Privacy policy

In brief

• The public site uses no cookies, no analytics or tracking tools, and no third-party resources.
• In the members' area the content (papers, minutes, treasury, files) is encrypted end-to-end in the browser: the server keeps ciphertext that it cannot read.
• During an online session too, the video and audio of those present are encrypted end-to-end (high privacy): what reaches our media server are opaque envelopes, which it routes without being able to open them, and they are not recorded. The server still sees only the metadata of the room (who is connected, the times, who is speaking); the detail, including the case of browsers that are too dated, is further below.
• The server keeps neither the name nor the email of members: the working identity is a pseudonym.
• No marketing, no profiling, no artificial intelligence in the product.

Data controller

The data controller is the Italian sole proprietorship that runs the service (hereinafter also the Provider), reachable at info@adogma.it: the full identifying details (name, registered office and VAT number) are given to anyone who requests them at that address and are always stated in the contractual documents. The controller has not appointed a data protection officer (DPO): the appropriateness of such an appointment, given the nature of the data processed by the lodges, is under assessment with legal counsel.

Two distinct roles: when we are the controller and when we are the processor

• Adogma as controller. For the public site, for requests received by email and for the contractual and administrative relationship with client lodges (activation, billing, support), the data controller is the Provider.
• The lodge as controller, Adogma as processor. For the data processed by each lodge in its own members' area (data of members and candidates), the controller is the lodge, or the body that represents it; the Provider processes it as data processor pursuant to art. 28 GDPR, on the basis of the agreement that forms part of the service contract.

In practice: for what happens inside your lodge the first point of contact is the lodge itself, which is the only one able to read the content.

Public site: no collection

Merely visiting the public site involves no collection of personal data on our part: no cookies, no forms, no newsletter, no resources loaded from third parties. The infrastructure records the minimal technical logs of requests (IP address, requested resource, date and time) needed for security and diagnostics, kept for the time strictly necessary for these purposes. Anyone who writes to us at info@adogma.it shares the data they choose to share with us: we use it only to reply.

Members' area: what we cannot read

The content of the members' area is encrypted end-to-end in the browser of the person who writes it, with keys that we do not hold. We cannot read, and therefore do not process in the clear:

• members' name and email address: they simply do not exist on the server;
• the body of papers, minutes and archive documents;
• the treasury: amounts, descriptions, payments and personal positions;
• who holds which office, the membership record and the dates of the journey;
• the files of candidates (name, contact, interview notes);
• the library catalogue and loans, schedule entries.

The online session now falls within this perimeter too: the video and audio of those present are encrypted end-to-end with high privacy and the media server routes them without being able to open them (see below, "Online sessions"). The metadata of the room stays visible and, if a browser is too dated for live encryption, that stream falls back to the clear and the room declares it to everyone.

Members' area: what we do process (metadata)

To make the service work, the server processes some metadata, which remains personal data (pseudonymised, not anonymous) and is protected as such:

• an opaque username generated by the system (never chosen, not derived from real data) and the sign-in credential in non-reversible form;
• membership of the lodge with role, degree and status of the journey;
• the title, summary and labels of papers, in the clear to allow searching;
• attendance at meetings, when the lodge chooses to record it;
• the operation logs (who did what and when, identified by the username), for security and traceability;
• the existence and status of proceedings (for example how many candidacies are open), never their content.

The members' area uses only essential technical cookies (session and request protection), with no tracking purpose: this is why no consent banner is required. The unlocked encryption keys live only in the browser's memory and are wiped on closing or on inactivity.

Online sessions: the video and audio stream

A lodge can hold a session by video call as well, in a virtual room, in addition to in person: it is scheduled from the calendar like an ordinary session and the room opens shortly before the appointed time. Those who take part turn on their own webcam and microphone, and image and voice are personal data: their processing must be stated frankly, because here the line of what we can see shifts.

• Like papers, minutes and the treasury, the video and audio of an online session too are encrypted end-to-end on the devices of those present (high-privacy profile): the key of the meeting is born and stays on their browsers, and what reaches our media server are opaque envelopes. The server routes the encrypted streams in real time, so that each may see and hear the others, without being able to read their content.
• The stream is neither recorded nor kept: it ends with the sitting. The media server conveys it in the moment, it does not store it.
• The media infrastructure is ours and self-hosted (a routing server of ours, known as an SFU), on the same European infrastructure as the rest of the service: no third-party video-conferencing provider is involved.
• The entrance is guarded: a digital Tyler welcomes at the door and admits or turns away (the vetting stays a human act in real time), with no self-admission. The name under which one appears in the room is assigned by the Tyler at the door and does not travel in the technical connection token; during the sitting the media server knows only which ephemeral connections are connected and conveys their streams.
• The very fact that a session is held online, and the coordinates of the room, live in the encrypted data of the summons: the server does not know which meetings take place online.

