Information pursuant to Articles 13 and 14 of EU Regulation 679/2016

This page constitutes the "Privacy Policy" of this website and is intended to provide information on how personal data of users interacting with this website are processed, how users benefit from its services, as well as to provide the disclosure required by Articles 13 and 14 of EU Regulation 2016/679.
This privacy policy applies solely to this website and not to other websites that may be accessed by the user via links present on the pages of this site.

Regulation (EU) 2016/679 on the protection of personal data (hereinafter the “Regulation”) establishes rules regarding the protection of natural persons with respect to the processing of personal data, as well as rules on the free movement of such data and safeguards the rights and fundamental freedoms of individuals, with particular regard to the right to the protection of personal data.

Article 4, paragraph 1 of the Regulation specifies that “Personal Data” means any information relating to an identified or identifiable natural person (hereinafter, the “Data Subject”).

“Processing” means any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Art. 4, paragraph 2 of the Regulation).

Pursuant to Articles 12 and following of the Regulation, it is also established that the Data Subject must be informed about the relevant information concerning Processing activities carried out by the Data Controller and about the rights of Data Subjects.

Data Controller

The data controller is the Fondazione Cammino Minerario di Santa Barbara, headquartered in Iglesias (SU), Piazza Municipio n. 1, and can be contacted at the following addresses: tel. 0781.24132, email amministrazione@cmsb.it, PEC camminodisantabarbara@pec.it.

Personal Data Protection Officer

The Data Protection Officer (DPO) is Giovanni Ledda, Esq., with an office in Cagliari, Piazza Repubblica no. 10, who can be contacted at the following details: tel. 070.303361, mobile 339.83589721, email avvocatoledda@studiolegalegiovanniledda.it, certified email giovanni.ledda@legalmail.it.

Purposes and Legal Bases for Data Processing

The user's personal data will be processed for the following purposes and on the following legal bases:

1. to conclude and properly execute the contract to which the data subject is a party or to carry out pre-contractual measures at the request of the data subject, including information and/or the requested services/products, such as subscribing to informational newsletters; the legal basis for these data processing activities is set out in Art. 6(1)(b) of EU Regulation 2016/679;

2. to respond to requests sent by the user via email and/or the form provided on the site; the legal basis for these processing activities is set out in Art. 6(1)(b) of EU Regulation 2016/679;

3. to periodically send, via remote communication technologies (email, telephone, SMS, WhatsApp), commercial communications about the services, products, and activities offered by the controller; the legal basis is consent as provided by Art. 6(1)(a) of EU Regulation 2016/679;

4. to carry out retargeting activities and/or use email to target social media profiles (Facebook, Instagram) for customised marketing campaigns; the legal basis is consent as provided by Art. 6(1)(a) of EU Regulation 2016/679;

5. to send emails with commercial and promotional information related to the sale of our products/services, of a similar nature to previous purchases made by the data subject, unless the data subject objects to such processing, which can be done at any time; the legal basis for this processing is the legitimate interest of the Controller as provided by Art. 6(1)(f);

6. to ensure that marketing communications regarding the products and services offered by the controller, as well as those of their business partners and sponsors, including online advertising, are relevant to the data subject's interests; to this end, your personal data may be used to better understand your interests and preferences in order to anticipate which other products, services, and information you may be most interested in, thus allowing us to personalise the controller's communications to make them more relevant and engaging; the legal basis is consent as provided by Art. 6(1)(a) of EU Regulation 2016/679;

7. to carry out market research to develop and improve our range of products, services, and activities offered by the controller and partners; the legal basis is consent as provided by Art. 6(1)(a) of EU Regulation 2016/679;

8. to enable and ensure the functionality of site browsing, and to guarantee an adequate level of security, integrity, and availability; the legal basis for this type of processing is the legitimate interest of the Controller as provided by Art. 6(1)(f);

9. to analyse statistical data on aggregated or anonymous data, with the aim of monitoring the website’s proper functioning, usability, and user interest; the legal basis for this type of processing is the legitimate interest of the Controller as provided by Art. 6(1)(f);

10. to establish, exercise, or defend a legal right in court; the legal basis for this processing is the legitimate interest of the Controller as provided by Art. 6(1)(f);

11. to fulfil obligations set forth by law, regulation, EU legislation, or by order of an Authority; the legal basis for this type of processing is as set out in Art. 6(1)(c);

Types of Data

The following data necessary for the purposes listed above will be collected and processed:

• identification data

• contact data

• data relating to the contractual relationship

• data concerning the data subject’s preferences and interests

Browsing Data

The IT systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.

This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.

