Controller and contact details
ColivingLiguria S.r.l.
Strada Chiappella 21, 17014 Cairo Montenotte (SV), Italia
VAT number: 01939660096
What information do we collect?
The form requires organisation name and type, country, business email, contact first and last name, role, request purposes and a short description. It also records language, notice version and acknowledgement. The system links the application to your LivingRegister account identity and records dates, status, edit history and operation receipts, alongside technical access and security checks. The form cannot record an application without the required fields. Provide only information needed for the request and your own professional contact details: do not enter identity documents, health information, other special categories or other people's personal information in free text. Organisation details and declarations are not automatically verified as evidence of a mandate. When you edit an application, previous versions and receipts containing the information submitted remain in its history. Editing a field therefore does not automatically remove its former value from earlier versions. Linking an account identifies who manages an application, but does not automatically verify that every named contact or contact detail belongs to that person.
Why do we use it?
We use this information to receive, review and respond to your request about funding, partnerships, supplies, public-body collaboration or another specified context, and to let you view and correct it. Where you are personally a party to a proposed relationship, processing necessary to take the pre-contractual steps you request relies on GDPR Article 6(1)(b). If you are a contact for a legal entity, processing your professional details and correspondence relies on ColivingLiguria S.r.l.'s legitimate interest in reviewing and responding to the request you voluntarily initiate, Article 6(1)(f); you may object. The same basis supports proportionate protection against abuse and unauthorised access and strictly necessary evidence of operations or disputes. Acknowledgement is not the processing basis. An application does not authorise marketing, publication of your details, disclosure to funders or submission of a grant application: further services will have specific information and conditions.
Who can access it?
You can view applications associated with your account; authorised ColivingLiguria S.r.l. operators can manage them in the private register. The application flow uses Cloudflare Workers and the D1 database, with access from local dashboards. The register also has local operational and encrypted database recovery copies; their most recent verification predates activation of this collection. These recovery copies are excluded from generic synchronisation to GitHub and Google Drive. Replication of selected data follows a separate flow: before activating a new destination for application data, we will explain which information it receives, its purpose, who can access it and the applicable safeguards. Cloudflare processes information entrusted to the service as processor under the DPA incorporated in its service terms. Requested correspondence may use the consumer Gmail mailbox colivingliguria@gmail.com; Google applies consumer service terms and privacy information, not a project Workspace contract. European database placement does not guarantee that all processing remains in the EEA. Cloudflare’s DPA governs transfers, with the Data Privacy Framework where applicable and standard contractual clauses for transfers subject to those clauses; Google explains its consumer-service transfer mechanisms in its privacy information. You can obtain information about actual destinations and a copy or reference for the relevant safeguards from the controller. Application data is not published on the website or disclosed to funders on the basis of this acknowledgement.
For how long?
We keep an application, its previous versions and receipts during its review and related correspondence. Conclusion or withdrawal triggers a retention review: if the requested relationship, a specific obligation or a documented dispute does not continue, an operator must assess and execute erasure in the affected copies. Any further retention requires a recorded reason, scope and review; an application is not indiscriminately retained as a tax record. Withdrawal records your choice not to continue the application, but currently retains information and revisions; it does not revoke delegations or terminate separate contracts. Closing the personal account is a separate operation and does not automatically erase BusinessRegister applications. An erasure request opens a separate case: a “closed” status means administrative case closure, not proof that every copy was erased. The controller must assess the request, carry out applicable operations and tell you the outcome or the reason for any refusal or deferral. Recovery copies do not authorise renewed use of erased information: before using a restore, an operator must reapply completed erasures. D1 database history on the Free plan may cover the preceding seven days; this is not the retention period for all applications or other copies. Technical access proofs, security events, rights cases and correspondence have separate purposes and retention criteria; their existence does not make them permanent archives. Recipients’ message copies and providers’ own retention are subject to separate rules. Credentials and technical proofs cannot grant access beyond their recorded expiry; authentication attempts have a five-minute technical window. Physical removal of expired credentials requires separate maintenance: this Worker currently has no active periodic maintenance, so expiry does not itself prove removal of the records. Operators review technical proofs during maintenance and security events when an incident closes: further retention requires a recorded reason and review date. Rights cases are reviewed after the response and case closure; only evidence needed for obligations or documented disputes is retained. Correspondence is reviewed when its request or relationship concludes. Recovery copies are reviewed when their recovery set is replaced or retired: a historical copy does not authorise disregarding a later erasure. These are operational review criteria, not a statement that erasure is automatic or already completed.
How can you exercise your rights?
Contact colivingliguria@gmail.com or colivingliguria@pec.it, including without an account, for access, correction, erasure, restriction, objection and portability where applicable. Do not send sensitive information in the first message: we will request only proportionate identity checks. We normally respond within one month under the GDPR and notify you of any justified extension. You can complain to the Italian Garante per la protezione dei dati personali or the competent supervisory authority. In the private area you can edit an application while it is pending review; after a decision you may request correction from the controller. Export shows your declared applications and their history, not certified coverage of every controller archive. Receipt and technical checks do not automatically decide admission, contracts, company authority or funding. Historical acknowledgements keep their original version; a new notice does not convert them into new consents or signatures. You may also ask the controller for information about the balancing of the legitimate interests stated here. If you have closed your account or cannot sign in, use the same contact channels: exercising your rights does not require reopening an account. An access-request response may include further relevant information beyond the private-area export.