1. Data Controller

The data controller for the processing of personal data is CharitX S.p.A., with registered office at Via Massimiliano Massimo n. 16, 00144 Rome, Italy, Tax Code and VAT number 18312061007, e-mail address privacy@charitx.com, certified e-mail (PEC) charitx@pec.it (hereinafter, the “Controller” or “CharitX”).

2. Scope of application

This Privacy Notice governs the processing of personal data carried out by CharitX S.p.A. in connection with the management and operation of the digital platform named “CharitX”, accessible via the website www.charitx.com and through the dedicated mobile application (jointly, the “Platform”). It applies to the processing of personal data connected with registration, access to and use of the Platform and its features.

In particular, this Privacy Notice concerns exclusively the personal data of Users who are natural persons registering for and using the Platform, as well as the personal data of legal representatives, contact persons or persons specifically delegated by Beneficiary Entities who access the Platform and operate on it on their behalf, in connection with activities of promoting, managing and participating in charitable initiatives.

Expressly excluded from the scope of this Privacy Notice are the processing activities carried out by Beneficiary Entities acting as independent data controllers, including with reference to data received through the Platform in connection with Donations or for tax, administrative or reporting purposes. Such processing activities are governed by the respective privacy notices adopted by the Beneficiary Entities, in respect of which CharitX is entirely unrelated and assumes no liability.

This Privacy Notice also applies to: (a) visitors to the website www.charitx.com who access the site without registering on the Platform, in relation to processing connected with anonymous browsing and the use of analytics tools; (b) individuals who fill in the demo request form available on the website, in relation to personal data voluntarily provided for that purpose. For these categories of data subjects, the provisions of this Privacy Notice apply insofar as relevant, with particular reference to Articles 3.7, 3.8, 4, 5, 6, 8, 9, 10 and 11.

3. Categories of personal data processed

In connection with registration, access to and use of the Platform, CharitX processes various categories of personal data, strictly relevant and proportionate to the purposes pursued, as described below.

3.1 Registration and Account management data

CharitX processes the personal data provided directly by the User at the time of registration and during the management of their Account on the Platform. Such data include, by way of example, first and last name, e-mail address, username and authentication credentials, which are processed in encrypted form.

Where the User chooses to provide their tax code pursuant to paragraph 3.3, CharitX processes it exclusively for that purpose (facilitating the transmission of tax data to Beneficiary Entities for the purpose of any tax certification), in compliance with the data minimisation principle. The User’s age of majority is verified through the date of birth indicated during registration, as provided for in the Terms of Use – Users.

The User may also choose to complete their profile by uploading a representative image (avatar) and, where available, to access the Platform through authentication systems provided by social networks or third-party platforms. In such cases, CharitX may receive certain identification and authentication data from the third-party operator, within the limits and in accordance with the procedures set out in the relevant privacy notices.

3.2 Data relating to use of the Platform and social interactions

During use of the Platform, CharitX processes data relating to the activities carried out by the User, such as, by way of example, information on the Challenges promoted or in which the User participates, interactions with other Users, comments, feedback, as well as text, photographic or audiovisual content that may be uploaded or shared.

Data relating to usage preferences and how the User interacts with the Platform’s features are also processed, in order to enable proper functioning and, where applicable, improve the User’s overall experience.

3.3 Data relating to Donations

With reference to Donations made through the Platform, CharitX processes the data necessary for the technical management of the transactions, such as the amount and date of the Donation, the recipient Beneficiary Entity and technical information relating to the transaction.

Where the User chooses to provide their personal and tax data in order to allow their transmission to Beneficiary Entities for the purpose of any tax certification, such data will be processed by CharitX exclusively for the purpose of technically facilitating the transmission, it being understood that Beneficiary Entities act as independent data controllers for their subsequent activities. Where a Pledge involves an amount equal to or exceeding the threshold set for the Waiver under the applicable Terms of Service, CharitX also processes, for the sole purpose of collecting and transmitting the Waiver itself, the following additional User data: tax code; VAT number, where the User acts as a company; a copy of a valid identity document; and, where the User is a company, a chamber of commerce extract or equivalent certificate of registration/incorporation.

