Italia Turrita Privacy Policy

11. Introduction, definitions and interpretation

In plain terms: this Policy explains, carefully and completely, what happens to your information and who is responsible for it.

1.1 This Privacy Policy (the "Policy") explains how Italia Turrita (the "Service") collects, uses, stores and deletes Personal Data, and the rights you have in respect of it. It forms part of, and shall be read together with, the Italia Turrita Terms of Service (the "Terms").

1.2 The Service is operated by a natural person domiciled in the Republic of South Africa who operates the Service, who determines the purposes and means of the processing described in this Policy and is accordingly its controller and, for the purposes of the Protection of Personal Information Act 4 of 2013 of the Republic of South Africa ("POPIA"), its responsible party. The controller is assisted by the administration of the Repubblica Italiana community. In this Policy, the controller is referred to as the "Administration", "we", "us" and "our". Because the controller is domiciled in the Republic of South Africa and operates the Service from there, POPIA applies to all of its processing. Requests concerning Personal Data may be sent by email to repubblicaitaliana-rblx@googlegroups.com, or through the Repubblica Italiana administration on the community's Discord servers. The identity of the controller is disclosed on request to any data subject or supervisory authority.

1.2A Because the Service is offered to Members in the European Union and the United Kingdom, the General Data Protection Regulation (EU) 2016/679 and the UK General Data Protection Regulation (together, the "GDPR") also apply to the processing of their Personal Data.

1.2B The controller is not established in the European Union. In accordance with Article 27 of the GDPR, the controller has designated in writing a co-owner of the Groups who is resident in Italy as its representative in the European Union (the "EU Representative"). Supervisory authorities and data subjects in the European Union may address the EU Representative, in addition to or instead of the controller, on any matter concerning the processing of Personal Data by the Service, through the contact mailbox in clause 12. The EU Representative passes every such matter to the controller without delay. The EU Representative does not take part in operating the Service; for continuity only, and on the controller's written instructions, the EU Representative holds a sealed copy of the key that protects the backup described in clause 9.1A and may suspend the Service in an emergency.

1.3 In this Policy, unless the context otherwise requires:

• (a) "Personal Data" means any information relating to an identified or identifiable natural person, and "processing" has the meaning given to it by the data protection law applicable to you;
• (b) "Controller" means a person who determines the purposes and means of processing, and "Processor" means a person who processes Personal Data on behalf of a Controller;
• (c) "Database" means the database in which the Service keeps its records, which is hosted by Cloudflare;
• (d) "Backup" means the single encrypted copy of the Database that the Service keeps in a private GitHub repository and replaces every night;
• (e) "Platforms" means Discord and Roblox;
• (f) "Member", "Linked Account", "Groups", "Porto Ercole", "Staff", "Staff Permissions", "Case" and "Dashboard" have the meanings given to them in the Terms; and
• (g) "you" and "your" refer to the person whose Personal Data is processed.

1.4 Where this Policy and the Terms conflict on any matter concerning Personal Data, this Policy shall prevail, subject always to any mandatory provision of the data protection law applicable to you.

22. Personal Data processed

In plain terms: this is everything we hold about you, and where it comes from.

2.1 The Service processes the following categories of Personal Data:

2.2 Sign-in through Discord and Roblox takes place on the Platforms' own pages. The access tokens they return are used once, to confirm your user IDs, and are not stored. We never receive your passwords. The Roblox sign-in uses PKCE: a one-time secret is kept with the sign-in state for at most 15 minutes and is deleted when it is used.

2.3 The Service does not read your messages, save for posts made in the warrant-application forum, and does not collect bank, card, tax or payment-account credentials. If the freelance development workflow is enabled, it records only the agreed fee, currency or unit, payment method, payment status/date and a non-sensitive internal receipt reference, as described in clause 2.1; an invoice likewise holds only a short receipt reference for its payment. The Service does not read the body of the emails sent to the community's mailbox (clause 5.1B). Your IP address necessarily reaches Cloudflare when your device or Porto Ercole contacts the Service. The Service does not store it: it converts it at once into a keyed one-way hash, which it holds only in memory, for a few minutes, to limit the rate of requests and to protect the Service against abuse.

