Privacy Policy

1. Data Controller

The data controller is A.N.P.I.G. OdV — Associazione Nazionale Pazienti per il Glaucoma e le malattie croniche dell'occhio (Italian National Association of Patients with Glaucoma and Chronic Eye Diseases), with registered office at Via Roma 45, 34074 Monfalcone (GO), Italy.

Tax code: 90033840316
RUNTS no. 30990

Email: anpiglaucoma@gmail.com
Certified email (PEC): anpig@pec.csvfvg.it

2. Data Collected

This website is informational and does not collect personal data through registration forms, online contact forms or newsletters. The technical data collected automatically while browsing include:

• IP address (in anonymised form)
• Browser type and operating system
• Pages visited and length of the visit
• With your consent, clicks on phone numbers, email addresses and links to other sites: only the type of contact and the page it starts from, never the number or the address
• Date, time and time zone of the visit
• Referring site (referrer)

Eye tests. The answers and results of the eye tests stay on your device and are never transmitted: neither to us nor to third parties. With your consent to statistics we only record the use of the test (started, stage reached, completed or abandoned), never what you answered, the result or how long you spend on the test. The screen calibration is saved in your browser so that you do not have to repeat it; to suggest the next test, the browser remembers which tests you have already taken until you close the tab, never how they went.

3. Legal Basis for Processing

• Technical browsing data (server logs) are processed on the basis of the Controller's legitimate interest (Art. 6(1)(f) GDPR) in ensuring the security and operation of the site.
• Usage statistics via PostHog are processed only on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

4. Purposes of Processing

The data are used exclusively to:

• Ensure the proper operation of the site
• Produce aggregate statistics on the use of the site, to improve its content and accessibility
• Ensure IT security and prevent abuse

We do not carry out profiling, advertising or otherwise, and we do not link the pages you visit to your identity.

5. Cookies and Browser Storage

This site uses technical cookies needed for browsing to work properly and, with your prior consent, third-party analytics cookies to measure the use of the site in aggregate form. No advertising profiling cookies are used, and no marketing activity is carried out.

In accordance with the law, strictly necessary technical cookies do not require the user's consent (Art. 122 of Legislative Decree 196/2003 and the Italian Data Protection Authority's cookie guidelines of 10 June 2021). Analytics cookies, on the other hand, require your prior consent: until you give it through the banner, the analytics code is not even downloaded by your browser. You can decline without any consequence for your browsing.

How many people accept or decline. When the banner appears and when you make your choice, the browser requests an empty address from our server (/c/banner, /c/accettato or /c/rifiutato). The request uses no cookies, saves nothing on your device and contains no identifiers: it ends up in the server logs like any page visited, and we only count it in aggregate form. It happens even if you decline, because it is the only way to know how many people do; it does not go through PostHog or any other third party.

How to withdraw consent. At the bottom of every page you will find the Cookie preferences command: it reopens the banner, and if you choose «Decline» the measurement stops immediately and the PostHog identifier is deleted from your browser.

6. Third-Party Services

PostHog (PostHog Inc.) provides aggregate usage statistics, with the data hosted on servers in the European Union (Frankfurt). The service is activated only after your consent: if you do not consent, its code is not downloaded and no data reaches it. The IP address is anonymised; session recording and automatic click collection are disabled.

Donations with PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.) take place on PayPal's website: the «Donate with PayPal» button opens its page, and our site neither receives nor sees any payment data. For those data PayPal acts as an independent controller, under its own privacy policy. When a donation is made, the association receives from PayPal the donor's name, email and amount, which it uses for its accounts and to issue the receipt.

The site embeds video content via YouTube (Google Ireland Limited). The videos are embedded in "privacy-enhanced" mode and the player is loaded only when you press play. However, the video preview images are loaded from YouTube's servers (img.youtube.com) as soon as the page is displayed: this means your IP address is transmitted to Google, without cookies. When you play a video, YouTube may collect data under its own privacy policy.

The map of eye centres (the CentresIT page) uses map tiles from OpenStreetMap (OpenStreetMap Foundation, United Kingdom): to show them, your browser requests them from their servers, which receive your IP address. OpenStreetMap does not set cookies; see its privacy policy.

The fonts are hosted directly on our servers: displaying them does not involve any connection to external services.

7. Sharing and Transfer of Data

The data are not sold, transferred or disclosed to third parties, except:

• The hosting provider needed to deliver the web service (processor under Art. 28 GDPR)
• PostHog Inc., for usage statistics, only with your consent (processor under Art. 28 GDPR)
• The competent authorities, where required by law

PostHog Inc. is based in the United States: although the data are hosted in the European Union, any access on its part is governed by the European Commission's Standard Contractual Clauses. Google (YouTube) may transfer data to the United States on the basis of the EU-US Data Privacy Framework. The United Kingdom (OpenStreetMap) benefits from an adequacy decision of the European Commission.

8. Retention Period

• Technical browsing data (server logs) are kept for a maximum of 90 days from collection, after which they are automatically deleted.
• Usage statistics collected through PostHog are kept for a maximum of 12 months.
• The data saved in your browser remain for the duration shown in the table in section 5, and you can delete them at any time.

9. Your Rights

Under Articles 15-22 GDPR, you have the right to:

• Access — obtain confirmation of whether or not personal data concerning you are being processed
• Rectification — request the correction of inaccurate data
• Erasure — request the deletion of your data ("right to be forgotten")
• Restriction — request the restriction of processing
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Complaint — lodge a complaint with the Garante per la Protezione dei Dati Personali (the Italian Data Protection Authority)

To exercise your rights, contact the Data Controller by email at anpiglaucoma@gmail.com.

10. Data Security

The Controller adopts appropriate technical and organisational measures to protect personal data against unauthorised access, loss or destruction, including: encrypted communications via the HTTPS/TLS protocol, firewalls, and access to systems limited to authorised personnel.

11. Changes to this Policy

This policy may be updated from time to time to reflect changes in the law or in the services offered. The date of the last update is shown at the top. We recommend checking this page regularly for any changes.