Legal
Privacy Policy
Privacy notice pursuant to Articles 13–14 of EU Regulation 2016/679 (GDPR)
Last updated: November 2026
1. Data controller
The data controller for personal data collected through wildsos.it is:
Stefanello Enrico
Vigonza, Padova, Italy
Email: info@wildsos.it
For any privacy matter write to the address above. No DPO has been appointed because the processing does not fall under Article 37 GDPR.
2. Data processed and purposes
Using WildSOS to look up an animal and the nearest centre requires no account and no personal data. The processing below only concerns the features you choose to use.
2.1 Browsing and statistics (Vercel Analytics)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Pages visited, device type, country; clicks on the "Call" button (with the centre ID and name, nothing else) | Anonymous statistics to improve the service and count calls to centres | Legitimate interest — Art. 6.1.f GDPR | Aggregated data, no individual profiles |
- Data
- Pages visited, device type, country; clicks on the "Call" button (with the centre ID and name, nothing else)
- Purpose
- Anonymous statistics to improve the service and count calls to centres
- Legal basis
- Legitimate interest — Art. 6.1.f GDPR
- Retention
- Aggregated data, no individual profiles
Vercel Analytics works without cookies and does not follow you across sites or sessions. The public call counter is an aggregate number: it does not record who called. Like any hosting provider, Vercel processes technical connection data (IP, user agent) to deliver and protect the service.
2.2 Location and maps
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| GPS coordinates or typed city/postcode; IP address and viewed area when maps are loaded | Show the nearest centres and maps | Consent — Art. 6.1.a GDPR (browser location permission, revocable at any time); for maps, legitimate interest — Art. 6.1.f | GPS coordinates never leave your device and are not sent to WildSOS servers |
- Data
- GPS coordinates or typed city/postcode; IP address and viewed area when maps are loaded
- Purpose
- Show the nearest centres and maps
- Legal basis
- Consent — Art. 6.1.a GDPR (browser location permission, revocable at any time); for maps, legitimate interest — Art. 6.1.f
- Retention
- GPS coordinates never leave your device and are not sent to WildSOS servers
City or postcode search sends only the typed text to Nominatim (OpenStreetMap Foundation). Maps are loaded from OpenStreetMap servers: to do so your browser tells them your IP address and the area you are viewing. The site does not use Google Maps; the "Directions" buttons open Google Maps only if you click them.
2.3 Security and abuse prevention
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| IP address, stored only as a cryptographic fingerprint (HMAC) together with a request count | Limit submissions from forms, newsletter and call clicks to prevent spam and abuse | Legitimate interest (service security) — Art. 6.1.f GDPR | From 30 minutes to 24 hours depending on the form, then automatically deleted |
- Data
- IP address, stored only as a cryptographic fingerprint (HMAC) together with a request count
- Purpose
- Limit submissions from forms, newsletter and call clicks to prevent spam and abuse
- Legal basis
- Legitimate interest (service security) — Art. 6.1.f GDPR
- Retention
- From 30 minutes to 24 hours depending on the form, then automatically deleted
2.4 Reporting a new rescue centre
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Centre details (name, address, phone, email, website, hours, species, notes). Optional: your email, for a confirmation of receipt | Verify and add centres to the map; confirm receipt | Legitimate interest — Art. 6.1.f (centre data); consent — Art. 6.1.a (your email, given voluntarily) | 12 months from the outcome, then the report is deleted. Data of an approved centre stays published as a centre page (see section 3). Your email is not stored: it is only used to send the confirmation |
- Data
- Centre details (name, address, phone, email, website, hours, species, notes). Optional: your email, for a confirmation of receipt
- Purpose
- Verify and add centres to the map; confirm receipt
- Legal basis
- Legitimate interest — Art. 6.1.f (centre data); consent — Art. 6.1.a (your email, given voluntarily)
- Retention
- 12 months from the outcome, then the report is deleted. Data of an approved centre stays published as a centre page (see section 3). Your email is not stored: it is only used to send the confirmation
2.5 Reporting incorrect centre data
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Report type, centre ID, optional note | Keep centre data correct | Legitimate interest — Art. 6.1.f GDPR | 12 months, then deleted |
- Data
- Report type, centre ID, optional note
- Purpose
- Keep centre data correct
- Legal basis
- Legitimate interest — Art. 6.1.f GDPR
- Retention
- 12 months, then deleted
2.6 Post-emergency feedback
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Outcome (helpful yes/no), optional rating, centre ID, optional note. No identifying data | Understand whether the service helped and improve it | Legitimate interest — Art. 6.1.f GDPR | 24 months, then deleted; only aggregate counts remain |
- Data
- Outcome (helpful yes/no), optional rating, centre ID, optional note. No identifying data
- Purpose
- Understand whether the service helped and improve it
- Legal basis
- Legitimate interest — Art. 6.1.f GDPR
- Retention
- 24 months, then deleted; only aggregate counts remain
In the optional note do not write personal data about yourself or others.
