Legal
Privacy Policy
Privacy notice pursuant to Articles 13–14 of EU Regulation 2016/679 (GDPR)
Last updated: May 2026
1. Data Controller
The data controller for personal data collected through wildsos.it is:
Stefanello Enrico
Vigonza, Padova, Italy
Email: info@wildsos.it
For any privacy-related matter, please write to the email address above. No DPO has been appointed as the processing does not fall within the cases set out in Article 37 GDPR.
2. Data collected and purposes
2.1 Navigation data (Vercel Analytics)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Pages visited, device type, country of origin (no identifying data) | Anonymous statistical analysis to improve the service | Legitimate interest — Art. 6.1.f GDPR | Aggregated data, no individual profiles |
Vercel Analytics uses a cookie-free methodology and does not track users across sessions. No personally identifiable data is collected.
2.2 Geolocation
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| GPS coordinates or city/postcode search result | Show the nearest rescue centers to the user | User's explicit consent via browser — Art. 6.1.a GDPR | Not retained: processed client-side only, never transmitted to WildSOS servers |
City or postcode searches are processed via Nominatim, a geocoding service by OpenStreetMap Foundation (Belgium, EU). Only the text entered by the user is sent to Nominatim — no other personal data.
2.3 CRAS submission reports
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Center name, phone, region, optional notes | Verify and add new centers to the database | Consent — Art. 6.1.a GDPR | Until verification; after integration, personal data in notes is removed |
2.4 CRAS data quality feedback
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Report type, CRAS ID, optional notes | Maintain database data quality | Legitimate interest — Art. 6.1.f GDPR | 12 months from submission |
2.5 CRAS accounts (rescue centre operators)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email address, password (hashed), CRAS ID | Authentication and dashboard management | Performance of a contract — Art. 6.1.b GDPR | Until account deletion on request |
2.6 CRAS access requests
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email address, selected CRAS | Verify identity and send access invitation | Consent — Art. 6.1.a GDPR | 90 days from request, then deleted |
2.7 Donations (Stripe)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Payment data (processed by Stripe), amount, optional email | Process voluntary donation | Performance of a contract — Art. 6.1.b GDPR | As required by applicable tax and accounting regulations (minimum 10 years) |
WildSOS never stores or accesses credit card data. Such data is entered directly on a secure Stripe, Inc. page and remains exclusively with Stripe. WildSOS only receives payment confirmation and amount.
2.8 Telegram bot (@soswild_bot)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Telegram chat ID, message text, geographic location (if voluntarily shared) | Respond to wildlife rescue requests | Implicit consent — starting the bot conversation — Art. 6.1.a GDPR | Session state: 30 minutes in volatile memory, not persisted to database |
3. Data recipients and cross-border transfers
Data may be shared with the following processors:
| Provider | Service | Location | Transfer safeguards |
|---|---|---|---|
| Google LLC (Firebase / Firebase Auth) | Firestore database and account authentication | USA | Standard Contractual Clauses (SCCs) — Art. 46 GDPR |
| Vercel Inc. | Web hosting and Vercel Analytics (cookie-free) | USA | Standard Contractual Clauses (SCCs) — Art. 46 GDPR |
| Resend Inc. | Transactional email (CRAS invites, notifications) | USA | Standard Contractual Clauses (SCCs) — Art. 46 GDPR |
| Stripe, Inc. | Payment processor | USA | Standard Contractual Clauses (SCCs) — Art. 46 GDPR |
| Telegram Messenger Inc. | Wildlife rescue bot (@soswild_bot) | USA/Dubai | Standard Contractual Clauses (SCCs) — Art. 46 GDPR |
| OpenStreetMap Foundation (Nominatim) | Free-text geocoding | Belgium (EU) | No cross-border transfer |
Transfers to the USA are made under the safeguards provided by Art. 46 GDPR (Standard Contractual Clauses approved by the European Commission).
4. Cookies and tracking technologies
WildSOS does not use profiling or remarketing cookies.
The following are used:
- Strictly necessary technical cookies for site operation (e.g. authenticated session management).
- Service Worker (local cache): data is stored exclusively on the user's device and not transmitted to third parties.
Vercel Analytics is separate and operates cookie-free: it does not collect identifying data or profile users.
5. Your rights
Under Articles 15–22 GDPR, you have the right to:
- Access (Art. 15): obtain confirmation of processing and a copy of your data
- Rectification (Art. 16): correct inaccurate or incomplete data
- Erasure (Art. 17): request deletion of your data ("right to be forgotten")
- Restriction (Art. 18): limit processing in certain cases
- Portability (Art. 20): receive your data in a structured, machine-readable format
- Objection (Art. 21): object to processing based on legitimate interest
- Withdrawal of consent: at any time, without prejudice to prior processing
To exercise your rights, write to: info@wildsos.it
The controller will respond within 30 days of receipt (Art. 12 GDPR).
You also have the right to lodge a complaint with the competent supervisory authority:
Italian Data Protection Authority (Garante) — www.garanteprivacy.it
6. Minors
WildSOS does not knowingly collect personal data from individuals under the age of 16. Should any unintentional processing of minors' data be detected, such data will be deleted without delay.
7. Updates to this notice
The controller reserves the right to update this notice at any time, particularly following regulatory changes or the introduction of new services. Material changes will be notified via a notice on the site. The date of last update is shown at the top of the page.