2.3A The Service sends you direct messages about matters that concern you, for example a sanction, a promotion, the decision on a leave of absence, a report you made, a reminder of an event you registered for, the steps of an invoice you sent, an infraction recorded about you as Staff, or an erasure. It also counts its own use of its hosting plan; those counts contain no Personal Data.

2.4 Persons who are not Members. The Service also processes Personal Data about some persons who have not used it:

• (a) applicants who ask to join the Groups, whose join requests are checked as described in clause 4.1; and
• (b) persons whom Staff sanction, including by a ban, in the Community's Discord servers, in the Groups or in Porto Ercole, for example a Discord user who has left a server or a Roblox player who is banned from Porto Ercole.

For these persons the Service processes only the Discord user ID or the Roblox user ID and username, the join-request check or the Case (the sanction, its reason, its duration and the member of Staff who imposed it), obtained from Staff, Discord and Roblox. The legal basis is the Administration's legitimate interests in keeping the Community safe and in enforcing its sanctions (GDPR Art. 6(1)(f); POPIA s 11(1)(f)). The Service has no means of contacting these persons other than the platform on which the check or sanction takes place, and informing each of them individually would therefore be impossible or would involve a disproportionate effort (GDPR Art. 14(5)(b)). This Policy is published so that they are informed, and they have the same rights under clause 8 as Members.

33. Purposes and legal bases

In plain terms: we use your information only to run the community and keep it safe, and never for advertising.

3.1 Personal Data is processed only for the following purposes and on the following legal bases. References are to Article 6(1) of the GDPR and to section 11(1) of POPIA.

3.1A Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms, taking particular account of Members aged 16 and 17 (clause 10). We collect only what each purpose needs. We publish only the public record described in clause 5.5, which consists of the public acts of the Community's public offices, and nothing else about Members. The retention of each record is set out in clause 6, which also states plainly which records are kept without a fixed period.

3.1B The Service relies on consent in one case only. Under POPIA a person under 18 is a child, and the personal information of a child may be processed only on a ground set out in section 35(1) of POPIA. For Members aged 16 or 17, the processing described in this Policy therefore also rests on the prior consent of a competent person, namely a parent or guardian (POPIA s 35(1)(a)), which the Member confirms when they link an account or sign in to the Dashboard. A parent or guardian may withdraw that consent at any time (clause 10.3). The withdrawal does not affect the lawfulness of processing that took place before it, and leads to the removal described in clause 10.1A. For Members in the European Union and the United Kingdom, the legal bases are those in clause 3.1, and none of them is consent. In any event, 16 is the highest age that Article 8 of the GDPR allows a Member State to set for a child's consent to an online service, so that a Member aged 16 years of age or over has reached that age in every Member State and in the United Kingdom; in Italy the age is 14 (Article 2-quinquies of Legislative Decree No. 196/2003).

3.2 We do not sell Personal Data, and we do not use it for advertising or for profiling for marketing purposes.

3.3 Where processing is based on our legitimate interests, you are entitled to object to it in accordance with clause 8.

44. Automated decision-making

In plain terms: a few things happen automatically, and you can always ask a person to look at them again.

4.1 The following decisions are taken by automated means:

• (a) join requests to the Community's main group are checked against the following criteria, using public Roblox profile information and the Service's own records: the account must be at least 30 days old and hold at least 10 badges; where the Administration has set these requirements, the account must have a minimum number of friends and followers combined and must not use the default avatar; the account must not be a member of a group that the Administration has flagged; and the account must not be on the blocklist or be linked to a Discord account that is banned from the Community. A request that meets every criterion may be accepted automatically;
• (b) a join request that does not meet every criterion is referred to a human reviewer and is not declined automatically, save that, where the Administration has enabled automatic declines, a request from an account that is on the blocklist or is linked to a banned Discord account, or (where the Administration has enabled it for every criterion) any request that does not meet the criteria, is declined automatically;
• (c) join requests to the Vigili del Fuoco group are accepted automatically where the account owns the department's game pass, and are declined automatically after 48 hours where it does not; and
• (d) Staff activity that matches the misuse rules is recorded and referred to an administrator for review. Once the Administration has moved the rules from observation mode to enforcement mode, a match also blocks the action and suspends the Member's Staff Permissions within the Service until an administrator has reviewed the matter.

