Privacy notice

Who holds the data

The controller is Kevin Gallaccio, who maintains this archive personally. There is no association yet; when one is formed the controller will change and this page will be updated.

For any question or request: info@casalcassinese.com. Replies come from a person rather than a department, and may take a few days.

No data protection officer has been appointed. The archive meets none of the three limbs of GDPR art. 37(1): it is not a public authority, it carries out no large-scale systematic monitoring, and it processes no art. 9 data at scale.

Why we hold it, and on what basis

There are three purposes and they do not share a legal basis.

Keeping and making readable the photographic and genealogical memory of Casalcassinese, a frazione of Acquafondata. Basis: GDPR art. 6(1)(f), legitimate interests. The interest is concrete: the village’s photographs currently exist mostly as twice-compressed copies in a Facebook group, with no dates, no places, and the names buried in comment threads. Without an archive that memory goes when the people who remember it go.

Running member accounts and sign-in. Basis: art. 6(1)(b) and (f).

Consent is deliberately not the basis. Consent must be freely withdrawable, and an archive that comes apart when one cousin changes their mind is not an archive. Consent could never cover the many documented people who never registered anyway.

On request we will provide the written balancing assessment weighing our legitimate interest against your rights.

Archiving in the public interest

The archive relies on the Italian regime for archiving in the public interest and historical research: art. 99 of D.Lgs. 196/2003, which permits processing beyond the period needed for the original purposes and draws no distinction between public and private controllers.

We declare our intention to apply, so far as compatible, the Garante’s Regole deontologiche for processing for archiving in the public interest or historical research (provvedimento no. 513 of 19 December 2018).

This regime bears on the right to erasure — see below.

What we hold about a documented person

A person record exists for anyone the community remembers — living or dead, registered or not. Having a record implies neither consent nor participation.

It may hold: given name, surname and soprannome; dates of birth, marriage and death, often as ranges or estimates and never forced into a precise date nobody actually knows; places; family links; the photographs they appear in; where their face sits in a photograph; dialect testimony transcribed exactly as spoken; and comments naming them.

A face position is a rectangle and nothing more: four numbers between 0 and 1. We do not compute or store facial templates, descriptors or biometric signatures, and we never compare faces across photographs. No face recognition, ever. It is a rule written into the project and checked automatically on every change to the database.

What we hold about members

Display name, email address, preferred language, the dates you joined and last visited, your role, and optionally a link to your own record in the tree.

There is no password anywhere. You sign in with a code sent by email, or with Google.

If you sign in with Google we receive your name, email address and profile picture. The picture is copied once into our own storage and never linked to Google — otherwise Google would learn the IP address of every visitor to every page showing that face.

Where the data comes from

Almost all of it comes from members: photographs deposited, faces recognised, places pointed out, dates remembered.

Every statement in the archive keeps two separate names: who wrote it down, and who knew it. They are often different people — the grandson typing and the grandmother recognising the face — and attributing to the first what the second knows would destroy the archive’s credibility. It is why we can tell you, for any single fact, where it came from.

Some comes from public archives and publications, always cited.

Who else sees it

Railway (hosting and database, Amsterdam), Cloudflare (domain, DNS and network), Mailjet (sending sign-in emails, data within the European Union), and Google — only for members who choose to sign in that way.

And, above all: the other members of the archive. That is the recipient that actually matters.

We run no analytics, profile nobody, sell nothing, and carry no advertising.

The members’ tier is not confidentiality

The family tree and individual person pages require signing in, are not indexed by search engines, and return 403 to anyone who is not signed in.

This should be said plainly: a tier that can reach roughly 1,600 people is publication, not privacy. It removes search engines, strangers and scrapers. It does not make the data private.

That is why the objection route below is part of the structure rather than decoration.

For how long

Indefinitely — that is what the word archive means, and it is the processing art. 99 of D.Lgs. 196/2003 permits.

Nothing is physically deleted. When something is removed the row survives stripped of its identity, because otherwise other people’s records and links shared years earlier would break. Every removal is written to an append-only log, so that a future import cannot silently resurrect somebody whose removal was honoured.

Your rights

You may ask for access to your data, for it to be corrected, for processing to be restricted, and you may object to the processing.

Because the basis is legitimate interests rather than consent, the instrument is the right to object (art. 21), not withdrawal of consent. Where an objection succeeds, erasure follows under art. 17(1)(c).

Erasure is not automatic. Art. 17(3)(d) excludes it in so far as it would render impossible or seriously impair archiving-in-the-public-interest purposes. The difficulty is real and worth stating: a family tree is a graph, and deleting one person destroys the edges documenting the parentage of siblings, children and cousins who asked for nothing. The same facts also sit in civil-status and parish registers entirely outside our control.

So we offer a ladder of measures before the last rung: remove a name from a photograph; suppress the name while keeping the family link; restrict visibility to members; restrict processing pending an assessment; and only then erasure, where no lesser measure will do. Each time, the balancing is written down and kept.

Deleting an account is a different thing from erasing archive content. Someone closing their account is asking for their credentials and activity to go, not for their grandmother’s photographs to lose their attribution. Accounts, sessions and the email log are not archive content and are removed.

You may complain to the Garante per la protezione dei dati personali (Italy), the CNIL (France), or the supervisory authority where you live.

People who have died

The GDPR does not apply to the dead, and saying so to a relative helps nobody.

In Italy, art. 2-terdecies of D.Lgs. 196/2003 lets anyone with an interest of their own, or acting to protect the person or for family reasons deserving protection, exercise the art. 15–22 rights over a deceased person’s data. In France, art. 85 of the loi Informatique et Libertés allows directives about one’s data after death. We treat these requests like any other.

Children

The site is not aimed at children and does not knowingly register them.

Historical photographs obviously show children, many of whom are now elderly or have died. Requests concerning a child’s image, however old the photograph, take priority.

Cookies

Two, both strictly necessary: one keeps you signed in, one remembers the language you chose.

No analytics, no tracking, no third-party cookies. That is why there is no banner: strictly necessary cookies do not require one, and asking permission for something we do not do would be noise.

About this document

This is a first version, written carefully but not by a lawyer, and it will be revised. Some of the project’s legal positions still need checking with a professional; where there is doubt we say so rather than hiding it.

If anything here looks wrong about you or your family, write to us: info@casalcassinese.com.