Legal basis: performance of the service contract (art. 6, par. 1, lett. b) for the Provider, which conveys the encrypted stream as processor to the extent that the lodge chooses to hold the session online; for the lodge, as controller, the video and voice of those present at a session fall within the special categories of data (art. 9), processed in the context of the associative life of its own members. There is no recording. The real-time stream is encrypted end-to-end (high-privacy profile): the media server routes opaque envelopes that it cannot read. Encryption hides the content, not the metadata (who is connected, with temporary identifiers, the times, who is speaking); and it requires a recent browser: if someone uses a browser that is too dated, their stream falls back to the clear and the room declares it to everyone, so that no one believes protected what at that moment is not.

Special categories of data (art. 9 GDPR)

Membership of a lodge may reveal philosophical beliefs and therefore falls within the special categories of data. This data is processed by each lodge, as controller, within the safeguards provided for associations with a philosophical aim with reference to their own members (art. 9, par. 2, lett. d); the Provider processes it as processor, with the technical measures described on this page, and does not disclose it to third parties. The precise classification is under legal review.

Purposes and legal bases

• provision of the service and management of accounts: performance of the contract (art. 6, par. 1, lett. b);
• carrying out the online sessions chosen by the lodge (real-time, unrecorded transmission of the video and audio of those present): performance of the contract (art. 6, par. 1, lett. b);
• administration, billing and tax obligations: legal obligation (art. 6, par. 1, lett. c);
• security of the platform, prevention of abuse and operation logs: legitimate interest (art. 6, par. 1, lett. f);
• responding to requests received by email: pre-contractual measures or legitimate interest.

We do no marketing, we do not profile, we do not sell data, we make no automated decisions about people and we do not use data to train artificial intelligence systems.

Retention and deletion

• accounts and metadata of the members' area: for the duration of the contract with the lodge;
• online sessions: the video and audio stream is neither recorded nor kept, it ends with the sitting;
• on termination: a read-only window for exporting the archive (30 days, unless otherwise agreed), then the destruction of the keys (crypto-shredding) makes the encrypted content permanently unreadable;
• backups: encrypted, kept for 30 days; a deleted piece of data may therefore survive in the copies for up to 30 days before disappearing from there too;
• candidacies: unfavourable outcomes and withdrawals are deleted 6 months after the outcome; on admission the file is deleted at the same time;
• contractual and tax data: 10 years, as required by law;
• operation logs: kept for security purposes; the precise duration is being defined with legal counsel.

Where the data resides and who helps us process it

The data resides in the European Union: data centres in Frankfurt (Germany) for the service and Amsterdam (Netherlands) for the backups. The infrastructure is provided by DigitalOcean, appointed as sub-processor; since the group is based in the United States, any transfers outside the EU take place with the safeguards provided by the GDPR (standard contractual clauses and applicable adequacy decisions): this point too is under legal review. There are no other providers: the site and the members' area load no third-party resources and there is no email-sending provider.

Rights of the data subject

The GDPR grants the rights of access, rectification, erasure, restriction, objection and portability (artt. 15-22), as well as the possibility of lodging a complaint with the supervisory authority (Garante per la protezione dei dati personali, garanteprivacy.it). How to exercise them here:

• for the data processed inside your own lodge (including the files of candidates): contact the lodge, which is the controller of it and the only one able to read the content; export of the archive is available in the members' area;
• for everything else: write to info@adogma.it; each member can also export their own metadata from the Profile and correct their own display name themselves.

A limit stated frankly: the Provider cannot read or single out the encrypted content, so for that, access and portability necessarily go through the lodge. Deleting a person revokes every access, removes their cryptographic material and neutralises the credential; the operation logs remain, for security, with the historical pseudonym alone.

Security measures

End-to-end encryption in the browser with keys that we do not hold; no name or email on the server; database not reachable from the internet; encrypted backups kept in a separate region; operation logs that cannot be altered; support access that is limited and traced. We do not promise the impossible: no system is absolutely secure, but this one is built so that a compromise of the server exposes as little as possible. The real-time stream of online sessions too is encrypted end-to-end (high privacy): the media server conveys opaque envelopes that it cannot read and does not record them. Only the metadata of the room stays exposed, and a browser too dated for live encryption makes that stream fall back to the clear, with a notice declared to everyone in the room (see "Online sessions").

Minors

The service is intended for adults.

Updates

This policy may change as the service or the rules change: the version published here, with the date at the top, is the one in force.