Last updated on April 19, 2025. Effective date October 23, 2023.
 This Privacy Policy describes the policies of Parrocchia di Santa Marta Vergine – IT RegCode: 91002350139, Piazza della Chiesa snc, Magreglio 22030, Italia, email: info@santuariomadonnadelghisallo.it, the Gruppo Sportivo Madonna del Ghisallo, and Winston Partners Srl regarding the collection, use, and disclosure of users’ personal information when using our website (https://www.santuariomadonnadelghisallo.it) and related services (the “Service”). The Policy also illustrates how we collect, use, and share personal information and the choices available to the user regarding such data.

 Joint Controllers of Processing
 Parrocchia di Santa Marta Vergine – IT RegCode: 91002350139, Piazza della Chiesa snc, Magreglio 22030, Italia, email: info@santuariomadonnadelghisallo.it, the Gruppo Sportivo Madonna del Ghisallo, and Winston Partners Srl are joint controllers of the processing of personal data collected through the website.
 In relation to personal data collected through the “credenziale di passaggio” (passage credential), obtained via the MyMilestones application licensed by Winston Partners, and the Ex-voto and dedication service, the joint controllers of processing are Parrocchia di Santa Marta Vergine, the Gruppo Sportivo Madonna del Ghisallo, and Winston Partners Srl.

 Data Processor
 Winston Partners Srl is designated as the Data Processor for personal data collected through this website. We wish to inform you that Winston Partners Srl acts as both a Joint Controller and a Data Processor of your personal data. This means that in addition to defining how and why your data is processed, it is also responsible for its operational management in compliance with data protection laws. To ensure maximum protection of your rights, we have implemented specific internal procedures and controls to ensure that your data is processed securely and transparently.

 Acceptance of the Privacy Policy
 By accessing or using the Service, you consent to the collection, use, and disclosure of your information in accordance with this Privacy Policy. If you do not consent, please do not access or use the Service.

 Changes to the Privacy Policy
 This Privacy Policy may be amended at any time without prior notice. The revised Privacy Policy will be published on the Service and will become effective 30 days after publication. Continued access or use of the Service after this period will constitute acceptance of the revised Privacy Policy. Therefore, it is advisable to periodically review this page.

 Categories and use of Personal Data
 Depending on the operational processes for delivering Services/Products, all or some of the following categories of personal data may be processed:
 – identification and contact data such as: name, surname, place and date of birth, contact details provided by the User (for example: e-mail, phone number, residential/domicile address, billing address);
 – copy of identity document (identity card, passport, driving license and any other identification document considered valid according to current legislation);
 – iii. data relating to web traffic on the websites www.santuariomadonnadelghisallo.it, www.gsmadonnadelghisalo.it, connected portals and social networks.
 – bank data and identity document (credit card details or current account details) in case of purchase of goods or services;
 – v. images and videos with or without audio sent by the User in relation to services provided on the website www.santuariomadonnadelghisallo.it (for example, the Ex-voto and dedication collection service);
 – data present on social networks in case of contact through social channels (for example, nickname, profile picture, post images and videos, e-mail address). On this point, the data controllers specify that access through social channels and the use of the latter are subject to the terms and conditions and privacy and cookie policies of the social networks themselves;
 To use personal information for any other purpose, the user’s consent will be required and the information will be used only after receiving such consent and only for the purposes for which it was granted, unless otherwise required by law.
 The personal data of Users and Potential Users are processed with dedicated IT tools, suitable for guaranteeing their security, in terms of confidentiality, integrity and availability, thus avoiding, for example, unauthorized access, dissemination, unauthorized modifications thanks to the adoption of adequate technical, physical and organizational security measures. In the case of processing carried out for Aggregate Profiling Purposes, the personal data of Users may be processed through automated analysis processes. In any case, such processing will not produce any detrimental effect for Users and no service will be activated automatically and/or in the absence of specific, free and informed consent.

