Privacy Notice on the Processing of Personal Data pursuant to Articles 13 and 14 of EU Regulation 679/2016 concerning Requests for Admission to Alzheimer’s Residential and Semi-Residential Care Services at “Villaggio Fondazione Roma”

Rev. 1 del 14/09/2026 

 

EU Regulation 679/2016 (hereinafter the “Regulation” or “GDPR”) establishes rules relating to the protection of natural persons with regard to the processing of personal data and to the free movement of such data, and protects the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data.

This notice is issued by Fondazione Roma – Salus (hereinafter, for brevity, the “Fondazione”) pursuant to Articles 13 and 14 of the GDPR for the processing of personal data relating to requests for admission to the socio-welfare services provided on a residential basis (Alzheimer’s Residences) and semi-residential basis (Alzheimer’s Day Centre) by the facility known as “Villaggio Fondazione Roma” (hereinafter the “Villaggio”).

Data processing is carried out to the extent compatible with the purposes described in this notice and is based on the principles of fairness, lawfulness and transparency, in compliance with security measures.

 

DATA CONTROLLER

The Data Controller (hereinafter “Controller”) of the facility called “Villaggio Fondazione Roma” is Fondazione Roma – Salus. Contact details are as follows:

 

DATA PROTECTION OFFICER (DPO)

The Data Protection Officer (DPO) is Maurizio Belli of the Associazione Università del Lavoro ETS, who can be reached at dpo_salus@unilavoro.org.

 

TYPES OF PERSONAL DATA PROCESSED

For the purpose of managing requests for admission to the Villaggio’s Alzheimer’s residential and semi-residential services, the Controller processes personal data relating to the care recipient and to third parties acting on their behalf (family members, caregivers, court-appointed guardians, etc.), data classified under the GDPR as “personal data,” including “special category data” pursuant to Art. 9 GDPR. The data are collected directly from the data subject (the care recipient) or from the relevant third parties acting on their behalf. Processing takes place when the data subject submits the request through the Villaggio’s website or other channels, such as, for example, an email requesting information and/or submitting documentation.

The data processed are of various kinds, as described below.

 

→ Personal data relating to the form on the Villaggio’s website

Requests for admission to the Villaggio’s Alzheimer’s services may also be submitted via the Villaggio’s website (https://villaggiofondazioneroma.it), in which case the applicant must complete the form provided for this purpose on the “How to Access” page. The data requested in the form are: type of service requested (Residences or Alzheimer’s Day Centre), type of user (guest or caregiver), first and last name, phone number, email, any message the user wishes to send, a certificate issued by a neurologist or geriatrician from a public facility (UVA centre, hospital, ASL, or CDCD) confirming the diagnosis, and the preliminary form for the Residences (completed) or the preliminary form for the Alzheimer’s Day Centre (completed), depending on the service for which access is requested. All fields marked with an asterisk are mandatory; failure to complete even one mandatory field prevents submission of the request. The “Message” field is optional; leaving it blank does not prevent submission of the admission request.

 

→ Personal data relating to requests for admission to the residential Alzheimer’s services

The personal data, including special category data, comprise all information necessary to manage the request for admission to the Alzheimer’s Day Centre. This includes personal identification data, the place where the data subject lives and who they live with, current or past occupation, family network (type of relationship with the applicant, phone number, email, and occupation), caregiver (name, phone number, and email), any assistance from other reference persons and/or social services, type of social service activated (CDA-ADI, CD, SAISA/SAISH), social, care-related, and disability information, stage of Alzheimer’s disease, medical conditions, drug therapies, behavioural disorders, aspects relating to daily life and personal history, level of autonomy (hygiene, dressing, eating, mobility, aids used), and health, clinical, and diagnostic data relating to the certificate issued by a neurologist or geriatrician from a public facility (UVA centre, hospital, ASL, or CDCD).

The data collected are processed at the time of the initial request but also subsequently, in connection with the management of waiting lists, reassessment and management of care intake, or the closing of the file in the event of factors incompatible with the provision of the Alzheimer’s Day Centre’s services.

 

PURPOSES OF PROCESSING

Personal data are processed for the following purposes:

a) evaluation and management of the request for admission to residential or semi-residential socio-welfare services submitted by the care recipient or by their reference person, including management of the initial interview, waiting lists, and any subsequent reassessment interviews following the initial care intake;

b) management of the care recipient’s intake process, or archiving of the request due to a lack of eligibility requirements based on the outcome of the assessment referred to in point (a);

c) communications and exchange of information (by phone and email), including of a health-related nature and concerning the care recipient’s state of health, with reference persons and authorized third parties indicated in the admission request form (e.g., family members, caregivers, etc.);

d) any other administrative purpose connected with, and instrumental to, managing the request for admission to the Villaggio.

 

LEGAL BASIS FOR PROCESSING

For the purposes described above, providing personal data (including contact details) is essential for evaluating the admission request and activating the requested services, and for communications between the Villaggio and the care recipient, family member, caregiver, or other reference persons, including related administrative and management activities. Refusal to provide personal data, even in part, would make it objectively impossible for the Villaggio to take on the care request and, subsequently, to provide the services.

 

CONSEQUENCES OF REFUSAL TO PROVIDE DATA

Per le finalità sopra riportate il conferimento dei dati personali (compresi i dati di contatto) è indispensabile per la valutazione della richiesta di ammissione e attivazione dei servizi richiesti, per le comunicazioni tra il Villaggio e l’assistito, il familiare, il caregiver o altre persone di riferimento, comprese le correlate attività di natura amministrativa e gestionale. Un rifiuto al conferimento dei dati personali, anche in parte, comporterebbe l’impossibilità oggettiva per il Villaggio di prendere in carico la richiesta di assistenza e, successivamente, erogare i servizi.