This category of data includes IP addresses or domain names of the computers used by users connecting to the site, URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numeric code indicating the status of the response from the server (success, error, etc.), and other parameters relating to the user’s operating system and IT environment.

This data is used solely to obtain anonymous statistical information on the use of the site and to check its correct functioning, and is deleted immediately after processing.

Data may be used to establish responsibility in case of hypothetical cybercrimes against the site.

Refusal to Provide Data

Except as specified for browsing data, users/visitors are free to provide their personal data. Provision of the data is, in some cases, necessary, since refusal to provide them may result in the inability to conclude or properly fulfil the contract to which the Data Subject is a party and/or the failure to comply with legal obligations to which the Controller is subject.

Providing data for processing activities that require consent is optional, and failure to provide it will not affect your ability to access the products/services offered by the Controller. Even if consent is given, the data subject will still have the right to subsequently object, in whole or in part, to the processing of their personal data for the purposes outlined above by making a simple request to the Controller at the contact details above.

Source of Data

Data will be provided by the data subject or collected from third parties.

Processing Methods

In accordance with Article 5 of the Regulation, Personal Data subject to Processing will be:

1. processed lawfully, fairly, and in a transparent manner in relation to the data subject;

2. collected and recorded for specified, explicit and legitimate purposes, and subsequently processed in a way compatible with those purposes;

3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

4. accurate and, where necessary, kept up to date;

5. processed in a manner that ensures appropriate security;

6. kept in a form that permits identification of data subjects for no longer than is necessary to achieve the purposes for which they were processed.

Processing will be carried out using both manual and/or electronic and telematic tools, with organisational and processing logic strictly related to the purposes themselves and, however, in such a way as to ensure the security, integrity, and confidentiality of the data in compliance with the organisational, physical, and logical measures provided for by current regulations.

Disclosure of Data

Personal data may be communicated to authorised persons, as well as to external data processors appointed by the controller (the full list of external processors is available from the Controller), responsible for managing the purposes outlined above. With your prior consent, the data may also be disclosed to third-party companies, sponsors and/or business partners of the controller, who may use them for the purposes in point 3) of the above “Purpose of Processing” section. In pursuit of the purposes mentioned above, data may also be disclosed to other parties acting as independent controllers.

Data Dissemination

Personal data will not be subject to dissemination.

Transfer of Data Abroad

For the above purposes, Personal Data will be processed within the European Economic Area (EEA). Should it be transferred to third countries, in the absence of an adequacy decision by the European Commission, the applicable legal provisions concerning the transfer of Personal Data to third countries will be complied with, such as the Standard Contractual Clauses adopted by the European Commission.

Data Retention

In general, Personal Data will be stored for the period strictly necessary to achieve the purposes for which it was collected and subjected to Processing, including the retention period required by applicable law and, in any case, for a maximum of 10 years from the end of the relationship with the Controller and for a maximum of 2 years for the purposes where your consent is required, unless the Controller needs to defend their rights in court.

Data Subject Rights

Pursuant to EU Regulation 2016/679 Articles 15 and subsequent, and under applicable national law, the Data Subject may, according to the modalities and within the limits provided by current regulations, exercise the following rights:

• Art. 15 Right of Access

  Description
  The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them is being processed and, where that is the case, access to the personal data and the following information:

  • the purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipient to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations;
  • where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • where the data are not collected from the data subject, any available information as to their source;
  • the existence of automated decision-making, including profiling referred to in Article 22 paragraphs 1 and 4, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

  Where personal data is transferred to a third country or to an international organisation, the data subject has the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, unless otherwise requested, the information shall be provided in a commonly used electronic form.

  Conditions
  The right to obtain a copy of your personal data must not adversely affect the rights or freedoms of others.

  How to exercise
  The data subject may exercise this right by sending a request to the email address . In order to provide a positive response to the request, it is necessary to provide the required information to identify the data subject. Before responding, the controller may need to identify the data subject, as the right can only be exercised by the data subject or their authorised representative.

• Art. 16 Right to Rectification

  Description
  The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by providing a supplementary statement.

  Conditions
  Processing of inaccurate and/or incomplete data

  How to exercise
  The data subject may exercise this right by sending a request to the email address

  In order to provide a positive response to the request, it is necessary to provide the required information to identify the data subject.

  Before responding, the controller may need to identify the data subject, as the right can only be exercised by the data subject or their authorised representative.

• Art. 17 Right to Erasure ("Right to be Forgotten")

  Description
  The data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay and the controller has the obligation to erase such personal data without undue delay.

