Privacy Policy

Project “Connecting Sardinian Innovation with the Swiss Ecosystem”

(pursuant to EU Regulation 2016/679 – GDPR and the Swiss Federal Act on Data Protection – FADP)

1. Data Controller

ICE - Italian Trade Commission
Trade Promotion Office of the Italian Embassy
Elfenstrasse 14, CH-3006, Bern

For any request concerning the processing of personal data or to exercise data subject rights, the Data Controller may be contacted at:
berna@ice.it

2. Data Processors

2.1 Italian Chamber of Commerce for Switzerland (CCIS)

Data Processor acting on behalf of the Region.
Dolderstrasse 62, 8032 Zürich, Switzerland.

For technical assistance relating to the application platform:
info@ccis.ch

2.2 Kickstart Innovation

Data Processor appointed by CCIS (sub-processor).
Selnaustrasse 25, 8001 Zürich, Switzerland.

Kickstart operates exclusively under the instructions of CCIS and the Region and does not act as a contact point for data subjects.

3. Categories of Personal Data Processed

3.1 Data provided through the application form

first name, last name, professional role within the startup/SME;
contact details (email address, telephone number);
optional address;
identification data (e.g., ID document or passport, if required);
information relating to the startup/SME: team composition, sector, business description, operational and financial information relating to identifiable individuals.

3.2 Technical data automatically collected during access to the form

When accessing the webpage hosting the application form, the systems providing the service automatically collect certain technical data necessary for proper functioning and security, including:

IP address;
browser, operating system and device information;
date and time of the request;
accessed URL;
server-generated technical logs.

These data are used solely for technical and security-related purposes. No profiling cookies or unnecessary tracking tools are used.

3.3 Special categories of personal data

Special categories of personal data may be processed only where strictly necessary for the project and — where required — subject to the Region’s explicit prior authorisation, as defined in the official appointment documents.

4. Purposes of Processing and Legal Bases

4.1 Management of applications

Assessment of eligibility, evaluation and selection of applicants, and related communications.
Legal bases: Article 6(1)(b) GDPR (pre-contractual measures) and Article 6(1)(e) GDPR (public interest task).

4.2 Implementation of project activities

Acceleration, mentoring, networking and support activities within the Swiss ecosystem.
Legal bases: Article 6(1)(b) and Article 6(1)(e) GDPR.

4.3 Compliance with legal obligations

Transparency, reporting, administrative controls and audits connected to the use of public funds.
Legal basis: Article 6(1)(c) GDPR.

4.4 Technical functioning and security of the platform

Management of logs and system security.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in ensuring system security).

Prohibition of processing for further purposes:
CCIS and Kickstart are not permitted to use personal data for their own or additional purposes.

5. Methods of Processing

Processing is carried out by electronic means, applying technical and organisational measures appropriate to ensuring data security.

Access to personal data is restricted to:

authorised personnel of the Region;
authorised personnel of CCIS;
authorised personnel of Kickstart;
technical service providers designated, where necessary, as processors under Article 28 GDPR and Article 9 FADP.

No decisions are made on the basis of solely automated processing that produce legal effects or significantly affect the data subject.

6. Data Transfers to Switzerland

Personal data will be processed in Switzerland, where CCIS and Kickstart are located. Switzerland is recognised by the European Commission as providing an adequate level of protection (Article 45 GDPR).

Any additional transfers to third countries will be carried out using appropriate safeguards (e.g., Standard Contractual Clauses or equivalent mechanisms).

7. Data Retention

CCIS and Kickstart may process personal data only until the end of their contractual engagement on 31 December 2026;
at the end of their activities, they must return or delete all personal data processed;
the Region retains personal data for the time necessary to fulfil legal, administrative and supervisory obligations.

8. Rights of the Data Subject

Data subjects may contact the Region at industria@regione.sardegna.it to exercise, where applicable:

right of access;
right to rectification;
right to erasure (within legal limits);
right to restriction of processing;
right to data portability;
right to object;
right to withdraw consent (where processing is based on consent).

Data subjects may lodge a complaint with:

the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali);
the Swiss Federal Data Protection and Information Commissioner (FDPIC);
any other competent EU supervisory authority.

9. Provision of Data

The provision of mandatory data is necessary for submitting the application and participating in the programme. Failure to provide such data makes it impossible to evaluate the application.

10. Updates

This Privacy Notice may be updated to reflect regulatory, organisational or technical changes.