Personal Data Processing Information Notice

This page describes how this website is managed with regard to the processing of personal data of users who browse it and use the services integrated in it. It constitutes the information notice provided pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree No. 196/2003 (Personal Data Protection Code) to those who interact with the web services of the site.

This notice applies only to the website www.cospas-sarsat-italy.it and not to any other websites that may be visited through links on this site.

1. Data Controller

Following the consultation of this site and the use of its forms, data relating to identified or identifiable persons may be processed. The “Data Controller” is the Italian Cospas Sarsat Satellite Station - Lungomare Starita, 5 - 70123 Bari.

2. Place of Data Processing

The processing operations connected with the web services of this site take place at the Italian Cospas Sarsat Satellite Station - Lungomare Starita, 5 - 70123 Bari, and are carried out only by personnel authorised to process data, under the direct authority of the Data Controller, for the provision of the services and for the maintenance of the site itself.

3. Purposes of Processing

The personal data provided by users are used for the following purposes:

- To allow navigation of the website and to obtain anonymous statistical data on its use.

- To allow the user to generate the registration form and to send it subsequently to the National Database.

- To ensure the operation of the Search and Rescue (SAR) system by sharing vital information in the event of a beacon activation.

- To handle requests for informational material or communications voluntarily sent by users.

- To comply with legal, regulatory or statutory obligations under national or European Union law, and to respond to formal requests from supervisory and administrative control bodies or from judicial and police authorities.

4. Data Retention Period

Data are retained for the time strictly necessary to achieve the purposes for which they were collected:

Browsing data: Deleted immediately after statistical processing or retained for a few days (unless required to investigate computer crimes or requested by supervisory bodies/the Judicial Authority).

Beacon registration data: From the moment the registration form is received by the Satellite Station, in view of the purpose of safeguarding human life, the personal and technical data transmitted through the registration form will be retained for the entire operational life cycle of the transmitter. Following a formal request for deletion or notice of decommissioning/change of ownership of the device, the data will be retained only for the technical time needed to update the operational databases (no longer than 30 days), after which they will be permanently archived or deleted in accordance with the legal provisions on SAR matters and the legal obligations of retention/administrative archiving.

5. Types of Data Processed

A. Browsing data

The computer systems that operate this site acquire some data whose transmission is implicit in the use of Internet protocols. This category includes IP addresses, domain names, the URIs of the requested resources, the time of the request, the method used to submit the request to the server, and other parameters relating to the user’s operating system.

B. Data entered in the registration form completion tool

In the web tool that supports the completion of the registration form for 406 MHz emergency transmitters, the user enters personal and contact data of the owner/operator, emergency contact information and technical details of the device (e.g. 15- or 23-character Hex ID protocols for ELT, EPIRB or PLB beacons), including identification data of the associated vessel or aircraft.

The data entered in the tool are processed exclusively in the user’s browser and are neither transmitted to nor stored on the servers of the site. Processing by the Satellite Station begins only upon receipt of the form sent by the user by e-mail, PEC (certified e-mail) or fax. A temporary copy of the data may remain in the local memory of the user’s device, which the user can delete with the “Clear Form” function or from the browser settings.

6. Submission of Data through Registration in the Database and Legal Basis

The use of the tool facilitates the creation of the registration form and its subsequent submission for entry in the National Database of 406 MHz Transmitters. The processing of these data is not based on mere consent, but on:

the performance of a task carried out in the public interest (Art. 6(1)(e) GDPR);

the need to protect the vital interests of the data subject or of another natural person (Art. 6(1)(d) GDPR) in the context of search and rescue (SAR) operations;

compliance with legal and supervisory obligations to which the Data Controller is subject (Art. 6(1)(c) GDPR).

7. Recipients of Data, Communication and International (Non-EU) Transfers

To ensure the effectiveness of the emergency service and to comply with legal obligations, the personal data collected may be communicated to the following recipients:

Supervisory and administrative control bodies, Judicial Authorities, Law Enforcement and competent Public Administrations, where the communication is required by law, necessary for the exercise of supervisory and inspection functions, or expressly requested by such bodies in the course of their institutional functions.

National and international authorities responsible for rescue (SAR), to ensure the effectiveness of the emergency service in the event of a transmitter activation or for operational readiness purposes. This entails the entry of the data into the International Cospas-Sarsat Beacon Registration Database (IBRD) and their potential accessibility by rescue coordination centres (SPOC and RCC) located worldwide, including countries outside the European Economic Area (non-EU). This non-EU transfer takes place by derogation pursuant to Art. 49(1)(d) and (e) GDPR, as it is strictly necessary for important reasons of public interest and for the protection of the vital interests of persons in distress.

8. Cookie Notice

This site uses exclusively so-called “technical” cookies, used solely to carry out the transmission of a communication over an electronic network or to the extent strictly necessary to provide the requested service (cf. Art. 122(1), Legislative Decree 196/2003). No profiling cookies or third-party cookies are used. The session cookies used avoid the need for other computer techniques that could be detrimental to the confidentiality of browsing and do not allow the acquisition of personal identifying data. Any “analytics” cookies are created and used directly by the site to collect information in aggregate and anonymous form, without the involvement of third parties. Users can prevent the use of cookies by changing their browser settings.

9. Optional Nature of the Provision of Data

Apart from what is specified for browsing data, users are free to provide the personal data requested in the electronic forms. However, failure to provide the data required for beacon registration makes it impossible to enter the transmitter in the operational databases, effectively preventing the competent authorities from associating any emergency alert with the identity and contact details of the owner, and seriously compromising search and rescue operations.

10. Processing Methods

Personal data are processed by automated and non-automated means, adopting the technical and organisational measures necessary to ensure compliance with the applicable legislation. Specific security measures are observed to prevent data loss, unlawful or incorrect use and unauthorised access. The designated Processors or authorised persons receive adequate operating instructions to ensure maximum confidentiality and security, especially in the handling of e-mail flows and documents generated by the system.

11. Right to Lodge a Complaint

Data subjects who believe that the processing of their personal data infringes the GDPR have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) or with a competent supervisory authority in the Member State where they habitually reside, work, or where the alleged infringement took place.

12. Rights of Data Subjects

Data subjects have the right, at any time, to obtain from the Data Controller confirmation as to whether or not personal data concerning them are being processed and, where that is the case, to obtain access to the data (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR - without prejudice to the regulatory obligations linked to SAR operations and to retention for supervisory/legal purposes), restriction of processing (Art. 18 GDPR) and the right to object (Art. 21 GDPR).

Pursuant to Art. 37(7) GDPR, the contact details of the Data Protection Officer (DPO) are provided below:

The Director of the Satellite Station pro tempore

Email: director@cospas-sarsat-italy.it

The DPO may be contacted to exercise the above rights or for any clarification on personal data protection.

This notice may be subject to change. You are therefore advised to check this web page regularly and to refer to the most recent version of the notice published here.

Last updated: 22 October 2026