3.4 Data of representatives and contact persons of Beneficiary Entities

CharitX processes the personal data of the legal representatives, contact persons or persons delegated by Beneficiary Entities operating on the Platform, such as identification and contact details, the position and role held within the entity, as well as the information necessary for the creation and management of the entity’s profile and related Challenges. As part of the eligibility verification of the Beneficiary Entity, CharitX also processes, in accordance with the Beneficiary Policy: a copy of an identity document of the legal representative or of the person carrying out the registration; the entity’s memorandum and articles of association; a resolution of the competent body attesting to the relevant signing powers; where applicable, the latest available financial statements and a reference to the public register or supervisory authority with which the entity is registered or recognised in its country of establishment or operation.

3.5 Data transmitted to the Payment Provider for KYC/AML verification

The personal data of legal representatives and contact persons of Beneficiary Entities collected by CharitX pursuant to paragraph 3.4, as well as the identification and tax data that may be collected by CharitX pursuant to paragraph 3.3 in connection with the Waiver, may be transmitted to the Payment Provider, as an independent data controller, for the purposes of the “Know Your Customer” (KYC) and “Anti-Money Laundering” (AML) checks that the Payment Provider carries out autonomously, in accordance with its own policy, as a condition for enabling the dedicated account of the Beneficiary Entity to receive and disburse funds. Such transmission takes place on the basis of the performance of the contract between CharitX and the Beneficiary Entity and, with regard to anti-money laundering and counter-terrorist financing aspects, on the basis of compliance with legal obligations to which the Payment Provider is subject.

3.6 Technical and browsing data

Lastly, CharitX processes technical and browsing data generated by access to and use of the Platform, such as the IP address, access logs, information relating to the device used and the browser, as well as data collected through cookies and similar tools. Such processing is carried out in accordance with the Cookie Policy, to which reference should be made for further details.

3.7 Data of website visitors

With reference to browsing of the website www.charitx.com by unregistered visitors, CharitX processes technical browsing data whose transmission is inherent to the use of internet communication protocols, such as the IP address — processed in anonymised form and never stored in its complete form — access logs, browser type, operating system and pages visited. Subject to the visitor’s consent, CharitX also processes data collected through analytics cookies, in particular through Google Analytics 4 provided by Google LLC, in order to collect aggregate information on the use of the website with a view to improving its functioning and content. Details of the cookies used are set out in the Cookie Policy, accessible from the website.

3.8 Data collected through the demo request form and commercial contacts

When filling in the demo request form available on the website, CharitX collects the following personal data, voluntarily provided by the data subject: first and last name; e-mail address; telephone number; name of the company or organisation of affiliation; professional role held; type of organisation; main area of interest; any additional information entered in the message field.

4. Purposes of processing and legal bases

The personal data of Users and of the individuals operating on the Platform on behalf of Beneficiary Entities are processed by CharitX exclusively for determined, explicit and legitimate purposes, strictly connected with the operation of the Platform and the provision of related services, in compliance with the legal bases provided for by Regulation (EU) 2016/679.

In particular, personal data are processed to allow registration on the Platform, the creation and management of the User’s Account and the verification of the requirements necessary to access the services, including verification of the User’s age of majority carried out through the date of birth indicated during registration. Such processing is necessary for the performance of the contractual relationship established with the User and is therefore based on the performance of a contract to which the data subject is a party, pursuant to Article 6(1)(b) of the GDPR.

Personal data are also processed to enable the provision of the features and services made available through the Platform, such as, by way of example, participation in Challenges, social interaction with other Users, and the publication and management of content and feedback. Such processing is also necessary for the performance of the contract and is based on the same legal basis.

With reference to Donations made through the Platform, personal data are processed for the purpose of technically facilitating payment transactions and transmitting the information necessary to the Payment Providers (see below) and to the Beneficiary Entities receiving the Donations. Such processing is carried out on the basis of the performance of the contract and, where applicable, in order to comply with legal obligations to which CharitX is subject.

Personal data may also be processed in order to comply with regulatory, legal or administrative obligations, as well as to respond to requests, orders or measures issued by the competent authorities. In such cases, the processing is based on compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR.

Lastly, CharitX processes personal data for purposes connected with the security of the Platform, the prevention and combating of unlawful or abusive use, and the protection of its own rights and interests, including in legal proceedings. Such processing is carried out on the basis of the Controller’s legitimate interest pursuant to Article 6(1)(f) of the GDPR, in compliance with the fundamental rights and freedoms of data subjects.

