Privacy notice on the processing of personal data

Introduction and scope

Cinghio in Comune is a project for the participatory regeneration of public spaces in the Cinghio Sud neighbourhood of Parma, promoted by Sex & the City APS as lead organisation, together with the City of Parma and a network of local partners. The process comprises listening activities, exploratory walks, co-design workshops, courses and public events.

Organising these activities and documenting how they unfold involves collecting some personal data through online forms. This notice describes the categories of data processed, the purposes and legal basis of the processing, who may access the data, how long it is kept and the rights of the data subject.

1. Data controller

Sex & the City APS
Registered office: via della Moscova, 58 — 20121 Milan, Italy
Tax code 97914640152 — VAT number 12586000965
Address for data protection matters: info@genderatlas.it
Certified email: info@pec.sexandthecity.space

The Controller has not appointed a Data Protection Officer, as the conditions set out in art. 37 of the Regulation do not apply.

2. Categories of data processed

The project’s online forms collect:

• name, that is first name and surname;
• email address;
• age range, selected from predefined intervals;
• gender, selected from the options offered.

Processing is limited to the data listed above. The forms do not collect information on health, religious or philosophical beliefs, political opinions, trade union membership, ethnic origin or sexual orientation, nor data relating to criminal convictions and offences.

Where the answer on gender is such as to reveal the gender identity of the person filling in the form, that data falls within the special categories referred to in art. 9 of the Regulation and receives the reinforced protection provided there: processing is based on the explicit consent referred to in art. 9(2)(a), the data is used exclusively in aggregate form and access is restricted to members of the research team. The answer options always include “prefer not to say”.

3. Purposes of the processing

The data is processed for the following purposes:

• a) Organising the project activities. Confirming registrations, communicating the place or time of meetings, giving notice of any changes, managing participation lists.
• b) Sharing the outcomes of the process. Sending those who took part the materials produced, the reports and invitations to the public events of the project.
• c) Monitoring and evaluating the impact of the project. Data on age range and gender makes it possible to see which groups of the population the process reaches and which remain at its margins, so that the ways of involving people can be adjusted as the project goes on. The analysis is carried out in aggregate form: reports, indicators and accounts to funders contain no data attributable to individuals.

The data is not used for commercial or promotional purposes, does not feed newsletters or communications unrelated to the Cinghio in Comune project, and is not sold or transferred to third parties for purposes of their own.

4. Legal basis of the processing

Processing is based on the consent of the data subject, pursuant to art. 6(1)(a) of the Regulation and, for gender data under the conditions described in point 2, art. 9(2)(a).

Consent is given by ticking the relevant box before submitting the form and may be withdrawn at any time, with no need to give reasons, by writing to info@genderatlas.it. Withdrawal does not affect participation in the public activities of the project and does not affect the lawfulness of processing carried out beforehand.

5. Whether providing data is required

Providing data is optional. Registering for an activity and receiving the related communications require at least a name and an email address, without which the Controller cannot confirm participation. The fields on age range and gender may be left blank, or filled in by selecting the non-answer option, with no limitation whatsoever on access to the activities.

6. Processing of data relating to minors

The forms may only be filled in by people aged eighteen or over. The participation of children and teenagers in the project activities — workshops in schools, the videomaking course, the street art workshop — takes place through schools and educational partners, with the consent of those holding parental responsibility and on the basis of forms separate from this notice. Data relating to minors received in error is deleted without further processing.

7. Recipients of the data

The data is accessed by members of the Sex & the City APS team — members, staff and external collaborators — authorised in writing and instructed on the processing.

Project partners — the City of Parma, orizzontale, Emporio Parma, Cooperativa Sociale ECOLE, Montanara Insieme, Laboratorio Democratico Montanara, Biblioteca Malerba, Rise the Cat — and funders receive aggregate data and statistics only, with no individual references.

The data may be disclosed to public authorities in the cases required by law. No form of public dissemination is envisaged.

8. Processors and transfers of data to third countries

The data collection forms are built with Google Forms, part of the Google Workspace suite. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) acts as processor, appointed pursuant to art. 28 of the Regulation on the basis of the Cloud Data Processing Addendum applicable to the contract entered into with the Controller, and processes the data solely in accordance with the Controller’s instructions.

Form responses are stored on Google’s infrastructure and may also be processed in countries outside the European Union, including the United States. Those transfers are based on the adequacy decision adopted by the European Commission on 10 July 2023 in relation to the EU-U.S. Data Privacy Framework, to which Google LLC adheres, and on the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914, referred to in the same Cloud Data Processing Addendum.

An up-to-date list of the processors appointed by the Controller, and a copy of the safeguards adopted for transfers to third countries, may be requested by writing to info@genderatlas.it.

9. Retention period

• Name and email address: for the duration of the project (June 2026 – September 2027) and for twelve months after it ends, the time needed to close the activities and report on them, after which the data is deleted.
• Age range and gender: until the monitoring analysis is complete, after which only aggregate data remains, which does not allow individuals to be identified and may be kept without time limit.
• Withdrawal of consent or request for erasure: removal within thirty days of receiving the request, unless a legal provision requires the data to be kept.

10. How the data is processed

Processing is carried out by electronic means, with access protected by personal credentials and limited to those who need it for the purposes described. Contact lists are not disseminated or shared in copy outside the team. The Controller does not use automated decision-making or profiling within the meaning of art. 22 of the Regulation.

11. Rights of the data subject

At any time the data subject may exercise the rights set out in articles 15 to 21 of the Regulation:

• access to the data concerning them and a copy of it (art. 15);
• rectification of inaccurate data and completion of incomplete data (art. 16);
• erasure of the data (art. 17);
• restriction of processing (art. 18);
• portability, that is receiving the data in a machine-readable format and having it transmitted to another controller (art. 20);
• objection to the processing (art. 21);
• withdrawal of consent, as set out in point 4.

Requests should be addressed to info@genderatlas.it. The Controller replies within one month of receipt, a deadline that may be extended by two months in the cases provided for in art. 12(3) of the Regulation, informing the data subject accordingly.

12. Complaints

Anyone who believes that their data is being processed in breach of the applicable rules may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garante@gpdp.it — www.garanteprivacy.it) or bring proceedings before the courts.

Last updated: September 2026