This Privacy Policy explains how personal data are processed when you visit critical-lab.org, contact CRiTICAL LAB, or interact with the website.
1. Who we are and who controls your data
The data controller for this website is:
Carlo Inverardi-Ferri
Operating the website under the name CRiTICAL LAB
Email: info@critical-lab.org
CRiTICAL LAB is an independent international research initiative based in Rome. It is not part of the Italian National Research Council (CNR). Some members may be affiliated with CNR, universities or other organisations, but those affiliations do not make those organisations responsible for this website unless a specific page expressly states otherwise.
No Data Protection Officer has been appointed because one is not currently required. If this changes, the relevant contact details will be added here.
2. Scope of this policy
This Policy covers personal data processed through this website and ordinary website-related communications.
It does not govern personal data collected for interviews, surveys, fieldwork, research datasets, events, mailing lists or individual research projects. Where CRiTICAL LAB or one of its members conducts such activities, the responsible controller must provide a separate, project-specific privacy notice.
3. Personal data we process
Depending on how you use the website, we may process:
- Technical and log data: IP address, date and time of access, requested pages or files, referrer URL, browser and device information, operating system, HTTP status and security-event data.
- Contact data: name, email address, organisation or affiliation, subject and the contents of messages sent through a form or by email.
- Consent data: a consent identifier, selected cookie categories, date and time of the choice, consent status and limited technical information needed to document or honour the choice.
- Optional analytics data: information about visits and interactions, only where the relevant analytics require consent and you have given it.
- Embedded-content data: technical and usage data sent to providers of videos, maps or social content, only after the relevant consent or a deliberate click-to-load action where required.
- Public professional information: names, roles, institutional affiliations, biographies, photographs, publications and project information relating to CRiTICAL LAB members and collaborators, normally supplied or approved by them.
Please do not send health information, political opinions, union membership, biometric or genetic data, information about sexual life or orientation, or other sensitive personal data through the general contact form.
4. Why we process data, legal bases and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Deliver the website, diagnose faults, maintain security and prevent abuse | Technical and log data | Legitimate interests under Article 6(1)(f) GDPR: providing a secure and reliable website | Normally no longer than 30 days, unless a security incident or legal claim requires longer retention |
| Receive and answer enquiries, collaboration proposals or other requests | Contact data and message content | Legitimate interests under Article 6(1)(f) GDPR; Article 6(1)(b) where the message requests steps before an agreement | Normally up to 24 months after the last meaningful exchange, unless a longer period is required for an ongoing matter or legal claim |
| Record and honour cookie choices and demonstrate compliance | Consent data | Legal obligation under Article 6(1)(c) and legitimate interests under Article 6(1)(f) GDPR | Normally 12 months, then renewed or deleted according to the consent-management configuration |
| Measure website use through non-essential analytics | Online identifiers and usage data | Consent under Article 6(1)(a) GDPR and Article 122 of the Italian Personal Data Protection Code | As stated in the Cookie Policy and the relevant provider’s entry; consent may be withdrawn at any time |
| Display non-essential third-party embeds | Online identifiers and usage data | Consent under Article 6(1)(a) GDPR and Article 122 of the Italian Personal Data Protection Code | As stated in the Cookie Policy and the relevant provider’s entry |
| Present members, collaborators, projects and research outputs | Public professional information | Legitimate interests under Article 6(1)(f) GDPR in communicating the Lab’s work; consent where appropriate for photographs or non-public information | While the information remains relevant, subject to correction, withdrawal where applicable, archival needs and legal obligations |
| Establish, exercise or defend legal claims and comply with binding legal requests | Relevant records | Article 6(1)(c) and/or Article 6(1)(f) GDPR | For the applicable statutory period or as required by law |
Where processing is based on legitimate interests, we consider the necessity and proportionality of the processing and the interests, rights and reasonable expectations of the people concerned.
5. Is providing data mandatory?
You are not required by law to contact us. If you do not provide an email address and the information needed to understand your request, however, we may be unable to reply.
Non-essential cookies and tracking technologies are optional. Refusing them does not prevent access to the website’s ordinary content.
6. Who receives personal data
Personal data may be accessed by authorised CRiTICAL LAB members who need them for the purposes described above and by selected service providers acting under appropriate contractual safeguards, including:
- Website hosting and infrastructure: Hostinger
- Website maintenance and security: authorised developers or technical administrators, where necessary.
- Email: info@critical-lab.org
- Consent management: CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom.
- Analytics or embedded-content providers: only those actually listed in the current Cookie Policy and only where activated under the applicable consent choice.
- Public authorities, courts or professional advisers: where disclosure is required by law or necessary to establish, exercise or defend legal claims.
Service providers may process data only for the agreed purposes and subject to applicable data-protection obligations. CRiTICAL LAB does not sell personal data.
7. International data transfers
Some service providers may process data outside the European Economic Area.
CookieYes Limited is established in the United Kingdom. The European Commission currently recognises the United Kingdom as providing an adequate level of protection under Article 45 GDPR. CookieYes also publishes a Data Processing Agreement addressing restricted transfers and safeguards.
For any other transfer outside the EEA, the controller will use a lawful transfer mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where required. Information about applicable safeguards may be requested at info@critical-lab.org.
8. Cookies and similar technologies
The website uses technical technologies needed for operation and consent management. Any non-essential analytics, functional or embedded-content technologies must remain blocked until the required consent is given.
Details, current providers, purposes and durations are available in the Cookie Policy. You can change or withdraw your choices at any time using the Cookie Settings link in the website footer. Withdrawing consent does not affect processing that occurred lawfully before withdrawal.
9. Security
We use proportionate technical and organisational measures intended to protect personal data, including encrypted transmission, restricted administrative access, software updates, backups and access controls. No online service can guarantee absolute security.
10. Your rights
Subject to the conditions in the GDPR, you may request:
- access to your personal data;
- correction of inaccurate or incomplete data;
- deletion of data;
- restriction of processing;
- objection to processing based on legitimate interests;
- portability of data where processing is automated and based on consent or contract;
- withdrawal of consent at any time; and
- information about applicable international-transfer safeguards.
To exercise a right, email info@critical-lab.org. We may request limited additional information where reasonably necessary to verify identity. We normally respond within one month, subject to the extensions permitted by law.
You also have the right to lodge a complaint with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy, through the contact methods published at www.garanteprivacy.it.
11. Automated decisions
The website does not use personal data to make solely automated decisions that produce legal or similarly significant effects.
12. Children
The website is intended for a general academic and professional audience and is not designed to collect personal data from children. A child should not submit personal data through the contact form without appropriate adult assistance.
13. External websites
The website may link to third-party websites. Their processing is governed by their own privacy notices, and CRiTICAL LAB is not responsible for their independent practices.
14. Changes to this policy
We may update this Policy when the website, service providers or legal requirements change. The latest version and its update date will always appear on this page. Material changes may also be highlighted on the website or through the cookie banner where they affect consent choices.
15. Contact
Questions or privacy requests may be sent to info@critical-lab.org or by post to the controller address stated in section 1.