The personal data of representatives and contact persons of Beneficiary Entities are also processed by CharitX for the purpose of verifying the eligibility of the Beneficiary Entity, including classification according to the Tier/Category taxonomy set out in the Beneficiary Policy, verification of the identity and signing powers of the legal representative, and screening against applicable sanctions and international monitoring lists. Such processing is carried out on the basis of the performance of the contract with the Beneficiary Entity and, with regard to anti-money laundering and counter-terrorist financing aspects, on the basis of compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR, as well as, for checks exceeding the strict regulatory obligation, on the basis of CharitX’s legitimate interest in ensuring the integrity and reliability of the Platform pursuant to Article 6(1)(f) of the GDPR.

For Pledges of an amount equal to or exceeding the Waiver threshold set out in the Terms of Service, the data and documents collected pursuant to paragraph 3.3 are processed by CharitX in order to collect and retain the User’s declaration regarding the nature of the Donation and the lack of need for more formal requirements under applicable law. Such processing is necessary for the performance of the contract with the User and, with regard to the retention of documentation for protection purposes in the event of future disputes, is also based on CharitX’s legitimate interest pursuant to Article 6(1)(f) of the GDPR.

The data referred to in paragraph 3.5 are transmitted to the Payment Provider for the purposes and on the legal bases indicated therein.

The technical website browsing data referred to in paragraph 3.7 are processed for the purposes of IT security, proper provision of the service and monitoring of the website’s functioning in aggregate and anonymous form. Such processing is based on CharitX’s legitimate interest pursuant to Article 6(1)(f) of the GDPR. Data collected through analytics cookies are processed, subject to the visitor’s consent, for the purposes of statistical analysis of website use and improvement of the browsing experience. Such processing is based on the data subject’s consent pursuant to Article 6(1)(a) of the GDPR.

The data collected through the demo request form referred to in paragraph 3.8 are processed in order to respond to the request received, organise the requested demo and provide the data subject with information on CharitX services relevant to their type of organisation and area of interest. Such processing is based on the consent expressed by the data subject through the selection of the relevant consent checkbox when filling in the form, pursuant to Article 6(1)(a) of the GDPR. Should the commercial contact develop into the negotiation of a service agreement, the data may also be processed on the basis of pre-contractual measures taken at the data subject’s request, pursuant to Article 6(1)(b) of the GDPR.

5. Processing based on consent

Certain processing activities carried out by CharitX are not strictly necessary for registration on the Platform or for the provision of essential services and are therefore carried out exclusively upon the User’s specific consent, given freely, on an informed basis and unambiguously.

In particular, CharitX may process the User’s personal data for communication and marketing purposes, such as sending, through automated or traditional means, newsletters, updates, promotional and informational communications relating to the Platform, its features, active or future Challenges and, more generally, charitable initiatives promoted through CharitX. Such processing is carried out exclusively on the basis of the User’s consent pursuant to Article 6(1)(a) of the GDPR.

Subject to separate consent, CharitX may also process the User’s personal data for purposes of profiling and personalising the experience on the Platform. In this context, CharitX may analyse preferences, interactions, ways of using the services and participation in Challenges, in order to propose content, initiatives and suggestions consistent with the interests expressed by the User and to improve the usability and effectiveness of the services offered. Such processing is also based exclusively on the User’s consent.

Where expressly provided for and subject to further specific consent, the User’s personal data may also be used to enable the transmission, through CharitX, of informational or promotional communications from Beneficiary Entities present on the Platform, in relation to initiatives, projects or activities promoted by them. In such cases, CharitX acts as a facilitator of communication, in compliance with the instructions received and applicable law.

The provision of the consents indicated above is always optional. Failure to give, or subsequent withdrawal of, consent does not in any way affect the User’s ability to register on the Platform or to use the essential services offered through it.

The User may withdraw consent given at any time, without affecting the lawfulness of processing carried out prior to withdrawal, by accessing their Account settings or contacting CharitX in accordance with the procedures indicated in this Privacy Notice.

With reference to website visitors, CharitX processes data collected through analytics cookies — in particular Google Analytics 4 — exclusively upon the visitor’s consent given through the consent management tool (CMP) available on the website. Consent may be withdrawn at any time through the same settings, without affecting the lawfulness of processing carried out prior to withdrawal.

6. Nature of the data provision

The provision of personal data required for purposes connected with registration on the Platform, the creation and management of the Account, verification of the access requirements, as well as the provision of the services offered through CharitX, including participation in Challenges and the technical facilitation of Donations, is necessary. Failure to provide such data makes it impossible for CharitX to allow registration on the Platform, access to the services and, more generally, performance of the contractual relationship with the User or the represented Beneficiary Entity.

