Privacy policy - Food Wave

Privacy policy

Information Notice on Data Processing

pursuant to art. 13 of EU Regulation No 2016/679

In accordance with Art. 13 of EU Regulation No 2016/679 (General Regulation on the Protection of Personal Data), the following information is provided.



The European project “Food Wave – Empowering Urban Youth for Climate Action” aims to raise public awareness of development issues and to promote development education in the European Union. It is based on the implementation of awareness-raising and engagement campaigns on the key issue of climate change and urban food policies. The focus is also thought to be related to social inclusion.

The project is developed by the Municipality of Milan, together with civil society organizations and other Italian, European and global partners (29 in total).


Data Controllers

The partners of the Food Wave project carry out their functions in full autonomy and act as autonomous data controllers in relation to the data of citizens processed directly. These subjects will separately make the information on the processing of the data they hold.

The following information therefore refers only to the treatments carried out by the Municipality of Milan in its capacity as owner based in Piazza della Scala, 2 – 20121 Milan.


Responsabile della protezione dei dati personali

Il Responsabile per la protezione dei dati personali (Data Protection Officer – “DPO”) del Comune di Milano è raggiungibile al seguente indirizzo e-mail:


Data Protection Officer

The Data Protection Officer (“DPO”) of the Municipality of Milan can be reached at the following e-mail address: Purpose and legal basis The processing of data is aimed at the development of the Food Wave project and the realization of connected and instrumental activities, including the implementation of the platform for the management of the registration and authentication process of citizens who voluntarily adhere to project initiatives.

Personal data are processed in compliance with the conditions laid down in EU Regulation 2016/679 and in particular:

a) in the light of art 6, paragraph 1 (.b) for the performance of the contract to which the data subjects are parties by registering with the platform;

b) in the light of art 6, paragraph 1 (.c) and art. 2 ter of Legislative Decree 196/2003 “Code on the protection of personal data”, for the execution of a task of public interest in accordance with the project objectives;

c) in the light of 6, paragraph 1 (.a) on the basis of consent in relation to the possible transfer of data to non-EU countries or outside the EEA (European Economic Area).

The consent given regarding the subject referred to in point (c) above may be revoked at any time by contacting the Data Controller at the e-mail address


Types of data processed

The participation in the Food Wave project through the web platform provides for the collection of the following personal data:


Methods of data processing

The processing takes place in compliance with fundamental rights and freedoms and is based on the principles of fairness, lawfulness, transparency and the protection of confidentiality. It is also carried out with the help of electronic tools in line with the operations indicated in art. 4, point 2, of EU Regulation 2016/679.


Nature of data processing

The provision of data is mandatory and their failure to enter precludes the possibility of entering the Food Wave project as well as the consequent obligations related to the same project.


Communication and dissemination

Personal data may be shared with the independent food wave project partners who are indipendent data controllers (listed below): ActionAid Italia, ACRA, Mani Tese Cities and municipal agencies: City of Almere, Metropolitan Agency of Brazov, City of Bruges, ReLondon, City of Malmö, City of Madrid, Municipality of Molenbeek, City of Murcia, Municipality of Nea Smyrni, Pest County, City of Turin, City of Sao Paulo, City of Sofia, City of Warsaw, City of Zagreb, Risteco – Eating City Civil society organizations: Institute Wcycle Maribor, European Association for Local Democracy – ALDA, ActionAid Hellas,Fundación Alianza por los Derechos, la Igualdad y la Solidaridad Internacional, Biennale des jeunes créateurs de l’Europe et de la Méditerranée – BJCEM, Erasmus Student Network Italy – ESN Italy, Lisbon CLLD Network, Groundwork Greater Manchester. The communication and dissemination of data must take place exclusively for the purposes indicated related to the Food Wave project.


Categories of data recipients

The processing is carried out by the authorized persons and committed to confidentiality and in charge of the related activities in relation to the purposes pursued.

The processing of data will also be carried out by staff of ActionAid Italia and Pomilio Blumm, who act respectively as Data Processor and Sub-Processor ex art. 28 of the EU Regulation 2016/679 for the management of the platform and information and communication activities (sending newsletters, invitation to events, sending specific information notices related to project issues).

Data retention

The data will be kept for as long as necessary to achieve the purposes for which they were collected and for the entire period of execution of the project and in any case for the time required by the provisions on documentary keeping, including storage in the public interest.


Data transfer to third countries

The data processed for the aforementioned purposes reside on servers located in the European Union and are not, in principle, transferred to non-EU countries or outside the EEA (European Economic Area). However, in the framework of the project is not excluded the possibility of transferring data to non-EU countries or to international organizations and in this case the processing can only be lawfully carried out by explicit and specific consent as indicated in point (c) of the previous paragraph “Purpose and legal basis”. With this in mind, the information may be transferred to partners in the United Kingdom (UK) or São Paulo of Brazil or to other persons for whom there is no adequacy statement from the EU Commission. Data protection measures limit the risk of processing that does not comply with the regulatory framework.


Rights of data subjects

Interested parties may exercise the rights provided for in Art. 15 and the following of EU Regulation 2016/679 and in particular the right to access their own personal data, to request its correction or limitation, to update if incomplete or incorrect and to delete if the conditions are fulfilled, as well as to oppose processing by making the request:


Right of complaint

Finally, we inform that if interested parties believe that the processing of personal data referred to them takes place in violation of the provisions of EU Regulation 2016/679 (Art. 77) they have the right to lodge a complaint with the Guarantor, ( or to refer the matter to the appropriate judicial bodies (Art. 79 of the Regulation).