Privacy Policy

Processing of personal data pursuant to EU Regulation 2016/679 (GDPR) and to D.Lgs. 196/2003 as amended by D.Lgs. 101/2018.

Last updated: 8 October 2026 · Version 1.2

1. Data controller

The controller of the personal data collected through this site is Quelli della Via APS — Associazione di Promozione Sociale, hereinafter also "the Association".

For any formal communication (exercise of rights, complaints, requests for rectification or erasure) the use of PEC is recommended, as it provides certified evidence of the date and time of receipt.

2. Types of data collected

The site collects the following categories of personal data:

• Pilgrim registration data — name, email address, password (stored in encrypted form) provided voluntarily in the Pilgrim Area registration form.
• Newsletter data — email address provided through the subscription form in the site footer.
• Contact data of published accommodations — names, telephone contacts and addresses of the facilities (parishes, convents, monasteries, hostels, hospitales, inns) shown in the popups of the interactive map. Such contacts are published solely on the basis of written consent collected by the Association from each facility, or because they fall within data already publicly available on their official channels.
• Membership data — in addition to the profile data (name, surname, contact details, address), the Italian tax code or an equivalent identity document for foreign members, date and place of birth, membership type and payments; for applications made online we keep the date and time, IP address and version of the statute and of this policy that were accepted.
• Volunteers' register data — for members who volunteer on a regular basis: the same personal data as in the members' register, the activity carried out and the start and end dates, recorded in the register required by law and communicated to the insurance company.
• Purchase data — name, address, email and shipping details collected to fulfil orders from "The Pilgrim's Store", processed through the electronic payment provider.
• Browsing data — web server logs (IP address, date and time of the request, page visited, browser user-agent), collected for security and diagnostic purposes.

3. Purposes and legal basis

Registration and management of the pilgrim profile

Legal basis: performance of a contract to which the data subject is party (art. 6.1.b GDPR). The data is used to enable access to the digital credential, the tracking of completed stages and the collection of stamps.

Membership and management of the members' register

Legal basis: performance of the membership relationship to which the data subject is party (art. 6.1.b GDPR) and compliance with legal obligations connected with keeping the members' register of Third Sector entities (art. 6.1.c GDPR). For membership we collect, in addition to the profile data, the Italian tax code (or, for foreign members, the passport number or tax code of their own country and their nationality) and the date and place of birth. The date of birth is also used to check the age requirement for the reduced fee, reserved for members under 30. The membership fee is paid by bank transfer or through the electronic payment provider indicated in section 5. For applications submitted online we keep, as proof of acceptance of the statute and of this policy, the date and time, the IP address and the version of the texts accepted. Application data is sent by email to the members of the governing body and of the secretariat authorised to process it, who decide on admission and keep the members' register.

Membership card and authenticity check

Legal basis: performance of the membership relationship (art. 6.1.b GDPR). Each member receives a digital and a physical card bearing name, surname, membership number and a QR code. Whoever scans the QR code opens a page of this site confirming that the card is genuine and showing name and surname, number, role in the association and fee status (valid or expired): members should bear this in mind when showing their card. The physical card is printed by a print shop acting as data processor (section 5).

Volunteers' register and insurance

Legal basis: compliance with legal obligations (art. 6.1.c GDPR). Members who volunteer on a regular basis are entered in the volunteers' register required by art. 17 of the Italian Third Sector Code and by the Ministerial Decree of 6 October 2021, and are insured against accidents and illness connected with the activity and for civil liability towards third parties (art. 18). For this purpose the personal data in the register is communicated to the insurance company, which processes it as an independent controller to manage the policy and any claims.

Members' WhatsApp group

Legal basis: the data subject's voluntary participation (art. 6.1.a GDPR). Members whose fee is up to date receive an invitation link to the association's WhatsApp group, where dates of outings and news are shared. Joining is optional and happens only on the member's own initiative; those who join make their telephone number and profile name visible to the other members and may leave at any time. The service is provided by WhatsApp Ireland Ltd (Meta group), an independent data controller under its own privacy policy.

Newsletter subscription

Legal basis: the data subject's explicit consent (art. 6.1.a GDPR). Subscription is optional and may be revoked at any time through the unsubscribe link at the foot of each communication.

Publication of accommodation contacts

Legal basis: explicit consent collected in written form from each facility (art. 6.1.a GDPR). The facilities concerned may at any time request the rectification or removal of their contacts by writing to the PEC indicated above. The Association keeps the documentation of the consents collected and reserves the right to suspend the publication of contacts for which consent is not documented.

Fulfilment of orders from The Pilgrim's Store

Legal basis: performance of a contract (art. 6.1.b GDPR) and compliance with tax and accounting obligations (art. 6.1.c GDPR).

Security and diagnostics

Legal basis: the controller's legitimate interest in the security of its IT systems and in the prevention of abuse (art. 6.1.f GDPR).