Conversely, the provision of personal data for marketing purposes, promotional communications, profiling and personalisation of the experience on the Platform, as well as for the possible receipt of communications from Beneficiary Entities, is entirely optional. Any failure to provide such data, or subsequent withdrawal of consent for such purposes, does not in any way affect the use of the Platform’s essential services nor the validity of the contractual relationship with CharitX.

It is understood that the User may at any time change their preferences regarding the provision of data and the consents given, through their Account settings or by contacting CharitX in accordance with the procedures indicated in this Privacy Notice.

The provision of personal data through the demo request form referred to in paragraph 3.8 is entirely optional. Failure to provide such data does not affect browsing of the website or access to the information available on it, but makes it impossible for CharitX to process the request and contact the data subject. The consent given through the demo request form authorises CharitX exclusively to contact the data subject in relation to the specific request submitted; the sending of commercial communications or newsletters not directly connected with the request is subject to the provision of separate and specific consent.

7. Processing methods and security measures

The processing of personal data is carried out by CharitX mainly by means of IT and electronic tools, in accordance with procedures strictly related to the purposes indicated in this Privacy Notice and, in any case, in compliance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality set out in Regulation (EU) 2016/679.

CharitX adopts appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, as well as the risks, including accidental ones, of destruction, loss, alteration, unauthorised disclosure of, or access to, personal data processed. Such measures include, by way of example, access authentication and authorisation systems, credential management procedures, data encryption or pseudonymisation techniques, as well as monitoring and protection tools for the technological infrastructure.

Processing is carried out by personnel expressly authorised by CharitX and duly instructed, or by third parties acting as data processors pursuant to Article 28 of the GDPR, on the basis of specific contractual agreements governing the manner of processing and security and confidentiality obligations.

CharitX designs and manages its services and the Platform’s features in accordance with the principles of “privacy by design” and “privacy by default”, adopting technical and organisational solutions aimed at ensuring that, by default, only the personal data necessary for each specific purpose are processed and that data are not made accessible to an indefinite number of persons without the User’s intervention.

8. Recipients of the data

Personal data collected and processed through the Platform may be communicated or made accessible, within the limits strictly necessary for the purposes indicated in this Privacy Notice, to third parties acting as independent controllers or as data processors, as well as, in cases provided for by law, to the competent authorities.

In particular, data relating to Donations and payment transactions may be communicated to the payment service providers used through the Platform, which act as independent data controllers, in accordance with their respective privacy notices and in compliance with applicable law on payment services and anti-money laundering.

The User’s personal data provided for the purposes of managing Donations and facilitating the issuance of tax certifications may be transmitted to the Beneficiary Entities receiving the Donations, which process such data as independent data controllers, in accordance with their institutional purposes and their respective privacy notices.

The data of representatives and contact persons of Beneficiary Entities, as well as the data collected for the purposes of the Waiver, may also be communicated to the Payment Provider, as an independent data controller, for the purpose of the KYC/AML verification described in paragraph 3.5, as well as, for Beneficiary Entities established under a foreign legal system, to third-party screening providers that may be engaged by CharitX to support the eligibility verification in accordance with the Beneficiary Policy.

For requirements connected with the technical and operational management of the Platform, the development, maintenance, support and security of IT systems, personal data may also be communicated to technology, cloud and IT service providers, selected by CharitX and formally appointed as data processors pursuant to Article 28 of the GDPR, which operate on the basis of documented instructions and are bound by contractual confidentiality and security obligations.

Lastly, personal data may be communicated to judicial, administrative or supervisory authorities, as well as to other authorised public bodies, exclusively in cases provided for by law, regulations or measures of the competent authorities, or where such communication is necessary for the establishment, exercise or defence of a legal claim.

With reference to website browsing data collected through Google Analytics 4, Google LLC acts as an independent data controller for the purposes of its own analytics service. Where CharitX uses CRM or contact management tools provided by third parties for managing demo requests, such parties act as data processors pursuant to Article 28 of the GDPR, on the basis of specific contractual agreements.

9. Transfers outside the EU

Where, in connection with the provision of the Platform’s services, personal data are transferred to countries located outside the European Union or the European Economic Area, such transfers will take place exclusively in compliance with Articles 44 et seq. of Regulation (EU) 2016/679 and other applicable provisions on the protection of personal data.

