Personal Data Processing Information Notice

This page describes the management methods of the website with reference to the processing of personal data of users who consult it and use the services integrated therein. This privacy notice is provided pursuant to Art. 13 of EU Regulation 2016/679 (GDPR) and Legislative Decree No. 196/2003 (Personal Data Protection Code) to those who interact with the web services of the site.

This information notice applies exclusively to the website www.cospas-sarsat-italy.it and not to any other websites that may be consulted by the user via links present on the site.

1. Data Controller

Following consultation of this site and use of its forms, data relating to identified or identifiable persons may be processed. The "Data Controller" is the Italian Cospas Sarsat Satellite Station – Lungomare Starita, 5 – 70132 Bari, Italy.

2. Place of Data Processing

The processing operations connected to the web services of this site take place at the Italian Cospas Sarsat Satellite Station – Lungomare Starita, 5 – 70132 Bari, Italy, and are handled solely by personnel authorized to process data, under the direct authority of the Data Controller, for the provision of services and site maintenance operations.

3. Purposes of Processing

The personal data provided by users are used for the following purposes:

  - To allow navigation on the website and obtain anonymous statistical data on its use.

  - To enable the generation and submission of the emergency transmitter registration form to the National Database.

  - To guarantee the operational readiness of the Search and Rescue (SAR) system through the sharing of vital information in the event of beacon activation.

  - To manage requests for information material or communications sent voluntarily by users.

  - To comply with legal, regulatory, or statutory obligations under national or European Union law, as well as to respond to formal requests from administrative supervisory and control bodies or judicial and law enforcement authorities.

4. Data Retention Period

Data are retained for the period strictly necessary to achieve the purposes for which they were collected:

    Navigation data: Deleted immediately after statistical processing or retained for a few days (except in cases where assessment of computer crimes is required or upon request by supervisory bodies/Judicial Authorities).

    Beacon registration data: Considering the fundamental purpose of safeguarding human life, personal and technical data transmitted via the registration form will be retained for the entire operational life cycle of the transmitter. Following a formal request for cancellation or notification of decommissioning/transfer of ownership of the device, the data will be retained only for the technical time necessary to update operational databases (not exceeding 30 days), after which they will be permanently archived or deleted in accordance with SAR legal provisions and legal obligations regarding administrative retention and record-keeping.

5. Types of Data Processed

    A. Navigation Data: The IT systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This category includes IP addresses, domain names, URI addresses of requested resources, time of request, method used to submit the request to the server, and other parameters relating to the user's operating system.

    B. Data provided voluntarily via the registration form: Through the completion of the dedicated web form, personal and contact details of the owner/operator, emergency contact information, and technical details of the device (e.g., 15 or 23-character Hex ID protocols for ELT, EPIRB, or PLB beacons) including identifying data of the associated craft/vehicle are processed.

6. Legal Basis for Processing

Completing the form facilitates the creation of the registration card and its subsequent submission for inclusion in the 406 MHz National Transmitter Database. The processing of these data is not based on simple consent, but rather on:

    The performance of a task carried out in the public interest (Art. 6, par. 1, letter e of the GDPR);

    The necessity to protect the vital interests of the data subject or of another natural person (Art. 6, par. 1, letter d of the GDPR) within Search and Rescue (SAR) operations;

    Compliance with legal and supervisory obligations to which the Data Controller is subject (Art. 6, par. 1, letter c of the GDPR).

7. Data Recipients, Communication, and International Transfer (Extra-EU)

To ensure the effectiveness of the emergency service and compliance with legal obligations, collected personal data may be communicated to the following recipients:

    Administrative supervisory and control bodies, Judicial Authorities, Law Enforcement, and competent Public Administrations, where disclosure is required by law, necessary for the exercise of inspection and oversight functions, or expressly requested by such entities within their institutional mandate.

    National and international Search and Rescue (SAR) Authorities, in the event of transmitter activation or for operational readiness purposes. This involves entering data into the International Cospas-Sarsat Database (IBRD) and its potential accessibility by rescue coordination centers (SPOCs and RCCs) located worldwide, including countries outside the European Economic Area (Extra-EU). Such Extra-EU transfers take place pursuant to derogations under Art. 49, par. 1, letters d) and e) of the GDPR, as strictly necessary for important reasons of public interest and the protection of vital interests of persons in distress.

8. Cookie Policy

This site exclusively uses "technical" cookies, used solely for the purpose of carrying out the transmission of a communication over an electronic communications network, or to the extent strictly necessary to provide the service requested (cf. Art. 122, par. 1 of Legislative Decree 196/2003). Profiling cookies or third-party cookies are not used. Session cookies avoid resorting to other IT techniques potentially prejudicial to the confidentiality of navigation and do not allow the acquisition of identifying personal data. Any "analytical" cookies are generated and used directly by the site to aggregate anonymous statistical information without third-party intervention. Users can prevent cookie usage by adjusting browser settings.

9. Optional Provision of Data

Apart from what is specified for navigation data, users are free to provide personal data contained in the electronic forms. However, failure to provide data required for beacon registration makes it impossible to insert the transmitter into operational databases, preventing competent authorities from linking an emergency alert to the owner's identity and contacts, thereby severely compromising search and rescue operations.

10. Processing Methods

Personal data are processed using automated and manual tools, adopting technical and organizational measures necessary to ensure compliance with applicable legislation. Specific security measures are observed to prevent data loss, unlawful or incorrect use, and unauthorized access. Designated Processors or authorized personnel receive adequate operational instructions to ensure maximum confidentiality and security, especially in managing email flows and documents generated by the system.

11. Right to Lodge a Complaint

Data subjects who believe that the processing of personal data concerning them violates the GDPR have the right to lodge a complaint with the Data Protection Authority (Garante per la Protezione dei Dati Personali) or with a competent supervisory authority in the EU Member State of their habitual residence, place of work, or place of the alleged infringement.

12. Data Subject Rights

Data subjects have the right at any time to obtain confirmation from the Data Controller as to whether or not personal data concerning them are being processed, and to obtain access to the data (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR – subject to legal obligations related to SAR operations and statutory retention for supervisory/legal purposes), restriction of processing (Art. 18 GDPR), and the right to object (Art. 21 GDPR).

Data Protection Officer (DPO):

Pursuant to Art. 37, par. 7 of the GDPR, contact details for the Data Protection Officer are provided below:

The Director of the Satellite Station pro-tempore

Email: director@cospas-sarsat-italy.it

This privacy notice may be subject to changes. Therefore, it is recommended to regularly check this web page and to consider the most up-to-date version of the notice posted here.

The DPO can be contacted to exercise the aforementioned rights or for any clarification regarding the protection of personal data.

Updated on July 31, 2026.