Privacy Policy

The following describes some personal data processing procedures of the Order of Architects, Planners, Landscapers and Conservationists of the Province of Milan (the Order) and of the Foundation of the Order of Architects, Planners, Landscapers and Conservationists of the Province of Milan (the Foundation). This includes the processing of users who consult the website www.ordinearchitetti.mi.it and other web services accessible from it. Other websites that may be consulted by the user through links are excluded.

Data Controller and Data Protection Officer

For some processing operations, the data controller is:

Order of Architects, Planners, Landscapers and Conservationists of the Province of Milan

Via Solferino 19 - 20121 Milano

email: segreteria@ordinearchitetti.mi.it; segreteria@oamilano.it (registered e-mail).

 

For some processing operations, the data controller is:

Foundation of the Order of Architects, Planners, Landscapers and Conservationists of the Province of Milan

Via Solferino 19 - 20121 Milano

email: fondazione@architettura.mi.it; fondazione@oamilano.it (registered e-mail).

The Order of Milan has also appointed a Data Protection Officer (DPO), who can be contacted either at the Order of Milan administrative office or by emailing privacy@ordinearchitetti.mi.it.

Purposes, duration and legal basis of data processing

Processing of browsing data (controller: Order)

The data being processed are IP addresses or domain names of computers used by users connecting to the site, the time of the request and other parameters related to the user's operating system and computing environment.

Visitor browsing behaviour is also analysed, e.g., which pages are visited before or after others. Data are collected on cookies and on the legal basis of the consent of the data subject expressed on the banner or on the specific page of our site (renewal of permissions is required after 13 months). Evaluations are conducted on aggregate data, and data are kept for a maximum of three years.

This data is used on the legal basis of:

- the legitimate interest of the owner and in order to obtain anonymous statistical information on the use of the website and to monitor its correct operation;

- consent of the data subject on the banner or the window frame available from the website; this is to obtain further statistical information, although not based on anonymous data, on the services offered by the Order and the Foundation.

Further details can be found in the Cookie policy.

Access to the personal area - login form (controller: Order)

The site allows registration to the restricted area in order to take advantage of certain services. Email and Order subscription ID number are required for registration for members of the Order and only email for others. The legal basis for processing is the provision of a service requested by the data subject.

The website tracks those who access the personal area. The legal basis for this processing is the legitimate interest of the website operator because tracking certain user actions can be useful in the event of security issues.

Access data will be kept until requested by the data subject. Log data will be retained for up to three years.

Newsletter subscription (controller: Order)

The data processed consists of the email address and other contact details, provided directly by the data subject on our website or by other means.

The legal basis for the processing is consent, which is requested during registration for those using our website and during the confirmation of registration. The data subject may always rescind their consent following the procedure indicated in each email.

The data will be kept until the data subject explicitly requests otherwise.

In order to carry out statistical analyses regarding our newsletters, data on certain actions is collected: opening of the newsletter, use of the proposed links, pages of the site visited. Assessments are carried out on aggregated data and the data is kept for a maximum of three years.

The newsletter service is managed by the Foundation.

Over-the-counter" assistance (data controller: Order)

 

The data is processed by the professionals (e.g. lawyer, tax consultant) who supply "helpdesk" advice to members at their request.

Personal data is used for booking appointments only. Other data which may be supplied during interaction with the helpdesk is not collected and stored.

 

This data is used on the legal basis of the implementation of contractual measures taken at the request of the data subject.

Data are kept until the end of the meeting.

CV management (data controller: to whom they are addressed, Order and Foundation)

 

Sending CVs by email or contact form to the addresses indicated on this website involves the subsequent acquisition of the sender's address, which is necessary in order to reply to questions or requests, as well as any other personal data entered.

This data is used on the legal basis of the implementation of pre-contractual measures taken at the request of the data subject.

Data are kept for three years after receipt of the CV and to allow for any further selection and contact activities. Data may be retained further for a total of 5 years as they are in backups.

Request management on the DIMMI platform (data controller: Order)

Sending data via the DIMMI platform (https://ordinearchitetti.mi.it/it/professione/dimmi) involves the subsequent acquisition of the sender's address, which is necessary in order to reply to questions or requests. This data is used on the legal basis of the execution of pre-contractual measures taken at the request of the data subject.

When using the DIMMI platform, it is possible to agree to receive questionnaires for the assessment of the service. The legal basis for this processing is consent.

Data recorded on the DIMMI service are processed on the HubSpot platform (see below).