4.1A These decisions are made in accordance with Article 22 of the GDPR and section 71 of POPIA. Join-request checks apply only the published criteria above, and the details of a check are shown only to Staff in a Staff-only channel. A detection of possible misuse of Staff Permissions is an indication, not a finding: it is recorded with the activity that caused it, and it is reviewed by an administrator without undue delay. The Member concerned is told the case number and the outcome.

4.2 You are entitled to have any automated decision affecting you reviewed by a person, to express your point of view and to contest the decision, by contacting us in accordance with clause 12 or, for a sanction, by appealing it under clause 8.4 of the Terms. The review shall be carried out by a person who was not involved in the original decision.

55. Processors, recipients and international transfers

In plain terms: a few service providers help us run things, Discord and Roblox answer for their own platforms, and only the public acts of the community's offices are published.

5.1 Personal Data is processed on our behalf by the following Processors, each under its data processing agreement:

• (a) Cloudflare, Inc., which runs the Service and hosts the Database, which it encrypts at rest; serves the public site of the Service at italianarblx.com, including this Policy and the public record; delivers to the Service, through Cloudflare Email Routing, the emails described in clause 5.1B and, where the Administration has enabled it, sends the record emails described in clause 5.1A; and, through Workers AI, translates the interface text of the Dashboard into Italian, for which only that interface text, and no Personal Data, is sent;
• (b) GitHub, Inc., which hosts the Backup in a private repository;
• (c) Google LLC, which hosts the organisation roster spreadsheets in Google Sheets;
• (d) Resend, where the Administration uses it instead of Cloudflare Email Routing to send the record emails described in clause 5.1A; and
• (e) Atlassian, through Trello, only where the Administration has connected a Trello board, which receives the freelance development items and projects described in clause 2.1 (their names, scope, fee, due dates, deliverables and acceptance criteria, and the name or Discord user ID of the member of Staff who acted on them).

5.1A The contact mailbox in clause 12 is provided by Google LLC through Google Groups. Messages sent to it are received and held by Google under its own terms, and are read by the Administration and by the EU Representative. The same Google Group serves as the Community's records mailbox: the Service sends to it an email record of each step of an invoice (its sender's name and Roblox username, its lines and amounts, its approval, decline or payment, and the receipt reference), which Google holds with the Group's other messages.

5.1B The community inbox notice. When an email reaches the Google Group, the Group passes it to an address on the Service's domain, from which Cloudflare Email Routing delivers it to the Service. The Service reads only the sender's name and address and the subject, never the body, and sends them by Discord direct message to the two accounts authorised to configure the Service, so that the email is answered. It stores nothing about the email, apart from a count used to send at most 20 such notices an hour, and refuses any email that does not come from the Group.

5.2 Discord and Roblox are not our Processors. They are independent Controllers of the data on their own platforms, under their own privacy policies. Roblox also holds the data that Porto Ercole requires, such as bans, notices of sanctions and medals.

5.3 These providers may process Personal Data in the United States and in the other countries in which they or their sub-processors operate. Transfers from the United Kingdom and the European Union rely on the EU-US Data Privacy Framework and its UK extension where the provider is certified, and otherwise on the European Commission's standard contractual clauses together with the UK addendum. Transfers of Personal Data outside the Republic of South Africa are made under section 72 of POPIA, on the basis of binding agreements that provide an adequate level of protection.

5.4 Moderation Cases, roster changes, warrant decisions and the details of join-request checks are posted only in Staff and log channels that ordinary Members cannot see. Where a channel visible to Members shows join requests, it shows only their status. The one exception is the staff incident log: unless the Staff member who records it marks it as hidden, the log is also posted in a channel that Members can read, showing the player's name, where the incident took place, what happened, the rules broken, the action taken and the Staff member's name. The evidence, and the player's identifiers, are never shown there; they are kept with the complete record, which only Staff can read. Staff discipline records are seen only by the administration managers and by the member concerned, who is told of each infraction by direct message. The start and end of shifts, and the weekly report, are posted in a Staff channel, and the members on duty and the monthly totals of shifts are shown to the members who may use the /shift commands. A report is seen by the reporter and by the members of Staff who respond to reports; a confidential report about a member of Staff is seen only by the Owner and the administration managers. Invoices are seen in the Dashboard by the sender and the Owners.

