Last updated: 21 September 2026. Controller: Safe House ETS (Italian fiscal code / Codice Fiscale 96629270586).
1. Controller
The controller is Safe House ETS, a Third Sector entity, fiscal code 96629270586.
- Public website: https://safehouse.community
- Privacy contact: info@safehouse.community
- Registered office: Via Delleani 26, 00042 Anzio (RM)
- RUNTS registration: Rep. n. 156768
- Operational office: Turin (Piedmont)
No DPO (Data Protection Officer) is appointed at the time of this notice; if one is appointed, the details will be updated here.
2. Scope
This notice covers:
- visitors to safehouse.community (browsing, forms, donations, cookies);
- processing in internal management systems used by authorised staff (association accounts and desk case files);
- Google Calendar and Google Drive integrations in the staff area.
The public site and the internal systems are hosted on the same Aruba Cloud virtual server (VPS) in Italy.
We value confidentiality. Data you give us is used to reply, to run the association and — only if you accept analytics cookies — to understand in aggregate how the site is used. We do not send names, phone numbers or email addresses to third parties for advertising or commercial profiling.
3. Data and purposes (public website)
3.1 Browsing and security
Technical connection data (IP address, user-agent, security logs) to serve the site, prevent abuse and keep it secure. Legal basis: legitimate interest (Art. 6.1.f GDPR) and, where applicable, legal obligation. For audience measurement (section 3.7) Safe House does not store the visitor’s raw IP address.
3.2 Contact forms (general, legal desk, digital desk)
Name, email, message, chosen desk and consent. Purpose: to read and handle the request. We store the message, email it to the desk inbox and send a copy to the sender. The file may be linked to internal desk case records. Basis: pre-contractual steps / legitimate interest and, on the form, consent. We keep only a hash of IP and user-agent on the submission, not the raw address.
3.3 Volunteer application
First name, last name, email, phone, message and consent. Purpose: to assess the application and get back to you. The content is emailed to the staff volunteer inbox and a confirmation is sent to the applicant. Basis: consent and pre-contractual steps.
3.4 Online donations (Stripe)
Name, type (individual or organisation), email and/or phone, optional comment, amount, campaign, and whether the gift is one-off or recurring. Card data does not pass through our servers: payment is handled by Stripe. For association accounts we record donation metadata in internal systems (including fees and net amount when available) and the contact details needed for receipts and books. Basis: the donation relationship and accounting / legal duties.
3.5 5 per mille and information pages
Publishing the fiscal code does not collect extra data beyond ordinary browsing.
3.6 Cookie choice
We store the choice (essential only or analytics) and an audit log (hashed IP and user-agent, date). Basis: the duty to demonstrate consent.
3.7 Audience measurement (Google Analytics 4 via Google Tag Manager)
If you choose Accept all or save preferences with analytics cookies on, and if staff have the tool enabled, we load Google Analytics 4 through Google Tag Manager. It provides aggregated statistics (visits, pages, source, device, approximate geography, engagement) and records that a journey was completed (donation, volunteer application, contact or desk message). We do not send this tool names, emails, phone numbers, form text or amounts. We do not use it for advertising or remarketing. Basis: consent. Recipients: Google Ireland / Google LLC. Google states that it uses the IP for coarse geolocation and then discards it; Safe House does not keep the raw IP for this measurement. This section is distinct from staff Calendar/Drive APIs (section 5).
3.8 Form protection (Cloudflare Turnstile)
On contact and volunteer forms we use Cloudflare Turnstile to tell people from automated systems. It is a security tool, not advertising. The widget token and the request IP may be sent to Cloudflare for that check.
4. Cookies
The public site uses necessary cookies (session, security, consent preference). Google Analytics 4, via Google Tag Manager, loads only after Accept all or Save preferences with analytics selected. Marketing and advertising cookies are not in use. Details: Cookie policy.
5. Google API Services — staff area (Calendar & Drive)
This section also supports Google Cloud OAuth verification / Google API Services User Data Policy (Limited Use).
Application: Safe House staff area — Google Calendar / Drive for staff.
Users: authorised Safe House ETS staff only (not the public site audience).
Google data the app may access (OAuth scopes in use):
- basic identity of the linked Google account (
openid,email,profile); - Google Calendar — read/write events and calendars to sync appointments and relevant dates;
- Google Drive with limited scope
drive.file— only files created or opened by the app (not the user’s entire Drive).
How we use Google data: only to provide the staff integration. OAuth tokens are stored on the server and are not exposed to the browser as secrets.
What we do not do: we do not sell Google data; we do not use it for advertising; we do not transfer it to unrelated third parties; we do not use Google data to train generalised AI models.
Safe House ETS undertakes to comply with the Google API Services User Data Policy, including Limited Use.
Disconnect: staff can disconnect Google from the external-accounts area. Tokens are then invalidated or removed; operational records remain subject to internal retention.
6. Internal management systems
Internal systems hold association records (contacts, members, volunteers, donations and reporting, desk cases) for Safe House ETS institutional purposes. Recipients: authenticated users with roles and access controls. Basis: legitimate interest, legal duty or performance of a relationship, as the case requires.
7. Recipients and providers
- Hosting: Aruba Cloud VPS (Italy) — public site and internal systems on the same server.
- Institutional email: Google Workspace for Nonprofits (Google Ireland / Google LLC), used to send and receive association mail (contact, volunteering, internal mail).
- Payments: Stripe, under Stripe’s terms. Card data does not pass through Safe House servers.
- Form protection: Cloudflare Turnstile (Cloudflare, Inc. / Cloudflare Ireland) on contact and volunteer forms.
- Audience measurement: Google Ireland / Google LLC for Google Analytics 4 and Google Tag Manager, only after analytics consent.
- Google Calendar and Drive: when a staff member links their account (section 5).
8. Transfers outside the EU
The site server is in Italy. Google (mail, measurement, staff APIs), Stripe and Cloudflare may also process data outside Italy or the EU. For Google services, Google publishes participation in the EU–US Data Privacy Framework / adequacy decision; this page is not a processing contract. See those providers’ own notices for more detail.
9. Retention
- Technical and security logs: as needed for security and legal duties.
- Form messages: for as long as needed to handle the request and a reasonable follow-up, and in internal files if the case stays open.
- Volunteer applications: for assessment and follow-up.
- Donation and accounting data: according to civil and tax duties.
- Cookie-consent audit (hashes): to demonstrate consent, typically up to 12–24 months or until the choice is renewed.
- Staff Google tokens: while the external account stays linked.
10. Your rights
You may request access, rectification, erasure, restriction, portability, objection and withdrawal of consent (where applicable) by writing to info@safehouse.community. You may lodge a complaint with the Italian Data Protection Authority (Garante).
11. Updates
We may update this notice to reflect technical or organisational changes. The date at the top and the page «Updated» field show the latest published revision.