Data are retained for three years after service delivery to allow quality control; data may be retained further for a total of 5 years as they are present in backups.

Job search and job offer platform and search-offer form (data controller: Order)

The Order, together with the Foundation, provides a platform for offering job ads at https://cerco-offro.ordinearchitetti.mi.it.

Those offering a position need not provide personal data but must register on the site (with email and, if registered with the Order, ID number); refusal to enter the requested data (personal or non-personal) will result in the inability to publish the job post. The data remain published for 30 days, unless otherwise requested by the data subject, and then deleted from our records after another 5 months.

The data entered on the platform are published and, therefore, accessible to all.

Data are processed on the legal basis of providing a service requested by data subjects.

The data will also be transferred to the Hubspot platform and used for aggregate statistics, for example by types of professionals sought and areas of specialisation offered. This processing is performed for the legitimate interest of the data controller to improve its services.

The email can be used to send service evaluation questionnaires. This processing is done with the consent of the data subject.

Data are kept until the expiration date or until requested by the data subject. Data may be retained further as they are in backups.

Delivery of training courses, evenings, itineraries and events (data controllers: Order, Foundation and others)

The data processed is listed below together with the purposes:

- for participants in courses, including webinars, evenings, itineraries, and events, the contact information provided by the subscriber for tracking attendance, sending organisational communications related to the event, requesting satisfaction information, and proposing similar events;

- for participants, registered with the Order, in fire prevention courses, sending an email every time a new course is added;

- for teachers and professionals, contact details and CVs, necessary for organising the activity and demonstrating its quality.

For the registration of participants, the sending of organisational communications, the request for information on satisfaction and the proposal of similar events, the controller is the Foundation. Registration takes place via the Foundation's own website.

Evenings, courses, itineraries and events are managed by the Foundation. Registration data is transferred to possible sponsors for the purpose of sending subsequent information (e.g. newsletters) only with prior consent or because they provide the web platforms necessary for participation in the event.

For registering participants, sending organisational communications, requesting information on satisfaction, and proposing similar events, the data controller is the Foundation. Registration is done through the Foundation's own website.

Evenings, courses, itineraries and events are managed by the Foundation. Registration data are transferred to sponsors, if any, for sending subsequent information (e.g., newsletters) only with prior consent or because they provide web platforms necessary for participating in the event.

The Foundation and the Order process the data:

- Foundation, as the data controller, to keep track of the activity, send organisational communications, request satisfaction information, propose similar events, and, where appropriate, evaluate their quality;

- Order, in the case of Order members, joint data controller with CNA, which keeps track of member activity and evaluates the quality of training.

The legal basis for the data processing is the fulfilment of a contract to which the data subject is a party, compliance with the regulations on accounting records, and the legitimate interest of the data controllers (with respect to quality control, satisfaction inquiries, and the proposal of similar events, as also provided for in Italian Legislative Decree No. 196 of 2003, article 130, subsection 4).

Data will be retained for 10 years after the conclusion of the course, evening, itinerary or event (also, in the case of payments, insofar as required by accounting records regulations); data may be retained for another year as they are in backups.

The Foundation may use the email addresses of participants in courses, evenings, itineraries and events to promote similar initiatives. In this case, the data will be kept until requested by the data subject (see below). The data subject may always refuse such communications.

Representatives of affiliated entities, partners and other entities (data controllers: Order and Foundation)

The Order and the Foundation get to know the contact data of the individuals representing the entities with which they have dealings. This is in order to facilitate relationships.

Processing will be carried out on the legal basis of legitimate interest.

The data may be retained for 10 years after the termination of the relationship, as it is supplemented to the data to be retained according to the terms imposed by current regulations.

Data collection on social networks (controllers: Order and Foundation)

 

The Order and the Foundation (each the data controller for the processing carried out on its channels) process data, as joint data controller together with the social network provider (which independently provides its own privacy notice), of visitors to the pages on the social networks (Facebook, Twitter, Instagram, LinkedIn and YouTube) with the tools made available by the social network provider itself (which also makes use of cookies and other logging tools): analysis of visits, interaction with users, forwarding of non-private messages and other activities contemplated by the social network. Processing takes place legally for the consent of the data subject given when registering with the social network, for responding to their requests, for the legitimate interest on the part of the data controller (logging their interactions with users, evaluation of corporate image, marketing). Data are stored by social networks, according to rules set by them.

