Data Controller

• Controller: Associazione culturale non riconosciuta Komorebi – ETS (Unincorporated Cultural Association – Third Sector Entity)
• Address: via Gallarate, 113 – 20151 Milan, Italy
• Email: associazione.komorebi@gmail.com
• Tax Code (Codice Fiscale): 97928540158

Types of Data Collected

The personal data collected by this website, either independently or through third parties, includes: cookies, usage data, name, email address, tracking data via pixels (to confirm user actions), date of birth, and other information, including special categories of data (e.g., health-related data) submitted via external forms. The collection of health data is exclusively aimed at ensuring correct logistical organisation and accessibility during rehearsals and the concert.

Donation and Supporter Data: When you make a contribution via our payment platforms, we collect the amount donated, the date of the transaction, and the donor’s identification details (full name and email address) as provided through the payment service.

We do not use automated decision-making processes (algorithms) to select candidates; every application is manually evaluated by the project managers.

Purposes of Processing

The data collected through our website and application forms are processed exclusively for:

1. Contacting the User: Data sent via the contact form is used solely to respond to your requests. We collect data visible in the contact forms, the visitor’s IP address, and browser information also to support spam detection.
2. Artistic Selection: Evaluation of applications from musicians (with and without disabilities) for the formation of the orchestra.
3. Volunteer Management: Evaluation of applications and coordination of support profiles (tailors, reception, logistics, etc.).
4. Hospitality Organisation: Evaluation of applications and management of host family availability for musicians and other non-resident support figures.
5. Organisational Communications: Sending information regarding rehearsals, logistics, and concert details.
6. Google Forms: This website uses Google Forms for collecting specific data, including health-related data. This data is managed on Google’s servers and processed by Google according to its own privacy policy.
7. Displaying external fonts: This website uses fonts provided by Google to improve aesthetics: this service may collect the visitor’s IP address. For more information on data processing by the provider, please consult the Google Privacy Policy.
8. Displaying content from external sites: Pages on this website may contain links to external sites and content (e.g., videos, images, articles, etc.) from other sites. Such content is treated exactly as if the visitor were visiting the external site. These external sites may collect information about the visitor, use cookies, include third-party tracking systems, and monitor the visitor’s interaction with the displayed content, including tracking interaction if the visitor has an account and is logged into that website.
9. Documentation and Promotion: Project activities (preparations, rehearsals, and the concert) will be subject to audio-video filming and photography by the media and the organisation. Such materials will be used for communication, dissemination, and promotional purposes on institutional channels and in news publications.
10. Verification of Consent (Double Opt-in): We use a tracking pixel in confirmation emails to verify that the entered email address is valid and that the user has effectively confirmed their intention to participate/register. This ensures the security of the process and prevents unauthorised registrations. Where automated registration systems (Double Opt-in) prove technically incompatible with the data subject’s email domain, consent may be collected and documented via direct email exchange between the parties. Such communications shall be archived for the period strictly necessary to demonstrate the validity of the consent provided.
11. Management of Donations and Supporter Relations: Data collected through donation platforms is processed to fulfil fiscal and legal obligations, for the reporting of fundraising activities, and to send letters of thanks or invitations to institutional events related to the project (e.g., the after-party).

Legal Basis and Special Categories of Data

Processing is based on the necessity to take steps at the request of the data subject prior to entering into a contract (your application). Regarding health-related data (necessary for the inclusion of musicians with disabilities), processing takes place exclusively with your explicit consent pursuant to Art. 9 of the GDPR, provided through the voluntary completion of the form.

The processing of data related to donations is based on the fulfilment of legal and tax obligations (as per Third Sector regulations) and the legitimate interest of the Association in maintaining and nurturing relationships with its supporters.

