retains administrative and accounting donation records for 10 years from the relevant recording date. Information enquiries without a donation are retained for a maximum of 12 months after closure. Any additional periods concern only data needed for legal obligations, investigations or disputes, until those matters are resolved. At expiry, data no longer needed are deleted or anonymised. Providers’ independent processing follows the periods stated in their own notices.
No automatic newsletter subscription
Donating does not subscribe you to a newsletter. The Foundation uses email for communications about your contribution and enquiries; it does not publish donors’ names or individual amounts. For this process, it does not carry out profiling or solely automated decisions with legal or similarly significant effects. Payment providers’ checks are described in their own notices.
Your rights
You may request access, rectification, erasure, restriction and, where applicable, portability; you may object to processing based on legitimate interests. Erasure does not apply to data that must be retained by law. For processing based on consent, you may withdraw it without affecting processing carried out before withdrawal. Write to info@icustodidellaterra.org. You may also lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority.
The “Write to the Foundation” form
The controller is Fondazione I Custodi della Terra ETS (Italian tax code 05616620265, RUNTS 174420), contactable at info@icustodidellaterra.org. The form collects name, email address, topic and message; organisation and link are optional. For editorial proposals, we also ask for the type and subject of the material. Attachments, personal documents and health data are not requested. Required fields help us understand the enquiry and respond: without them, the form cannot send it; you can still use email.
Data are forwarded to the Foundation’s mailbox through the hosting provider’s email service; this form does not retain a copy of messages in the WordPress database. Authorised people and technical providers may access them as necessary. The legal basis is the legitimate interest in responding to enquiries and assessing proposals (Article 6(1)(f) GDPR); Article 6(1)(b) applies to pre-contractual steps requested by the data subject, and Article 6(1)(c) to legal obligations. The checkbox confirming that you have read the notice is not marketing consent.
Enquiries with no subsequent relationship are retained in correspondence for a maximum of 12 months after closure. Ongoing relationships and documentation obligations follow the relevant periods: administrative and accounting donation records remain separate, with 10-year retention. Correspondence is deleted by the Foundation, not automatically by the form.
To prevent abuse, the website uses local checks, a temporary code and counters linked to a pseudonymised representation of the IP address, without storing the plain-text IP in those counters. These technical data are valid for no more than one hour and are removed after expiry by periodic clean-up or the next use of the service. They are not sent to external anti-spam services. Hosting logs and the backup cycle described in the general notice remain separate.
No newsletter subscription, automatic publication of contributions or automated decision with legal effects takes place. Any editorial publication requires a separate assessment and agreements on materials, attribution and permissions. For access, rectification, erasure, restriction, objection and, where applicable, portability, write to the controller; you may lodge a complaint with the Italian Data Protection Authority. The other sections of this notice also apply to recipients, transfer safeguards and further details.
Form version: 21 September 2026.
A message after a bank transfer
In the bank-transfer sections of the Support and Donate pages you can leave a name, an email address or a message. Each field is optional; to send a communication, at least one must contain something. You can donate without using this form. No account, transfer amount, date, payer details or attachment is required. Without an email address we cannot reply personally. A message does not prove a donation, confirm a credit or replace a request for a donation statement.
The controller is Fondazione I Custodi della Terra ETS, tax code 05616620265, RUNTS 174420; contact: info@icustodidellaterra.org. The purpose is to receive your communication and, where possible, reply and thank you. The legal basis is the legitimate interest in handling communications initiated by visitors (Article 6(1)(f) GDPR). This does not enrol you in a newsletter, publish your name or authorise marketing.
Messages are forwarded to the Foundation’s email address through the hosting mail service, without a copy being stored in the WordPress database and without an automatic reply to the sender. Access is limited to authorised persons and technical providers as necessary. Correspondence without a subsequent relationship is retained for no more than 12 months after closure; continuing relationships and legal obligations remain separate. A message is not automatically classified as donation accounting documentation. The Foundation manages deletion of correspondence; it is not automated by this form.