Data will be deleted or processing will be stopped (or restricted) upon the explicit request of the data subject using the functions available on each social channel.

Participation in prizes (data controller: Foundation)

Participation in prizes requires that you provide your personal data (e.g., identification and contact information) to the Foundation. The Foundation will process this data for the following purposes:

- managing communications with participants;
- associating competition materials with participants;
- evaluating material, preparing rankings and awarding the prize;
- exhibiting the material specifying its author;
- retaining for historical archives;
- promoting the prize through the presentation of participants and winners;
- transferring contacts to offer job positions, only with prior consent.

Participants may be filmed at prize events or ceremonies by video-operators and photographers. Video and photographic products may be used by the Foundation for the sole purposes of promotion and communication of the prizes themselves and the winners.

Data are processed on the following legal bases:

- fulfilment of a service (participation in the contest) requested by the participant;
- legitimate interest of the data controller (quality control, displaying the material, promoting the prize);
- consent (transfer for job offers).

Some of the data (personal data), with participation in the prize, will be made public and kept indefinitely with the purpose of exposure and promotion of the prize.

Contact information will be kept with the material so that the author can be contacted if needed.

Data may be disclosed to sponsors or trade journals, that will act as independent data controllers and provide their own privacy notice and, where appropriate, request consents for further processing.

The following should be noted:

- the material may have been published and therefore it may not be possible to fulfil all the requests made by the data subject;
- modification or anonymisation of the material, once the prize has been awarded, may require onerous work for which requests from data subjects may be deemed "excessive" and therefore the Foundation may charge a reasonable fee or refuse to comply with the request.

Library (controller: Foundation)

To pick up and consult books at the Foundation's library, you must provide your personal data. The Foundation will process this data for:

- tracking online bookings;
- verifying the applicant's entitlement to the loan (as a registered member or as a Friend of the Foundation);
- checking the return of the loaned material, soliciting in case of delay, and imposing the penalties stipulated in the regulations;
- allowing the use of the networked station and imposing the penalties stipulated in the regulations;

Data are processed on the legal basis of fulfilling a service requested by the participant.

Data will be kept for as long as necessary for the loan.

Sending complaints to the Disciplinary Board (controller: Order)

As regards the member, the privacy notice is given in the one intended for members of the Order.

With regard to the complainant, the data processed are contact data and those specified in the complaint.

The legal basis for processing is the consent given by the complainant when submitting the form. Further processing takes place on the legal basis of fulfilling regulatory obligations (Italian Royal Decree 2537 of 1925, as amended) and on the basis of what is specified by the "Rules of Operation of the Disciplinary Board," which can be found on the Order's website.

Once the complaint has been sent, the complainant can no longer ask for deletion, restriction, or blocking of processing.

Failure to sign the consent to processing means that the Order and the Disciplinary Board cannot process the complaint, which will still be filed in the protocol.

The complainant, when sending the complaint, agrees in turn to process personal data in a way that ensures their protection.

The data will be kept for no longer than 10 years after the conclusion of the proceedings.

Analysis of services (controller: Order)

Through the Hubspot service, data collected on website browsing, membership of the Order, and event attendance are processed so as to obtain statistics about the services offered by the Order and the Foundation in order to improve them.

The data processed are not anonymous (they use IP addresses and registered users' personal details), but they are not used to profile data subjects or segment them or analyse their behaviour, but only to be able to obtain more precise data about the services offered (e.g., types of participants in certain events).

These data are used on the legal basis of the legitimate interest of the data controller and in order to obtain anonymous statistical information on the use of the services offered.

Disclosure to third parties and transfers to third countries

In order to carry out, on our behalf, some of the activities related to the processing of your personal data, the Order may disclose some of your data to outside companies, particularly IT service providers.

These companies have agreed by formal contract that they will process data only for the necessary purposes.

For statistical analysis activities, the Hubspot platform, headquartered in the U.S., is used.

Additional transfers abroad are detailed above for the single purposes.

Rights of the data subject

We would like to remind you that you have certain rights under the legislation. Specifically:

-obtain access, unless prevented by laws or regulations, to your personal data, their correction or deletion and the restriction or limiting of their processing;
- withdraw consent to processing, unless prevented by laws or regulations;
- send a complaint to the data controller, its Data Protection Officer (in the case of the Order) or the national Data protetion authority (in Italy it is the Garante per la protezione dei dati personali) by following the instructions on its website.

To exercise these rights, the reference channels indicated above should be used.

Version of 23 October 2023