2.7 Newsletter
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address, subscription and confirmation dates | Send you updates, guides and WildSOS news | Consent — Art. 6.1.a GDPR, with double opt-in (confirmation email) | Until you unsubscribe. Unconfirmed sign-ups are deleted after 7 days |
- Data
- Email address, subscription and confirmation dates
- Purpose
- Send you updates, guides and WildSOS news
- Legal basis
- Consent — Art. 6.1.a GDPR, with double opt-in (confirmation email)
- Retention
- Until you unsubscribe. Unconfirmed sign-ups are deleted after 7 days
Every email contains a link to unsubscribe immediately and permanently. Emails are sent via Resend.
2.8 Centre accounts (rescue centre operators)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, password (handled by Firebase Authentication, never readable by WildSOS), centre and role | Authentication and management of the centre page | Performance of the requested service — Art. 6.1.b GDPR | Until account deletion on request. Used or expired invitations are deleted after 30 days |
- Data
- Name, email, password (handled by Firebase Authentication, never readable by WildSOS), centre and role
- Purpose
- Authentication and management of the centre page
- Legal basis
- Performance of the requested service — Art. 6.1.b GDPR
- Retention
- Until account deletion on request. Used or expired invitations are deleted after 30 days
Account data is accessible only to the operator and the WildSOS administrator.
2.9 Centre access requests
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, selected centre | Verify identity and send the access invitation | Request of the data subject / pre-contractual steps — Art. 6.1.b GDPR | 90 days from the request, then deleted |
- Data
- Name, email, selected centre
- Purpose
- Verify identity and send the access invitation
- Legal basis
- Request of the data subject / pre-contractual steps — Art. 6.1.b GDPR
- Retention
- 90 days from the request, then deleted
2.10 Donations (Stripe)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Payment data (processed by Stripe), amount, optional email | Process the voluntary donation | Performance of a contract — Art. 6.1.b GDPR | As required by tax and accounting law (up to 10 years) |
- Data
- Payment data (processed by Stripe), amount, optional email
- Purpose
- Process the voluntary donation
- Legal basis
- Performance of a contract — Art. 6.1.b GDPR
- Retention
- As required by tax and accounting law (up to 10 years)
WildSOS never sees or stores card data: you enter it directly on a secure Stripe page. WildSOS only receives the confirmation and the amount.
2.11 Telegram bot (@soswild_bot)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Telegram chat ID, message text, location (only if you send it) | Answer your rescue request and show the nearest centres | Your request and explicit consent by voluntarily sending the message and location — Art. 6.1.a and 6.1.b GDPR | Conversation state: 30 minutes in temporary memory, not saved to a database |
- Data
- Telegram chat ID, message text, location (only if you send it)
- Purpose
- Answer your rescue request and show the nearest centres
- Legal basis
- Your request and explicit consent by voluntarily sending the message and location — Art. 6.1.a and 6.1.b GDPR
- Retention
- Conversation state: 30 minutes in temporary memory, not saved to a database
Conversations are not recorded by WildSOS. The Telegram platform is governed by the Telegram privacy policy; Telegram is an independent controller.
2.12 Search for animals without a sheet
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| The text you type in the search when we find no sheet (not your IP or any other data) | Work out which animal you found and show general guidance; know which sheets to write first | Legitimate interest — Art. 6.1.f GDPR | 12 months from the last search, then deleted. Only the text and a counter are kept, nothing identifying who searched |
- Data
- The text you type in the search when we find no sheet (not your IP or any other data)
- Purpose
- Work out which animal you found and show general guidance; know which sheets to write first
- Legal basis
- Legitimate interest — Art. 6.1.f GDPR
- Retention
- 12 months from the last search, then deleted. Only the text and a counter are kept, nothing identifying who searched
To recognise the animal the text is sent to iNaturalist from our server: iNaturalist receives neither your IP address nor any other information about you. Do not type personal data in the search.
3. Rescue centre data published on the site
WildSOS publishes the contact details of wildlife rescue centres (name, address, phone, email, website, hours, species handled). These are generally organisation data, but may include personal data, for example the number of a volunteer or of a sole trader. We inform you here because we did not collect them directly from you (Art. 14 GDPR).
- Sources: public directories (such as elencocras.it), centres' official websites, reports from citizens and data entered by centres themselves in their private area.