  If the controller has made personal data public and is obliged, pursuant to the previous paragraph, to erase them, taking account of available technology and the cost of implementation, the controller shall take reasonable steps, including technical measures, to inform controllers that are processing the personal data of the data subject’s request for erasure of any links to, or copy or replication of, those personal data.

  Conditions
  The right may be exercised if one of the following grounds applies:

  • the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
  • the data subject withdraws consent on which the processing is based according to Article 6(1)(a) or Article 9(2)(a), where there is no other legal ground for the processing;
  • the data subject objects to processing pursuant to Article 21(1), and there are no overriding legitimate grounds for the processing, or the data subject objects to processing pursuant to Article 21(2);
  • personal data has been unlawfully processed;
  • personal data must be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject;
  • the personal data has been collected in relation to the offer of information society services referred to in Article 8(1) (Where Article 6(1)(a) applies regarding the direct offer of information society services to children, the processing of a child's personal data is lawful where the child is at least 16 years old. Where the child is younger than 16, such processing is lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility; Member States may provide by law for a lower age for such purposes provided it is not below 13 years.).

  The right to erasure does not apply to the extent that processing is necessary:

  • for exercising the right of freedom of expression and information;
  • for compliance with a legal obligation that requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i), and Article 9(3);
  • for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing;
  • for the establishment, exercise or defence of legal claims.

  How to exercise
  The data subject may exercise this right by sending a request to the email address

  In order to provide a positive response to the request, it is necessary to provide the required information to identify the data subject.

  Before responding, the controller may need to identify the data subject, as the right can only be exercised by the data subject or their authorised representative.

• Art. 18 Right to Restriction of Processing

  Description
  The data subject has the right to obtain from the controller restriction of processing.

  Where processing has been restricted under the preceding paragraph, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

  A data subject who has obtained restriction of processing under the initial paragraph shall be informed by the controller before the restriction is lifted.

  Conditions
  The right may be exercised if one of the following applies:

  • the data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data;
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead;
  • the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
  • the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

  How to exercise
  The data subject may exercise this right by sending a request to the email address

  In order to provide a positive response to the request, it is necessary to provide the required information to identify the data subject.

  Before responding, the controller may need to identify the data subject, as the right can only be exercised by the data subject or their authorised representative.

• Art. 19 Notification Obligation regarding Rectification or Erasure of Personal Data or Restriction of Processing

  Description
  The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1), and Article 18 to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject so requests.

  How to exercise
  The data subject may exercise this right by sending a request to the email address

  In order to provide a positive response to the request, it is necessary to provide the required information to identify the data subject.

  Before responding, the controller may need to identify the data subject, as the right can only be exercised by the data subject or their authorised representative.

• Art. 20 Right to Data Portability

  Description
  The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data has been provided.

  When exercising this right to data portability as described above, the data subject also has the right to have their personal data transmitted directly from one controller to another, where technically feasible.

  The exercise of this right shall not adversely affect Article 17 - Right to Erasure ("right to be forgotten").

  Conditions

  The right may be exercised if one of the following applies:

  • the processing is based on consent in accordance with Article 6(1)(a) or Article 9(2)(a), or on a contract in accordance with Article 6(1)(b);
  • the processing is carried out by automated means

  This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

  The exercise of the right must not adversely affect the rights and freedoms of others.

  How to exercise
  The data subject may exercise this right by sending a request to the email address

  In order to provide a positive response to the request, it is necessary to provide the required information to identify the data subject.

  Before responding, the controller may need to identify the data subject, as the right can only be exercised by the data subject or their authorised representative.

• Art. 21 Right to Object

  Description
  The data subject has the right to object at any time.

  The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

  Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing.

  If the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

  Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to their particular situation, shall have the right to object to processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

  Conditions

  The right may be exercised if one of the following applies:

  • reasons related to the data subject’s particular situation
  • to the processing of personal data concerning them under Article 6(1)(e) (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller) or (f) (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child), including profiling based on those provisions

  How to exercise
  The data subject may exercise this right by sending a request to the email address

  In order to provide a positive response to the request, it is necessary to provide the required information to identify the data subject.

  In the context of using information society services and without prejudice to Directive 2002/58/EC, the data subject may exercise their right to object by automated means using technical specifications.

  Before responding, the controller may need to identify the data subject, as the right can only be exercised by the data subject or their authorised representative.

In general, to exercise their rights, the data subject may contact the Controller at the addresses provided above.
Before providing a response, the controller may need to identify the data subject, by requesting a copy of their identity document.
A written response will be provided without undue delay and, in any event, no later than one month from the receipt of the request.

Version 4.1

Last update: October 15, 2026