Privacy Policy

The Data Controller is ANPAI – Associazione Nazionale Professionisti AI, Italian tax code 98032180154, Via Appennini 45, Milan, Italy. To make a privacy request or exercise data rights, use the Contact page or write to the postal address above.

Browsing data. The hosting service may process IP address, date and time, requested resource, user agent and technical information required to deliver and protect the website.

ANPAI News newsletter. Only an email address is requested. Before confirmation it is used solely to send the verification message and is not added to the subscriber list. After confirmation it is stored in encrypted form; a cryptographic fingerprint prevents duplicates without exposing the address in the repository.

Data provided by the user. Contact and AI Act assessment journeys may include name, organisation, professional role, email, telephone number, sector, project description and message content. The website prepares the message in the browser and transfers it to WhatsApp only after the user clicks; it does not keep its own copy of the form.

Editorial area. Drafts and images remain in the authorised user’s browser until published or deleted. Login creates a technical session cookie. Published content is stored in the editorial repository.

Cookies and local storage. These are detailed in the Cookie Policy.

Data is processed to deliver and protect the website, based on the legitimate interest in security and correct operation; send ANPAI News only after consent and address confirmation; respond to requests and take requested pre-contractual steps; manage membership, association activities and legal duties; and publish authorised content. Providing form data is voluntary. Newsletter consent may be withdrawn at any time through the link in every email, without affecting earlier processing.

ANPAI does not sell personal data. Where necessary, data may be processed by authorised people and by the technical providers used: Vercel Inc. for hosting, distribution and security; Aruba S.p.A. for confirmation and newsletter email delivery; WhatsApp Ireland Limited when the user chooses to continue to WhatsApp; and GitHub Inc. for the editorial repository and the private encrypted subscriber register. Data may also be disclosed to advisers or authorities where required by law or necessary to protect rights.

Some providers operate through international infrastructure. Depending on the service and applicable relationship, transfers are handled through adequacy decisions, Standard Contractual Clauses or another safeguard under Articles 45–49 GDPR. Further information is available from Vercel, GitHub and WhatsApp.

Technical data is retained according to the hosting-service configuration and only as long as required for security, diagnostics and legal defence. A newsletter address remains active until consent is withdrawn; after unsubscribe, the encrypted record is kept for no longer than 24 months to document the request and prevent unwanted sends, then deleted. Requests received through WhatsApp are kept for the time needed to handle them and, if no further relationship or legal duty applies, for no longer than 24 months after the last interaction. Membership, association, contractual and accounting data is retained for applicable statutory periods and the protection of rights. Browser-storage periods are listed in the Cookie Policy.

Where Articles 15–22 GDPR apply, data subjects may request access, rectification, erasure, restriction, portability or object to processing, and may withdraw consent without affecting earlier processing. They may also lodge a complaint with the Italian Data Protection Authority. ANPAI may request information needed to verify the requester’s identity.

ANPAI applies technical and organisational measures proportionate to risk, including HTTPS connections, restricted editorial access, HttpOnly and SameSite authentication cookies, login-attempt limits and validation of published content. No system removes every risk; incidents are assessed and managed under applicable law.

The website is not specifically directed at children and its forms are not designed to collect their data intentionally. Dedicated initiatives will provide information and safeguards appropriate to their context.

This notice is updated when processing activities, providers or legal requirements change. Material changes will be brought to users’ attention in an appropriate way.