 

RECIPIENTS AND/OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Data processing is carried out by persons authorized by the Controller to process personal data for the purpose of performing the tasks assigned to them, limited to the purposes described above. Personal data are also processed, albeit exclusively in an indirect capacity and for technical/IT-related activities, by the following parties:

  • persons internal to the Controller’s organization who are authorized and who carry out technical/ IT activities and services on the information system;

  • the provider of technical support and IT consultancy services, acting as Data Processor and System Administrator (Consulenzeit.com Srls);

  • the provider responsible for the development and maintenance of the website, acting as Data Processor and System Administrator (1-618 Srl).

The personal data processed by service providers on behalf of the Fondazione are handled by parties acting either as “Data Processors” pursuant to Art. 28 GDPR, or entirely autonomously as separate Data Controllers. The up-to-date list of data processors is available from the Villaggio’s Privacy Officer (Dr. Claudio Faloni; tel. 06 872089207; email referenteprivacy@fondazioneromasalus.it).

Personal data may also be disclosed in fulfillment of an obligation provided for by national or EU laws, regulations, or other legal provisions, or as a result of orders issued by authorities so entitled, or in compliance with requests from supervisory and control authorities.

 

PROCESSING METHODS

Personal data are processed in compliance with sector-specific regulations and professional confidentiality obligations, in a manner that ensures maximum security and confidentiality, using paper-based, IT, and telematic tools, adopting appropriate technical and organizational security measures to reduce the risk of loss, destruction, unauthorized access, disclosure, and tampering of data.

 

TRANSFER OF DATA TO THIRD COUNTRIES

The personal data provided and processed are not subject to transfer to third countries, whether within or outside the European Union.

 

DATA RETENTION PERIOD

Personal data are processed solely for the purpose of evaluating the request for admission to the Villaggio’s services and managing related activities.

In the event of a positive assessment and subsequent care intake, personal data are used to manage the admission process. In that case, further notices will be provided regarding the processing related to managing the requested residential or semi-residential socio-welfare services, processing related to video surveillance systems, and any further processing of personal data relating to care recipients and other data subjects involved in the processing.

In the event of a negative assessment, or where it is not possible to proceed with care intake, the data provided by the data subject will be retained for six months following the conclusion of the assessment or the decision not to proceed with intake, after which they will be deleted or anonymized.

Data relating to assessments carried out by Villaggio staff are retained for a period of three years, after which they will be deleted or anonymized.

In all cases, personal data are processed and retained in compliance with the timeframes set out in sector-specific regulations, the principle of proportionality, and only for as long as necessary to achieve the purposes described.

 

RIGHTS OF THE DATA SUBJECT

With regard to the data processing described above, the Regulation grants data subjects the rights set out in Articles 15, 16, 17, 18, 19, 20, 21 and 22, and in particular:

  • Art. 15 – Right of access: the data subject has the right to obtain confirmation as to whether or not personal data concerning them is being processed, and, if so, to access the personal data, its origin, the purposes and methods of processing, the recipients to whom the data will be disclosed, and the logic applied in the case of processing carried out with the aid of electronic tools.
  • Art. 16 – Right to rectification: the data subject has the right to obtain, without undue delay, the rectification of inaccurate personal data concerning them.
  • Art. 17 – Right to erasure: the data subject has the right to obtain the erasure or anonymization of personal data concerning them (where the specific grounds set out in Art. 17 of the Regulation apply).
  • Art. 18 – Right to restriction of processing: the data subject has the right to restrict the processing of personal data concerning them (where the specific grounds set out in Art. 18 of the Regulation apply).
  • Art. 19 – Right to notification regarding rectification/erasure/restriction: the Controller is obliged to notify each recipient to whom personal data have been disclosed of any rectification, erasure, or restriction of processing carried out pursuant to Articles 16, 17 and 18, unless this proves impossible or involves disproportionate effort.
  • Art. 20 – Right to data portability: the data subject has the right to receive the personal data concerning them in a structured, commonly used, and machine-readable format. In exercising their rights regarding data portability, the data subject has the right to have their personal data transmitted directly from one controller to another, where technically feasible.
  • Art. 21 – Right to object: the data subject has the right to object to processing (where the specific grounds set out in Art. 21 of the Regulation apply), and the Controller must refrain from further processing the personal data in question, save for certain circumstances as provided for in that same Article.
  • Art. 22 – Right not to be subject to a decision based solely on automated processing: the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

Pursuant to Art. 7 of the Regulation, the data subject’s rights include the right to withdraw consent given. Withdrawal of consent does not affect the lawfulness of processing based on consent given before its withdrawal.

Data subjects also have the right to lodge a complaint (Art. 77 GDPR) or to seek judicial remedy (Art. 79 GDPR) if they believe that processing has taken place in violation of the GDPR.

The exercise of these rights is subject to the limits, rules, and procedures set out in EU Regulation 679/2016. In accordance with Article 12(3), the Controller will provide the data subject with information on the action taken without undue delay and, in any event, no later than one month from receipt of the request. This period may be extended by two further months, where necessary, taking into account the complexity and number of requests.

The Controller will inform the data subject of any such extension, and the reasons for the delay, within one month of receiving the request. To exercise these rights, please contact the details provided below, using the appropriate forms available on the website of the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, GPDP), also accessible via the following link: (https://www.garanteprivacy.it/web/guest/home/ docweb/-/docweb-display/docweb/1089924).

Controller’s contact details for exercising the rights provided for by the Regulation: