Newsletter Privacy Notice

Pursuant to Article 13 of the General Data Protection Regulation (the “GDPR”), Fondazione Penta ETS, an organization incorporated in Italy (Fiscal Code 92166930286) whose registered office is in Padova, Corso Stati Uniti, 4 (hereinafter “Penta”, “we” , “our”, “us” or the “Foundation”), in its capacity as Data Controller, provides you with the following information on the processing of your personal data in relation to your subscription to our “Penta Foundation Newsletter” (the “Newsletter”). The Personal Data Processing will be carried out in compliance with the GDPR and the Italian Legislative Decree n. 196 of 30 June 2003 “Italian Personal data protection Code”. 

a. Data controller

      Penta is the Data Controller of your personal data processed in relation to our Newsletter.

      b. Data Protection Officer (DPO)

      Penta appointed a Data Protection Officer (Article 37 of the GDPR) who may be contacted at the following e-mail address dpo@pentafoundation.org.

      c. Purposes and legal grounds

      Penta processes your personal data for the following purposes:

      PurposePersonal data processedDescriptionLegal basis
      Penta Foundation NewsletterFull name
      E-mail address      		Promotion of Penta’s activities or initiatives in the healthcare and research sector Your consent (Article 6, par. 1, let. A) of the GDPR).   Please note that your consent can be freely withdrawn by sending an email to the contacts listed below (par. h) of this privacy notice). The withdrawal of your consent will not affect the lawfulness of the previous processing.

      For further information on other personal data processing activities carried out through the website Penta – Child Health Research, please refer to the dedicated Privacy Policy.

      d. Means of the processing

      Data will be processed and stored by computerized means, in compliance with the legislation in force and, in any case, in a way that ensures its safety, confidentiality and prevents unauthorized dissemination or use, falsification or destruction.

      e. Data retention period

      We retain your personal data in line with what is indicated in the table below:

      PurposeRetention period
      NewsletterUntil consent is withdrawn. In any case, the data will not be processed for more than 10 years after the last expression of consent.

      f. Processing recipients

      Personal data will not be disseminated.

      Within Penta, personal data may come to knowledge (for their respective areas of competence) of the persons expressly authorized to the processing.

      Personal data may come to knowledge of the following third parties: (i) companies that offer services instrumental to the management of the Foundation’s technological infrastructure; (ii) companies and/or consultants that offer services instrumental to the browsing of Penta’s website; (iii) Companies providing services for the drafting and sending of newsletters. Where necessary, Penta has appointed such processing recipients as Data processors pursuant to Article 28 of the GDPR. A list of all the Data processors designated by Penta can be requested by contacting Penta at the details below (par. h) of this privacy notice).

      g. Transfer of data outside the European Union

      Within the purposes listed above, your personal data might be the subject of transfer to countries not belonging to the European Union. The transfer of personal data will take place in full compliance with the guarantees, measures, and rights provided by the GDPR, usually based on adequacy decisions or standard contractual clauses approved by the European Commission. By sending an email to the contact listed below (par. h) of this privacy notice), you can receive further information regarding the transfer of your personal data and the guarantees in place for their protection.

      h. Data subject’s rights

      By sending an e-mail to legal@pentafoundation.org, you may at any time exercise the following rights provided for by Articles 15 to 22 of the GDPR:

      • obtaining confirmation as to whether your personal data is being processed;
      • obtaining access to your personal data and to the information set out in Article 15 of the GDPR;
      • obtaining the rectification of your inaccurate personal data without undue delay or the supplementing of your incomplete personal data;
      • obtaining the erasure of your personal data without undue delay;
      • obtaining the restriction of processing of your personal data;
      • being informed of any rectifications or erasures or restrictions of processing in relation to your personal data;
      • receiving in a structured, commonly used and machine-readable format your personal data;
      • objecting at any time, on grounds associated with your specific situation, to the processing of your personal data.

      The full list of privacy rights could be found on www.garanteprivacy.it.

      i. Complaint to the Data Protection Authority

        Should you consider that the processing of data infringes the GDPR, you have the right to raise complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or, if different, to the Data Protection Authority of the Member State of your habitual residence, place of work or place of the alleged infringement.

        Fondazione Penta ETS
        1st July 2026