5.4A The chambers post their business in the Discord channels that the Administration has chosen for them: the items placed on the order of the day, with their text; petitions, with their text and the petitioner's name, and their placing on an agenda; sittings scheduled, opened, closed or cancelled, with the presiding officer's name; a summary of the attendance at each sitting, which lists the Roblox user IDs of the members absent; changes to a chamber's roll; and the opening and closing of each vote with its counts. The result of each vote that is not held within a commission is also posted in the chamber's public channel, and the votes of a commission are posted only in the commissions' channel. Elections are announced, with their candidates, results, turnout and winners, in the channel chosen for them or, where none is chosen, in a Staff channel.

5.5 The public record. Save as set out in this clause, nothing about you is published on any public web page. The Service publishes, at https://italianarblx.com/record, https://italianarblx.com/record/member and https://italianarblx.com/gazette, which anyone may read without signing in, the following public acts of the Community's public offices:

• (a) the latest votes held in the Senate and the Chamber of Deputies, other than votes held within a commission: the title of the motion, the chamber, the result, the numbers for, against and abstaining, the number present, the quorum and the date and, where the chamber reported it, the roll call, which shows how each member voted under their Roblox username, with a link to their page on the record that bears their Roblox user ID;
• (b) for each member who has sat in a chamber, the number of sittings, and the number of sittings at which they were present and absent, together with, on their own page, every recorded vote they cast;
• (c) the next sitting of each chamber, with its time and the titles of the motions on its agenda;
• (d) the results of the elections that the elections commissioner has confirmed: the office, the winners, the turnout, the date of confirmation and the end of the term, without the other candidates or the number of votes of each; and
• (e) the archive of the Gazette, month by month: promotions, medals, election results, votes, warrants issued, events and verdicts. The archive shows the text of each item but not the name or identifier of the person concerned, and a verdict is published only when Staff choose to publish it, without the name of the person sanctioned.

5.5A Discord user IDs, Discord names, petitions, the text of motions, the candidates who were not elected and every other record of the Service are not published. Porto Ercole receives the Gazette items of the last seven days, with the Roblox user ID of the person concerned, to show them in the game.

5.5B The record is published because the votes, attendance and elections of the chambers are the public acts of public offices in the Community's roleplay, which a member takes on in public, and the Community has a legitimate interest in institutions that are transparent and accountable to the citizens who elect them (GDPR Art. 6(1)(f); POPIA s 11(1)(f)). You may object to the publication of your own entries under clause 8.1(d), by contacting us in accordance with clause 12. The Administration decides each objection by weighing your particular situation, in particular if you are under 18, against the interest in an accurate record, and tells you of its decision. The Service does not yet offer a way to withdraw a name automatically: where an objection is upheld, the Administration has your name replaced in the published record by hand and tells you when that has been done.

66. Retention

In plain terms: most records have their own time limit, after which they are deleted; the few that are kept without one are named plainly below.

6.1 Personal Data is retained for the periods set out below, and is deleted when they expire. Where the table states that a record is kept without a fixed period, the Service does not delete it automatically:

6.1A Each period above is the shortest that serves its purpose. The records kept without a fixed period are the history of the Community's institutions, and the Administration reviews whether they are still needed whenever it reviews this Policy. Moderation records are retained for longer than routine records because repeated behaviour can only be recognised, and sanctions enforced, with knowledge of earlier cases. Records are reviewed against these periods automatically every day; when a period ends, the record is deleted rather than archived, except where an applicable legal, tax, audit or dispute hold remains active.

6.2 Deletion from the Database is permanent. The Backup is replaced every night by a single new copy, so that erased and expired data is gone from it within 24 to 48 hours.

77. Erasure (right to be forgotten)

In plain terms: you can ask for your data to be erased whenever you wish; a few safety records stay until their time runs out, and the record of public offices and of the work of Staff stays as clauses 7.3A and 7.3B explain.

