Privacy Policy for the Official Santa Barbara Way App

Pursuant to Regulation (EU) 2016/679 (“GDPR”)

Last updated: October 15, 2026

This privacy policy describes the methods of processing personal data of users of the “Cammino di Santa Barbara App” (“App”).

1. Data Controller

The Data Controller is:

The data controller is the Fondazione Cammino Minerario di Santa Barbara, headquartered in Iglesias (SU), Piazza Municipio n. 1, and can be contacted at the following addresses: tel. 0781.24132, email amministrazione@cmsb.it, PEC camminodisantabarbara@pec.it.

Data Protection Officer (DPO):

The Data Protection Officer (DPO) is Giovanni Ledda, Esq., with an office in Cagliari, Piazza Repubblica no. 10, who can be contacted at the following details: tel. 070.303361, mobile 339.83589721, email avvocatoledda@studiolegalegiovanniledda.it, certified email giovanni.ledda@legalmail.it.

2. Data Processed

During use of the App, the following categories of data may be processed.

Technical and Usage Data

The App may collect technical information relating to the device and the use of its features, such as, by way of example:

• information about the features used;

• interactions with the App’s content;

• technical data necessary for the proper functioning of the service;

• statistical and diagnostic information.

Such data are used exclusively for the operation of the App, to improve its features, for security purposes, and to process aggregated statistics on use of the service.

Location Data

With the user’s consent and through the permissions required by the operating system, the App may access the device’s geographic location.

Location data are used solely to provide features linked to the Santa Barbara Way, such as displaying the user’s position on the map, orientation along the route, and other geographic features strictly connected to the use of the App.

The user may change or revoke location authorization at any time via their device settings.

3. Purpose of Processing

Data are processed exclusively for the following purposes:

• to enable the App to function;

• to provide the features requested by the user;

• to enable use of maps, routes, and location-based functionalities;

• to improve the quality, reliability, and security of the App;

• to analyze the use of functionalities in statistical form;

• to prevent malfunctions, abuse, or improper use of the service;

• to comply with legal obligations, if any.

4. Legal Basis for Processing

The processing of personal data is based, depending on the specific purpose, on:

• the performance of the service requested by the user;

• the user’s consent, when required, for example to access geographic location;

• the legitimate interest of the Data Controller to ensure the service’s proper functioning, security, and improvement, to the extent permitted by applicable law;

• compliance with legal obligations.

5. No Advertising Tracking

Data collected through the App are not used to track user activity across applications or websites owned by other companies.

In particular, the data collected:

• are not used to create advertising profiles of the user;

• are not used for remarketing or behavioral advertising activities;

• are not combined with data from other companies’ apps or websites for advertising purposes;

• are not sold to third parties;

• are not shared with data brokers;

• are not used for tracking purposes as defined by Apple under App Tracking Transparency.

For these reasons, the App does not perform advertising tracking of the user.

6. Data Disclosure and Service Providers

The Controller may use technical providers solely to the extent necessary for the operation of the App, for example for:

• technological infrastructure and hosting;

• mapping services;

• maintenance and technical support;

• statistical analyses and technical monitoring;

• service security and diagnostics.

These parties process data exclusively for purposes necessary to provide the required technical services and based on instructions from the Controller, where applicable acting as Data Processors pursuant to Art. 28 GDPR.

Personal data are not transferred, sold, or disclosed to third parties for commercial, advertising or profiling purposes.

7. Data Transfers Outside the European Economic Area

Personal data are not transferred outside the European Economic Area.

8. Data Retention Period

Personal data are retained for no longer than is strictly necessary to achieve the purposes for which they were collected and, subsequently, for the time required to comply with legal obligations or protect the rights of the Controller.

Technical and statistical data may be stored in aggregated or anonymized form for service analysis and improvement purposes.

Location data are processed only for the time necessary to provide the related functionality and are not used to reconstruct or monitor user movements for advertising purposes.

9. Methods of Processing and Security

Personal data are processed using electronic tools and with technical and organizational measures suitable to ensure their security, confidentiality, and protection from unauthorized access, loss, destruction, or improper disclosure.

The Controller applies the principles of data minimization and data protection by design and by default.

10. Data Provision

The provision of data necessary for the operation of the App is limited to information strictly required by the features used.

The user may deny or revoke access to geographic location via device settings. In this case, some location-based features may not be available, while other App features will remain usable where technically possible.

11. Data Subject Rights

Pursuant to Articles 15-22 GDPR, the user may, where provided for by law:

• obtain confirmation as to whether or not personal data concerning them exist;

• access their personal data;

• request rectification or updating of their data;

• request erasure of their data;

• request restriction of processing;

• object to the processing;

• request data portability;

• withdraw previously given consent, without affecting the lawfulness of processing carried out prior to withdrawal.

Requests can be sent to:

info@cmsb.it

The user also has the right to lodge a complaint with the Data Protection Authority, according to the procedures provided for by applicable law.

12. Minors

The App is not specifically intended to collect personal data from minors.

If a minor’s use of the App involves the processing of personal data for which consent is required, the provisions set out by applicable law shall apply.

13. Changes to this Privacy Policy

This privacy policy may be updated over time, including as a result of regulatory, technical or app functionality changes.

The updated version will be made available within the App and/or through the website associated with the service.

For information regarding the processing of personal data, you may contact the Controller at:

info@cmsb.it