Third-Party Services and Tools

The website uses third-party services that may involve the transfer of data outside the EU:

• Google Forms (Google Ireland Limited): We use this service for contact forms and application collection. Entered data is stored on Google’s servers. Data transfers to Google occur in compliance with the EU-USA Data Privacy Framework and the Standard Contractual Clauses approved by the European Commission. You can consult Google’s Privacy Policy.
• Google Fonts: To ensure consistent font display, the site may call fonts from Google’s servers. This may involve tracking your IP address. Data transfers to Google occur in compliance with the EU-USA Data Privacy Framework and the Standard Contractual Clauses approved by the European Commission. For more information, consult the Google Privacy Policy.
• Anti-Spam Protection and Verification Systems (Google reCAPTCHA, Antispam Bee, and similar): To protect the website and application forms from abuse, cyber-attacks, and automated submissions (spam), we use security and verification tools:
  • Google reCAPTCHA: This service is used to distinguish between human users and automated software, both within Google Forms and, potentially, via direct integration on the pages of this site. The service collects personal data (such as IP address, browser information, mouse movements, and Google cookies) for security purposes. Data is transmitted to Google’s servers and processed in compliance with the EU-USA Data Privacy Framework and the Standard Contractual Clauses. More information is available in the Google Privacy Policy.
  • Antispam Bee: The site may use this plugin for the analysis of messages and comments. The tool is configured for local data processing on our server; however, to ensure advanced protection, it can be set to compare technical metadata (such as IP address) with external public spam databases. In any case, processing takes place exclusively for security purposes and without user profiling.
  • Similar Verification Services: The Controller reserves the right to use other automated verification services (such as, for example, Cloudflare Turnstile or Friendly Captcha) that operate with similar purposes of site protection, always ensuring respect for the principles of data minimisation and security.
  • Legal Basis: Processing is based on the legitimate interest of the Controller (Art. 6, paragraph 1(f) of the GDPR) to ensure the security of its IT infrastructure, the integrity of the data collected via forms, and the prevention of fraudulent activities.
• Embedded Content (YouTube, Vimeo, etc.): The site may incorporate videos or maps. This content interacts with the user as if they were on the original site, which may collect data via cookies or its own tracking systems.
• Verification Tools (Pixel Tracking): The site uses a technical tracking pixel to manage the double opt-in process. This tool records the user’s privacy confirmation for the purpose of proving consent (GDPR Compliance).
• Nexi / XPay (Nexi Payments SpA): This website uses the ‘Dona Italia’ service by Nexi to receive charitable donations. Payment data is processed on Nexi’s secure servers in compliance with PCI-DSS security standards. The Association receives donor identification details from Nexi for administrative purposes and to express our gratitude. You can consult the Nexi Privacy Policy here.

Data Retention

• Data of candidates who are not selected will be deleted within 90 days of the end of the selection process. Data of project participants will be retained for the duration of the event and for as long as strictly necessary to comply with legal obligations or for historical archiving purposes.
• Multimedia materials (photos/videos) collected for promotional purposes will be stored in the Association’s historical archives to document the activities carried out, unless a request for removal is made by the data subject.
• Technical logs relating to the confirmation of consent (collected via pixel tracking during the double opt-in procedure) will be retained for the same duration as the data provided through the relevant reference form (e.g., 90 days for non-selected candidates). This retention is aimed exclusively at proving the validity of the consent provided, in accordance with the accountability obligations set out under the GDPR.
• Data concerning donations and related accounting documents will be retained for the period required by tax and civil law (typically 10 years), notwithstanding the 90-day deletion policy for non-selected candidates.

User Rights (GDPR)

You have the right to access your data, request its rectification, erasure, or the restriction of its processing. To exercise these rights, please write to: associazione.komorebi@gmail.com.

Additional Information for Users in the United Kingdom

In accordance with the UK Data Protection Act 2018 and the UK GDPR, users in the UK have the same rights as EU residents regarding access, rectification, and deletion of their personal data.

• Data Controller: Associazione culturale non riconosciuta Komorebi – ETS
• Right to Complain: If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.

Additional Information for Users in Japan

In compliance with the Act on the Protection of Personal Information (APPI), we inform our Japanese users that:

• Purpose of Use: Personal data collected via Google Forms is used solely for managing inquiries and deliver services related to the scope of the project described in this website, including, but not limited to, contacting the user, artistic selection, volunteers management, hospitality organisation, etc.
• Cross-border Transfer: By using our forms, you acknowledge that your data may be transferred to servers located in the United States or the European Union. These countries provide a level of data protection equivalent to the APPI.
• Inquiries: To exercise your rights of disclosure or correction, please contact us at: associazione.komorebi@gmail.com.