7.1 You may request erasure at any time by means of /privacy forget or the Dashboard, once in every period of 24 hours. Upon your confirmation:

• (a) your account link and the linked Discord roles are removed immediately;
• (b) you are removed from the Groups, because ranks and positions cannot be maintained without the records that manage them;
• (c) your points, positions, roster entries, staff applications and staff registry entry are deleted, and your Roblox user ID and name are removed from warrant records;
• (d) if you so choose, Porto Ercole is asked to erase your game data as well; and
• (e) you receive a direct message bearing a reference number when the process is complete, usually within minutes.

7.1A If a step of the erasure cannot be completed at once, for example because Discord, Roblox or Google is unavailable, it is retried automatically. A step that still fails is recorded, the erasure is marked as partial, your direct message says that the request is still being completed, and the Administration is alerted and has the remaining steps carried out again until they succeed.

7.2 We keep a record that the erasure took place, which does not contain your identifiers. Erased data is deleted from the Database and leaves the Backup as described in clause 6.2.

7.3 Notwithstanding clause 7.1, limited records are retained after an erasure request where necessary for legal obligations or claims. Moderation Cases, appeals, blocklist entries and misuse reviews are deleted when their retention period ends (730 days, or for as long as a ban remains in force, if longer; a blocklist entry when its ban ends). The staff activity log and join-request checks are deleted at the end of their own retention periods (90 and 30 days respectively). If the freelance development workflow is enabled, the development item, including the identities of its parties and the agreed scope, payment and rights-assignment evidence, is retained while work or a dispute remains open and then until its fixed retention period (the fixed period configured before activation from its terminal date) expires, unless an applicable legal, tax, audit or dispute hold remains active. It is then deleted automatically.

7.3A The following records are not deleted on erasure, because they are the record of the public acts of the Community's offices and of its events: the public record described in clause 5.5, including your Roblox username in it; the records of the chambers, including your motions, petitions, attendance and the roll calls of your votes; the records of elections in which you stood or were elected; the Gazette archive; and the records of events you registered for or attended. They are kept as stated in clause 6.1. Your leave-of-absence records are kept with your moderation records, as stated in clause 6.1. You may object to the publication of your entries in the public record under clause 5.5B.

7.3B Records of your work as Staff, and reports, are also not deleted on erasure: invoices are kept as evidence of the payments made and for legal claims; staff discipline records, shift records and weekly reports are kept as the record of the management of Staff; and reports that you made or that concern you are kept until the end of their retention period. Each is kept as stated in clause 6.1.

7.4 Messages already posted in Discord channels are not edited by an erasure; you may ask the Administration to remove them.

7.5 Where Roblox forwards an erasure request concerning a Porto Ercole player, Porto Ercole erases its game data and the Service erases its data concerning that Roblox account in the same manner.

7.6 After an erasure you remain welcome to link an account again and to request to rejoin the Groups.

88. Your rights

In plain terms: this information is about you, so you have a say in what happens to it.

8.1 Under POPIA (in particular sections 5, 23, 24 and 71) and, where it applies to you, the GDPR, you are entitled to:

• (a) access the Personal Data we hold about you; a summary is available at any time with /privacy view;
• (b) have inaccurate data corrected;
• (c) have your data erased, as described in clause 7;
• (d) object to, or ask us to restrict, the processing of your data, including the publication of your entries in the public record (clause 5.5B);
• (e) have an automated decision reviewed by a person, as described in clause 4.2;
• (f) receive a copy of your Personal Data on request; and
• (g) lodge a complaint with a data protection authority, in particular in the country where you live or work or where an alleged infringement took place.

8.1A The supervisory authority for the Service is the Information Regulator of South Africa (inforegulator.org.za). Members in the European Union or the United Kingdom may also complain to their own authority, including the Garante per la protezione dei dati personali in Italy (garanteprivacy.it), the Information Commissioner's Office in the United Kingdom (ico.org.uk), and the data protection authority of any other member state of the European Union in which you live.

8.2 To exercise any of these rights, contact us by email to repubblicaitaliana-rblx@googlegroups.com, or through the Repubblica Italiana administration on the community's Discord servers. We shall respond within one month, and may ask for information that confirms your identity before doing so. Exercising your rights is free of charge.

99. Security

In plain terms: access to your information is locked down and watched.

9.1 Access credentials for the Service are held in Cloudflare's encrypted secret store and are never kept in its code, in the Database or in the Backup.