In particular, CharitX ensures that transfers to third countries take place only in the presence of an adequacy decision adopted by the European Commission pursuant to Article 45 of the GDPR, or, in the absence of such a decision, through the adoption of appropriate safeguards pursuant to Article 46 of the GDPR, such as, by way of example, standard contractual clauses approved by the European Commission, supplementary technical and organisational measures or other legal instruments suitable to guarantee a level of data protection substantially equivalent to that provided for by European legislation.

In residual cases where the transfer to a non-EU country takes place on the basis of one of the derogations provided for in Article 49 of the GDPR, CharitX will proceed in compliance with the conditions and limits set out therein, adopting every reasonable measure to protect the rights and freedoms of data subjects.

The User may request further information from CharitX regarding transfers of data to third countries and the safeguards adopted, in accordance with the procedures indicated in the section of this Privacy Notice dedicated to the rights of the data subject.

Transfers to foreign Beneficiary Entities. Where the Beneficiary Entity selected by the User for a Pledge is domiciled outside the European Economic Area, the User acknowledges that personal data connected with the Pledge and the Donation (such as first name, last name, amount and any personal and tax data provided for the purpose of tax certification) may be transferred to that third country, in compliance with the safeguards provided for in Articles 44 et seq. of Regulation (EU) 2016/679 as described in the preceding paragraphs of this article, including, where applicable, standard contractual clauses approved by the European Commission or another adequate transfer mechanism. The Tier/Category classification of the Beneficiary Entity, published on the Platform in accordance with the Beneficiary Policy, allows the User to know in advance whether the selected Beneficiary Entity is domiciled in a non-EEA country.

The use of Google Analytics 4 for the analysis of website browsing involves the transfer of data to Google LLC, based in the United States of America. Such transfer takes place in compliance with the adequacy decision adopted by the European Commission under the EU-US Data Privacy Framework (July 2023), to which Google LLC is a certified party. The updated list of certified organisations can be consulted on the website of the United States Department of Commerce.

10. Retention periods

Personal data collected and processed through the Platform are retained by CharitX for a period of time not exceeding that necessary to achieve the purposes for which they were collected and subsequently processed, in compliance with the principles of storage limitation and minimisation set out in Regulation (EU) 2016/679.

In particular, personal data processed for purposes connected with registration, Account management and the provision of the Platform’s services are retained for the entire duration of the contractual relationship between the User and CharitX. Following termination of the relationship, data may be further retained, in full or limited form, for the period necessary to comply with legal, regulatory or tax obligations, as well as for administrative and accounting requirements.

CharitX may also retain certain personal data even after termination of the contractual relationship, within the limits and for the periods permitted by applicable law, in order to protect its own legitimate rights and interests, including, by way of example, the management of any disputes, complaints or litigation, as well as the establishment, exercise or defence of a legal claim in or out of court.

Personal data processed on the basis of the User’s consent for marketing, promotional communication and profiling purposes are retained until such consent is withdrawn by the User, and in any case for a period not exceeding that deemed appropriate in relation to the specific purposes pursued, without prejudice to CharitX’s right to demonstrate the lawfulness of the processing carried out up to the time of withdrawal.

Once the applicable retention period has elapsed, personal data will be deleted, anonymised or rendered no longer attributable to the User, unless further retention is required or permitted by law.

The technical website browsing data referred to in paragraph 3.7 are retained for the time strictly necessary for the indicated purposes and in any case for no more than 30 days, save for requirements connected with security investigations or requests from the competent authorities. Data collected through analytics cookies are retained for the periods indicated in the Cookie Policy; Google Analytics 4 cookies have a maximum duration of 400 days, after which they are automatically deleted.

The data collected through the demo request form referred to in paragraph 3.8 are retained for the time necessary to manage the request and, in the event of the start of a commercial negotiation, for the entire duration thereof. Where the request does not result in a contractual relationship, the data are retained for a period not exceeding 24 months from the date the form was filled in, after which they are deleted or anonymised, unless the data subject has in the meantime given separate consent for marketing purposes.

11. Rights of data subjects

As a data subject, the User may exercise at any time the rights recognised by Articles 15 et seq. of Regulation (EU) 2016/679, within the limits and under the conditions set out therein. In particular, the User has the right to obtain confirmation from CharitX as to whether or not personal data concerning them is being processed and, if so, to access such data and information relating to the processing.

