Privacy Notice for Data Submitted via Google Forms
INFORMATION ON THE PROCESSING OF PERSONAL DATA pursuant to Articles 13–14 of Regulation (EU) 2016/679 (GDPR)
This notice forms an integral part of our general Privacy Policy.
We inform you that any personal data you provide by completing the CHEDAR Survey form via Google Forms will be processed in accordance with Legislative Decree 196/2003 and Regulation (EU) 2016/679 (GDPR).
The data is collected exclusively for the purposes specified within the CHEDAR Survey form. This notice applies to personal data submitted by users when completing the questionnaire.
1. DATA CONTROLLER
The Data Controller is CHEDAR Project, with registered office at Via di Santa Marta 3, 50139 Firenze (FI), Italy (“Controller”).
You may contact the Controller at: info@chedarproject.org
2. DATA PROCESSOR
Google Ireland Limited (“Google”), a company incorporated under Irish law (Company No. 368047), with registered office at Gordon House, Barrow Street, Dublin 4, Ireland, is appointed as external Data Processor pursuant to Articles 4(8) and 28 of the GDPR.
This appointment covers activities related to the management of data collected via Google Forms and associated cloud services.
Google acts on behalf of the Controller in providing storage and data processing tools, under the terms of the Data Processing Addendum signed as part of the Google Workspace agreement.
Regarding international data transfers to non-EEA countries, Google LLC (the parent company based in the USA) adheres to the EU-U.S. Data Privacy Framework (DPF), recognised as adequate by the European Commission on 10 July 2023. This ensures an appropriate level of data protection for transfers to the United States.
Google also complies with the Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional technical and organisational safeguards.
Google remains accountable, in line with the onward transfer principle, for ensuring data protection standards are maintained by any third-party subprocessors.
Further details:
· EU-U.S. Data Privacy Framework: https://www.dataprivacyframework.gov
· Google Privacy Policy: https://policies.google.com/privacy/update
· DPF Certifications: https://policies.google.com/privacy/frameworks
4. DATA PROCESSING AND ACCESS
Data is processed using Google Workspace tools (such as Google Forms, Google Cloud Platform, Google Docs, Google Sheets) and stored on servers managed by Google.
The Controller accesses the data using secured credentials with two-factor authentication.
All communication between the user’s browser and Google’s servers is encrypted using HTTPS (TLS protocol), ensuring data security during transmission.
Form submissions may generate an email notification to the Controller, which may be retained in their email system.
No other user tracking or additional data recording occurs beyond what is submitted in the form.
5. DATA LOCATION
Google uses globally distributed data centres to ensure high availability, continuity, and security.
An up-to-date list of Google’s data centre locations is available at:
https://www.google.com/about/datacenters/inside/locations/index.html
Data submitted via Google Forms may be stored across multiple server locations, including outside the EEA, but always under the safeguards described in Section 2.
6. DATA RETENTION PERIOD
Personal data collected via the CHEDAR Survey will be retained only as long as necessary to carry out the relevant management activities.
Once that purpose has been fulfilled, the data will be deleted or anonymised unless further retention is required to comply with legal obligations, public authority requests, or for the legitimate interests of the Controller (such as legal defence).
7. CONSEQUENCES OF FAILURE TO PROVIDE PERSONAL DATA
Providing the requested data is necessary for the purposes stated.
Failure to provide such data will make it impossible to process your request or deliver the services outlined in the form.
8. DATA SUBJECT RIGHTS
You have the right at any time to access your personal data, request its correction, updating, or completion, and to request its erasure, anonymisation, or restriction.
You may also object, wholly or partly, to its processing.
To exercise these rights under Articles 15–22 of the GDPR, please contact CHEDAR Project at Via di Santa Marta 3, 50139 Florence (FI), or by email at info@chedarproject.org
You also have the right to lodge a complaint with the Italian Data Protection Authority or another competent supervisory authority concerning the processing of your personal data.