4. Methods of processing and retention

The data is processed using electronic and paper-based tools, by authorised and trained personnel, adopting technical and organisational measures suitable to ensure the security, integrity and confidentiality of the information (arts. 25 and 32 GDPR).

The retention periods are as follows:

• Pilgrim profile: for the entire duration of the account and for the 24 months following its deletion, save for retention obligations provided for by law.
• Members' data (members' register): for the entire duration of membership and, after it ends, for the period required by the rules on Third Sector entities and by civil and tax law.
• Proof of acceptance (date, time, IP, versions of the texts): for the duration of membership and for the following ten years, the ordinary limitation period.
• Volunteers' register: for the duration of the volunteering activity and, after it ends, for the period required by the rules on Third Sector entities and by the management of the insurance policy.
• Newsletter: until consent is withdrawn.
• Accommodation contacts: until consent is withdrawn by the facility.
• Purchase data: 10 years for tax and accounting purposes (D.P.R. 600/1973).
• Browsing logs: maximum 12 months.

5. Recipients and communication to third parties

Personal data may be communicated to third parties acting as Data Processors under art. 28 GDPR, on the basis of a specific contract, solely for the purposes described above:

• Aruba S.p.A. (Via San Clemente 53, 24036 Ponte San Pietro BG, Italy) — hosting and web infrastructure provider on which the site and the database reside;
• the print shop that prints the physical membership cards (Stampa Divina), which receives name, surname and card number;
• providers of newsletter delivery services (e.g. Mailchimp, Brevo) — at the time of publication of this policy, the integration is being implemented;
• the Association's accountants, tax and legal advisors, where necessary;
• public authorities, at their express request and in the cases provided for by law.

Some services are provided by parties that process data as independent controllers, under their own privacy policies and only to the extent necessary for the service:

• PayPal (Europe) S.à r.l. et Cie, S.C.A. — electronic payment of membership fees and Store orders; the Association never receives card details;
• the insurance company (UnipolSai Assicurazioni S.p.A.) — for the volunteers' policy under art. 18 of the Third Sector Code and the handling of claims;
• WhatsApp Ireland Ltd — members' group, only for those who choose to join.

Within the Association, data is processed by the members of the governing body and by the persons in charge of the secretariat and of the website, authorised to process it under art. 29 GDPR and instructed on confidentiality. Notifications of new membership applications and new members are sent to them by email.

The data is not subject to dissemination beyond the purposes indicated above and is neither transferred nor sold to third parties for marketing purposes.

6. Transfer outside the EU

Should the service providers listed above involve the transfer of data outside the European Economic Area (e.g. the United States), such transfer takes place solely on the basis of the Standard Contractual Clauses approved by the European Commission (art. 46 GDPR) and/or applicable adequacy decisions.

7. Rights of the data subject

At any time the data subject may exercise the following rights, by writing to the PEC quellidellavia@pec.it or to the standard email privacy@viadigiovannibattista.com:

• Right of access (art. 15) — to obtain confirmation of the existence of processing and a copy of the data.
• Right to rectification (art. 16) — to request the correction of inaccurate data or the completion of incomplete data.
• Right to erasure (art. 17, "right to be forgotten") — to request the deletion of data in the cases provided for by the regulation.
• Right to restriction (art. 18) — to request the temporary blocking of processing.
• Right to portability (art. 20) — to receive the data in a structured, machine-readable format.
• Right to object (art. 21) — to object to processing on legitimate grounds.
• Right to withdraw consent (art. 7.3) — to withdraw at any time the consent given, without prejudice to the lawfulness of the processing carried out before withdrawal.

The Association undertakes to respond to requests within 30 days of receipt (art. 12.3 GDPR), save for a justified extension of a further 60 days in cases of particular complexity.

Registered users can exercise some rights directly from their profile area on the site: downloading a copy of their data in a readable format (portability, art. 20) and deleting their account (right to erasure, art. 17). Those who are or have been entered in the members' register cannot delete their account on their own: members' register data is subject to a retention obligation even after membership ends, and the request must be addressed to the Association, which deletes or anonymises everything not subject to retention.

8. Cookies

The site uses exclusively technical cookies necessary for its operation. No profiling cookies, analytical cookies, or third-party cookies for advertising or marketing purposes are used.

The integrated mapping services (Leaflet, OpenStreetMap, Stadia Maps), the typefaces (Google Fonts) and the icons (Font Awesome via cdnjs) may set third-party technical cookies for the loading and distribution of content. The complete detail of the third-party services and their respective policies is available in the Cookie Policy.

9. Changes to the policy

The Association reserves the right to update this policy to reflect changes in processing practices, regulatory developments or the activation of new services. The current version is always published on this page, indicating the date of the last update. For substantial changes, data subjects will be notified through the channels available.