9.1A The Database is hosted by Cloudflare, which encrypts it at rest. The Backup is encrypted with AES-256-GCM before it leaves Cloudflare, using a key held in Cloudflare's encrypted secret store, of which a sealed copy is kept offline for recovery. Neither GitHub nor any person with access to the repository can read the Backup without that key.

9.2 The repository that holds the Backup is private. Access to Staff functions is limited by role and monitored for misuse, and Dashboard sessions expire 12 hours after sign-in. Only the two accounts authorised to configure the Service may download a complete export of the Database, which is used solely for backup and recovery, and each such download is recorded in the staff activity log.

9.2A In the event of a breach of security that affects Personal Data, we shall assess and contain it without delay. We shall notify the competent supervisory authority, and the persons affected, where and within the time that the law requires (Articles 33 and 34 of the GDPR; section 22 of POPIA).

9.3 The Dashboard uses a strictly necessary session cookie, and a second one for at most ten minutes while you sign in, and stores in your browser your language preference, the Italian text of its interface, the currency you last chose for an invoice and, on the application forms, the answers you have not yet sent. Details are set out in the Italia Turrita Cookie Policy.

1010. Age requirements and children

In plain terms: the Service is for people aged 16 and over, and a parent or guardian must agree if you are 16 or 17. If we learn that someone is too young, or that a parent or guardian does not agree, we remove their data.

10.1 The Service is offered only to persons aged 16 years of age or over, which is the same as the age rating of the Community's experiences on Roblox. Under POPIA, a person under 18 is a child, and the personal information of a child may be processed only on a ground set out in section 35 of POPIA. For Members aged 16 or 17, the Service relies on the prior consent of a parent or guardian under section 35(1)(a) of POPIA, as described in clause 3.1B. The parental controls and consents of Roblox and Discord apply only to those platforms' own processing.

10.1A Each Member confirms, when they link an account or sign in to the Dashboard, that they are aged 16 years of age or over and, if they are under 18, that a parent or guardian agrees to their use of the Service and to the processing described in this Policy. If we learn that a Member is under 16 years of age, or that the parent or guardian of a Member under 18 does not agree or has withdrawn their agreement, Staff use the Service's under-age removal action, which unlinks their account and erases their Personal Data in accordance with clause 7. The removal is not a sanction, and the Member is not placed on the blocklist.

10.1B Porto Ercole is a Roblox experience that is subject to Roblox's own age rules. Where Staff take moderation action in Porto Ercole concerning a player who is not a Member, the Service records only the player's Roblox user ID and name and the moderation Case, as described in clause 2.4.

10.1C Positions as Staff, as a playtester or as a paid developer are held under signed agreements. Paid developer positions are open only to persons aged 18 or over; playtester and Moderation Staff positions are open to persons aged 16 or over, and a Moderation Staff applicant aged 16 or 17 needs a reference from a current member of Staff. Applicants confirm on the application form that they are 18 or over, and an application that states otherwise is not accepted.

10.2 In addition, we keep to the following safeguards:

• (a) we collect only what the Service needs;
• (b) we publish nothing about Members other than the public record described in clause 5.5;
• (c) we never use Personal Data for advertising;
• (d) Staff records stay in Staff-only channels, save for the summary of a staff incident log described in clause 5.4; and
• (e) the summary at the top of this Policy explains what we do in plain words.

10.3 A parent or guardian who believes that a person under 16 years of age has used the Service, or who does not agree, or no longer agrees, to the use of the Service by a Member under 18 in their care, may contact us in accordance with clause 12, and we shall act on the matter under clause 10.1A.

1111. Changes to this Policy

In plain terms: when this Policy changes, the date at the top changes too.

11.1 We may amend this Policy from time to time. The effective date shown at the top identifies the current version and the date on which it was published. Material changes are announced, and take effect, as set out in clause 15 of the Terms.

1212. Contact

In plain terms: questions are always welcome.

12.1 Questions about this Policy or your Personal Data, and requests to exercise your rights, may be sent by email to repubblicaitaliana-rblx@googlegroups.com, or through the Repubblica Italiana administration on the community's Discord servers. The EU Representative described in clause 1.2B may be reached in the same way.