- Purpose: let people who find a wild animal in distress quickly contact the right centre.
- Legal basis: legitimate interest — Art. 6.1.f GDPR (interest in protecting wildlife and the safety of animals and people).
- Retention: while the centre is active and the data remain accurate.
- Correction and removal: write to info@wildsos.it stating the centre and the data. If you run a centre you can also edit the data from the private area (request access on this page). Your personal data are removed or hidden without delay unless there is an overriding legitimate reason to keep them.
4. Recipients and transfers outside the EU
To provide the service we use the following providers (processors):
| Provider | Service | Location | Transfer safeguards |
|---|---|---|---|
| Google LLC (Firebase: Firestore and Authentication) | Database and authentication | USA | Standard Contractual Clauses (SCCs) — Art. 46 GDPR |
| Vercel Inc. | Hosting and Vercel Analytics | USA | Standard Contractual Clauses (SCCs) — Art. 46 GDPR |
| Resend, Inc. | Transactional emails and newsletter | USA | Standard Contractual Clauses (SCCs) — Art. 46 GDPR |
| Stripe, Inc. | Donation payments | USA | Standard Contractual Clauses (SCCs) — Art. 46 GDPR |
| Telegram Messenger Inc. | Rescue bot (independent controller) | USA/other | Subject to Telegram's terms; the bot is optional |
| OpenStreetMap Foundation | Maps (tiles) and city/postcode search (Nominatim) | United Kingdom | Adequacy decision — Art. 45 GDPR |
| iNaturalist (California Academy of Sciences and National Geographic Society) | Recognising the name of an animal | USA | Receives only the searched text, sent by our server: no personal data of the user |
- Provider
- Google LLC (Firebase: Firestore and Authentication)
- Service
- Database and authentication
- Location
- USA
- Transfer safeguards
- Standard Contractual Clauses (SCCs) — Art. 46 GDPR
- Provider
- Vercel Inc.
- Service
- Hosting and Vercel Analytics
- Location
- USA
- Transfer safeguards
- Standard Contractual Clauses (SCCs) — Art. 46 GDPR
- Provider
- Resend, Inc.
- Service
- Transactional emails and newsletter
- Location
- USA
- Transfer safeguards
- Standard Contractual Clauses (SCCs) — Art. 46 GDPR
- Provider
- Stripe, Inc.
- Service
- Donation payments
- Location
- USA
- Transfer safeguards
- Standard Contractual Clauses (SCCs) — Art. 46 GDPR
- Provider
- Telegram Messenger Inc.
- Service
- Rescue bot (independent controller)
- Location
- USA/other
- Transfer safeguards
- Subject to Telegram's terms; the bot is optional
- Provider
- OpenStreetMap Foundation
- Service
- Maps (tiles) and city/postcode search (Nominatim)
- Location
- United Kingdom
- Transfer safeguards
- Adequacy decision — Art. 45 GDPR
- Provider
- iNaturalist (California Academy of Sciences and National Geographic Society)
- Service
- Recognising the name of an animal
- Location
- USA
- Transfer safeguards
- Receives only the searched text, sent by our server: no personal data of the user
Transfers to the USA rely on the safeguards in Art. 46 GDPR. Data is never sold or used for advertising.
5. Cookies and local storage
WildSOS does not use profiling, advertising or third-party cookies. It only uses technical tools, which do not require consent:
- `NEXT_LOCALE` cookie (session): remembers the chosen language (Italian/English).
- Browser storage (`localStorage`): remembers that you dismissed the prompt to install the app.
- Session storage (`sessionStorage`): avoids showing the survey more than once per visit.
- Firebase authentication: only for operators who sign in to the private area; keeps the login session.
- Service Worker and cache: store some pages and the centre list on your device for offline use. They are not sent to third parties.
6. Your rights
Under Articles 15–22 GDPR you have the right to:
- Access (Art. 15): obtain confirmation of processing and a copy of your data
- Rectification (Art. 16): correct inaccurate or incomplete data
- Erasure (Art. 17): request deletion of your data
- Restriction (Art. 18): limit processing in certain cases
- Portability (Art. 20): receive your data in a structured format
- Objection (Art. 21): object to processing based on legitimate interest
- Withdrawal of consent: at any time, without affecting prior processing
To exercise them write to info@wildsos.it. We reply within 30 days (Art. 12 GDPR). You may also lodge a complaint with the Italian Data Protection Authority (Garante) — www.garanteprivacy.it.
7. Minors
WildSOS does not knowingly collect personal data from people under 16. If we detect any, we delete it without delay.
8. Updates to this notice
We may update this notice, for example for new services or legal changes. The date of the latest update is shown at the top of the page.