The form uses the same local anti-abuse safeguards described in the contact-form notice: temporary signed codes, duplicate-send protection and pseudonymised rate-limit counters lasting no more than one hour. It does not send form values to Analytics, Donorbox or external anti-spam services. Hosting logs and backups remain subject to the separate terms above. For access, correction, erasure, restriction, objection and portability where applicable, contact the controller. You may lodge a complaint with the Italian Data Protection Authority. The other sections of this notice explain the technical providers, international transfers and remaining safeguards.
Version: 10 October 2026.
Direct donations through PayPal
The “Donate with PayPal or card” link opens PayPal’s secure donation page in a new tab, while the Foundation’s website stays open. This component does not embed or load PayPal scripts, images or payment forms. When you follow the link, PayPal receives the technical information needed to provide its service, including your IP address and browser/device information, and may use its own cookies or similar technologies. Depending on your device, the PayPal app may open instead.
The amount, payment method and any further information are entered in PayPal’s interface. Our website does not collect card details, store a payment form or confirm a donation solely from a browser callback. PayPal processes data under its own privacy notice and terms, including any international transfers. The Foundation receives the donation and transaction information made available by PayPal to administer the contribution and any requested statement; the donation purposes, authorised recipients and ten-year accounting retention described above apply. No newsletter subscription is created. Technical activation of the payment service is separate from optional Analytics consent.
Version: 10 October 2026.
Guardians and Foundation updates
Dedicated privacy notice under Article 13 of Regulation (EU) 2016/679, version 11 October 2026. Controller: Fondazione I Custodi della Terra ETS, tax code 05616620265. Contact: info@icustodidellaterra.org; certified email FONDAZIONEICUSTODIDELLATERRA@LEGALMAIL.IT.
With your voluntary consent, we use your email to send project news, initiatives and opportunities to take part or support the Foundation. We verify your address with a confirmation email before activating updates and assigning your personal Guardian code. The code is a symbolic identifier, not a statutory position, certification, donation receipt or indication of the total number of Guardians. You do not need to donate or create an account. Donors and collaborators are not automatically added to updates.
We record your email, chosen language, confirmation date, consent notice version, update status and personal code. On the confirmation page you may also provide your first name, last name, city and an area of interest: all four fields are optional. With your consent, expressed by providing these details and confirming, we use them to address you personally and understand the interests you choose to share with us. There is no automated scoring or behavioural profiling. Leaving them blank does not prevent you from joining. These details are kept in the private register and removed together with your email under the deadlines below. We do not request a phone number, street address, occupation or financial data. The legal basis for updates and optional details is consent (Article 6(1)(a)); strictly necessary security and minimal evidence records are based on the legitimate interests of protecting the service and demonstrating how your choice was handled (Article 6(1)(f)).
Access is restricted to authorised Foundation administrators and its appointed technical providers. The register is held in the Foundation’s WordPress database on its existing Register.it hosting; confirmation and welcome messages use the website’s existing mail service. This component adds no external mailing platform, advertising, opening pixels, behavioural profiling or automated decisions about you. Data is not published or sold. Existing infrastructure providers and any applicable transfer safeguards remain as described in the general notice.
Unconfirmed requests expire and are removed after 7 days. Updates remain active until withdrawal; after 24 months without a renewed confirmation, the record is flagged for review and updates are suspended. Contact details are removed within 30 days of withdrawal or suspension; a verified erasure request can be handled immediately. Only minimal consent/withdrawal evidence, including a keyed email fingerprint instead of the address, is retained for 12 months after withdrawal or suspension, then removed. The unlinked sequence number remains reserved and is never reassigned. Expiry is processed hourly by WordPress and on subsequent use; infrastructure backups follow their separate retention cycle and are not used for updates.
Anti-abuse controls use a daily rotating keyed network fingerprint and short-lived counters, not a stored clear IP in this register. Application anti-abuse records last at most one day; infrastructure access logs remain separate. Confirmation and withdrawal links contain private tokens: do not share them. Every periodic update must include a way to withdraw without signing in.
You can withdraw consent at any time using the link in our messages or by writing to info@icustodidellaterra.org, without affecting the lawfulness of earlier processing. You can request access, rectification, erasure, restriction or portability where applicable, and object to processing based on legitimate interests. You may lodge a complaint with the Italian Data Protection Authority. Refusing or withdrawing updates does not prevent you from donating, contacting us or sharing the Foundation’s values.