 For what purposes do we process personal data?
 a) For the provision of Services and Products, including the pre-contractual phase and the eventual direct or indirect identification of the User for the purpose of providing the Service or supplying the Product – also with reference to the delivery of Products purchased online by the User by logistics service providers, appointed as data processors pursuant to art. 28 GDPR, for whom User identification is required by delivering a copy of the User’s identity document -, invoicing of fees, sending and storing invoices/receipts. (“Service Provision Purposes”)
 Legal basis: execution of services requested by the user
 The processing of Users’ personal data is necessary to carry out the operations requested by the user for the provision of the requested Services and Products (for example, the “ex-voto and dedications” service, the issuance of the credenziale di passaggio to the Sanctuary, spontaneous donations, the purchase of gadgets, etc.).
 Retention times: Users’ personal data are stored for a period equal to the duration of the service, including any new requests from the user for 10 years following the termination, resolution, suspension or withdrawal of the same services.
 Nature of the provision: if the User does not provide the personal data necessary for the provision of the services (or provides them incorrectly or incompletely), the controllers will not proceed with any activity.
 b) For sending information and newsletters regarding cycling and activities related to the Sanctuary of Madonna del Ghisallo. (“Communication and Marketing Purposes”).
 Legal basis: see point a)
 Retention times: see point a)
 Nature of the provision: see point a)
 c) for providing the User with technical assistance and support. (“Assistance Purposes”)
 Legal basis: see point a)
 Retention times: see point a)
 Nature of the provision: see point a)
 d) for managing reports, complaints and disputes.
 Legal basis: see point a)
 Retention times: see point a)
 Nature of the provision: see point a)
 e) for purposes of aggregated analysis and creation of segmentation models (i.e. User Clusters), based on its legitimate interest and prior opposition, the controllers may process personal data collected and those acquired during the use of the services also in aggregated and anonymized form (“Purposes of Creation of Segmentation Models and Aggregated Analysis”)
 Legal basis: see point a)
 Retention times: Strictly necessary retention time for the purposes pursued and the type of goods and Services offered and in any case not exceeding 12 months
 Nature of the provision: see point a)
 f) to submit to Users and former Users, after obtaining consent for Marketing Purposes as per letter b) of this Policy, surveys on the quality of Services/Products – via e-mail in order to ascertain the interest/satisfaction of the Data Subject to improve the quality of Services/Products and User satisfaction (“User Experience Improvement Purposes”).
 Legal basis: see point a)
 Retention times: see point a)
 Nature of the provision: see point a)
 g) for data enrichment, subject to specific and optional consent, the controller may integrate personal data provided and acquired during the use of the services with information from third parties (e.g., social media). Such data may be processed for marketing and communication purposes after consent as per previous letter b) and for profiling purposes, after consent as per letter e) (“Enrichment Purposes”)
 Legal basis: see point a)
 Retention times: see point a)
 Nature of the provision: see point a)
 h) to identify and prevent fraudulent and illegal behavior or activities that could compromise the security of the Services and the Website (“SPAM or abuse and fraud”) for example, by enabling the CAPTCHA service (Google reCAPTCHA or similar) on certain pages of the Website that offer information and personal data entry functionalities (e.g., subscription forms and/or contact data entry). This purpose is based on the legitimate interest of safeguarding the interests of the data controllers and protecting the Users of the Website and services (“Prevention and Security Purposes”).
 Legal basis: see point a)
 Retention times: see point a)
 Nature of the provision: see point a)

 User Rights
 Depending on applicable law, you may have the right to access, rectify or erase your personal data or receive a copy of your personal data, restrict or object to the active processing of your data, ask to share (port) your personal information to another entity, withdraw the consent you provided for the processing of data, the right to lodge a complaint with a statutory authority and other rights that may be relevant under applicable laws. To exercise these rights, you can write to info@santuariomadonnadelghisallo.it. Your request will be answered in accordance with applicable law.
 If you do not authorize the collection or processing of the requested personal information or revoke consent to the processing of the same for the requested purposes, you may not be able to access or use the services for which your information was requested.

 Consent of Minors
 If the user is under 16, the form for the Sanctuary credential service must be signed by a parent exercising parental responsibility or by the guardian.

 Consent for Further Communications
 The user can express their consent to be recontacted with subsequent communications after reading the privacy policy and authorizing the processing of their personal data.
 The user also has the option to confirm or deny consent to the processing of their data, as described in this policy in the paragraph “For what purposes do we process personal data”.

 MyMilestones Updates and Services
 The user can express the desire to stay updated on updates and services offered through the MyMilestones platform, by the data controllers or by third parties, by providing their consent. Consents are optional and can be revoked at any time by following the link at the bottom of the emails the user will receive. To exercise their rights, the user can send a communication to the contacts indicated in the privacy policy.

 Cookies etc.
 To learn more about how we use these and your choices regarding these tracking technologies, please refer to our Cookie Policy.

 Security
 The security of personal information is important and reasonable security measures will be used to prevent the loss, misuse, or unauthorized alteration of information under our control. However, given the inherent risks, we cannot guarantee absolute security and, therefore, cannot ensure or warrant the security of information transmitted to us, and this is done at the user’s own risk.

 Third-Party Links and Use of Personal Information
 Our Service may contain links to other websites that are not operated by us. This Privacy Policy does not address the privacy policy and other practices of third parties, including any third parties that operate any website or service that may be accessible through a link on the Service. We strongly advise you to review the privacy policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

 Complaint/Data Protection Officer
 The Data Protection Officer appointed by the Data Controllers can be contacted at the e-mail address info@santuariomadonnadelghisallo.it.
 This Policy may be subject to modifications and integrations, also as a consequence of the applicability of the Privacy Regulation and any subsequent amendments and/or regulatory integrations. Users can view the constantly updated text of the Policy on the website.