The User also has the right to request the rectification of inaccurate personal data or the completion of incomplete data, as well as, in cases provided for by applicable law, the erasure of personal data concerning them (“right to be forgotten”) or the restriction of processing. Where the legal requirements are met, the User may also object to the processing of personal data concerning them, in particular where the processing is based on CharitX’s legitimate interest, and exercise the right to data portability, obtaining the personal data provided in a structured, commonly used and machine-readable format, or requesting that it be transmitted to another data controller.

With reference to processing based on consent, the User has the right to withdraw consent given at any time, without affecting the lawfulness of processing carried out prior to withdrawal. Consent may be withdrawn through the Account settings, where available, or by directly contacting CharitX.

To exercise their rights, the User may contact CharitX using the contact details indicated in this Privacy Notice. CharitX will respond to the User’s requests within the timeframes and in accordance with the procedures provided for by applicable law.

The User in any case retains the right to lodge a complaint with the Data Protection Authority, or to bring proceedings before the competent courts, should they believe that the processing of their personal data is being carried out in violation of applicable law.

The same rights set out in this article may also be exercised by visitors to the website who are not registered Users and by individuals who have filled in the demo request form, in relation to their respective processing of personal data described in Articles 3.7 and 3.8. To exercise such rights, it is sufficient to contact CharitX at privacy@charitx.com or at the certified e-mail address charitx@pec.it. For the management of cookie consent and the modification of tracking preferences, the visitor may use the consent management tool accessible from the website at any time.

12. Role of Beneficiary Entities and the Payment Provider

Beneficiary Entities that access and operate on the Platform, including through their representatives, contact persons or delegated persons, process personal data received through CharitX as independent data controllers, pursuant to Regulation (EU) 2016/679, for purposes of their own and additional to those pursued by CharitX, such as, by way of example, the management of Donations received, compliance with regulatory, tax or statutory obligations, and the possible issuance of certifications or attestations to Users.

CharitX does not determine the purposes and means of the processing carried out by Beneficiary Entities following the communication of data and exercises no control over how such entities process personal data as independent controllers. Accordingly, CharitX cannot be held liable for subsequent processing carried out by Beneficiary Entities, which are required to provide data subjects with an appropriate privacy notice and to ensure compliance with applicable data protection law.

Similarly, payment service providers used through the Platform (hereinafter, the “Payment Providers”) act as independent controllers of personal data relating to payment transactions, including data necessary for authentication, execution of transactions, fraud prevention and compliance with obligations under applicable law on payment services, anti-money laundering and counter-terrorist financing.

CharitX does not access, store or process data relating to the payment instruments used by Users, which are acquired and managed directly by the Payment Providers through their own technological environments and infrastructure. CharitX does not determine the purposes and means of the processing carried out by the Payment Providers and exercises no control over how the latter manage personal data; accordingly, CharitX cannot be held liable for processing carried out by the Payment Providers as independent controllers.

In particular, the Payment Provider processes the data referred to in paragraph 3.5 as an independent data controller also for the purposes of carrying out its own KYC/AML verification of the Beneficiary Entity, in accordance with its own policy available on its website, as a condition for enabling the dedicated account of the Beneficiary Entity to receive and disburse funds. Such verification is separate and independent from the eligibility verification carried out by CharitX in accordance with the Beneficiary Policy, and CharitX exercises no control over its outcomes.

Users are therefore invited to consult the privacy notices and contractual terms made available by the Beneficiary Entities receiving the Donations and by the Payment Providers, in order to understand the manner, purposes and legal bases of the processing of personal data carried out by such parties, as well as the rights that may be exercised against them.

13. Updates to this Privacy Notice

CharitX reserves the right to modify, supplement or update this Privacy Notice on the processing of personal data at any time, in whole or in part, in order to bring it into line with new regulatory or legal provisions, measures issued by the competent authorities, developments in the services offered through the Platform, or organisational, technical or functional changes to the Platform.

Updated versions of this Privacy Notice will be made available through publication on the Platform and will indicate the date of last update. Where required by applicable law, CharitX will inform Users of the changes made in a manner suitable to ensure their awareness, including through direct communications.

Unless otherwise provided by law, changes to this Privacy Notice will take effect from the date indicated in the updated version. Continued use of the Platform after that date will constitute acknowledgment of the updated Privacy Notice, without prejudice to the User’s right to exercise the rights recognised by applicable data protection law.

14. Language of the document

This Privacy Notice is also made available in other languages for the convenience of Users. In the event of any discrepancy or interpretative conflict between the Italian version and any translation into another language, the Italian version shall prevail in all cases.