PRIVACY NOTICE FOR COURSES
ISTUD is committed to protecting and respecting your privacy. With this Privacy Notice we want to tell you how we may use your personal data and how we protect them, according to the General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR) and the Italian Legislative Decree 196/2003.
A. Data Controller
ISTUD s.r.l., Sede legale: Via Pietro Giannone, 9 – 20154 Milano.
E-mail contact for GDPR issues: [email protected].
B. Purposes of personal data uses and legal basis
We may use your personal data without your consent, for the following purposes based on the legal grounds set forth hereunder:
1. Legal and Contractual purposes
a- art. 6 para 1.b GDPR: data processing which are necessary for the performance of the contract to which you are part or in order to take steps at your request prior to entering into the contract, e.g.: communications from our secretariat or adminisration offices; selection procedure, when provided in the Course admission regulation; provision of the services required; management of claims and litigation; etc.
b- art. 6 para 1.c GDPR: data processing which are necessary to comply with any legal obligations to which we are subject, e.g.: tax obligations;
c- art. 6 para 1.f GDPR: data processing based on our legitimate interests to manage and control our organization and business, which not override your interests or fundamental rights and freedoms. This includes e.g. the use and retention of your data for internal planning, accounting, audits, statistical processing, etc.;
d- art. 6 para 1.b GDPR: to draw up your psychological profile through aptitude tests and interviews, in order to evaluate your eligibility to the Course, only when this is expressely provided in the Course admission regulation. Your psychological profile will be drawn up and processed by authorised subjects;
e- some Courses should require the completion of questionnaires managed on an anonymous basis by authorized subjects; data collected through that questionnnaires are nameless and they not allow the identification of the person who compiles a specific questionnaire. These data are excluded from the application of the Regulation GDPR.
Your refusal to provide to us your data for the purposes from 1.a to 1.e above will make it impossible to conclude the contract or provide the services requested by you.
2. Proposal of similar services, based to art. 130 of Italian Legislative Decree no. 196 of 30 giugno 2003. We may use your email you provided to us to inform you about further our initiatives, products or services of a similar nature of the present one (e.g. new courses, workshops, meetings with our Partner and Clients, ecc.). You can inform us at any time if you no longer interested in receiving these information.
Your request to avoid the usage of your email for such purposes does not prejudice the conclusion of the contract nor the provision of services; it just implies the impossibility of accomplishing the purposes illustrated.
3. Other purposes based on your consent, art. 6 para 1.a GDPR
a) Marketing and public relations: we may use the your personal data to send you e-mail notifications (e.g. about our new courses and events); send you our email newsletters and magazines; send you marketing communications relating to our business which we think may be of interest to you; spread our promotional materials; perform market survey. For this purpose we may process your contact details you provided to us (e.g. home or job address, e-mail, phone number, fax number, social media contacts, etc.) and the processing could be carried out by automated means. Be aware that without your consent, we may only send you e-mail notifications about our courses, products or services of a similar nature of the present one, as per Point 2 above;
b) Customer Satisfaction survey: survey of your satisfaction about the products and services received by ISTUD that could be realised by authorised subjects after the completion of the Course. Our surveys may include phone interviews and sending questionnaires at the contact details given by you (e.g. home or job address, e-mail, phone number, social media contacts, etc.);
c) Transmission to interested subjects or dissemination of your curriculum vitae and/or of the outputs you produced by participating to specific projects during the Course (e.g. Project Works), for teaching purposes and to agevolate the opportunity to connect with Companies. Data and documents will never be used in contexts that could jeopardize the personal dignity and the dignity of the person involved;
d) Alumni Yearbooks. Preparation and publication of our Alumni yearbooks; publication may be done using internet channels (e.g. our website, the online platforms of the Course, social media) and other means (e.g. our catalogues and other publications);
e) Other publications. Publication of photos and/or videos taken during the Course; publication may be done using internet channels (e.g. our website, the online platforms of the Course, social media) and other means (e.g. our catalogues). It should be noted that these images will never be used in contexts that could jeopardize the personal dignity and decorum of the subjects recorded. Your consent to this purpose shall also constitute a full and final release pursuant to Articles 10 and 320 of the Italian Civil code and Articles 96, 97 of the Italian Law No. 633 of 22 April 1941 (Copyright Law). Your consent to this purpose shall not give rise to any claims for remuneration.
You can express your choice by ticking the dedicated check-boxes in the registration form.
Your refusal to one or more of the data processing described here above from 3.a) to 3.e) does not prejudice the conclusion of the contract nor the provision of services; it just implies the impossibility of accomplishing the purposes illustrated.
C. Retention period of your personal data
ISTUD will retain your psychological profile with the only purpose of managing any claims; it will be erased from our archives and destroyed only after your written request. Any other personal data will be retained by ISTUD to the extent necessary and sufficient for the accomplishment of all contractual and legal obligations, to inform you about our initiatives and to proceed with the additional treatments authorized by you.
D. Recipients or categories of recipients of your personal data ISTUD may share or communicate your data internally and with third parties where necessary for purposes of the processing outlined in this Privacy Notice. ISTUD may share or communicate your data with the following subjects:
– Public Authorities according to relevant laws;
– Our employees of commercial, marketing, administration & finance, secretariat offices;
– Members of our Faculty and other external service providers and parties that are necessary for the provision of the service;
– External service providers in charge of specific activities which are necessary to us to comply with legal obligations to which we are subject or to pursue our legitimate interests to manage and control our organization and business. They includes: banks, accountants, lawyers, ICT service providers, debt collection agencies, auditors, other experts and consultants;
– Organization which are interested in evaluating your curriculum vitae and/or your outputs, as described above at point B.3.c, if you give your consent to process your data for such purpose.
– External service providers in charge of specific activities for the purposes described above at point B.3, if you give your consent to process your data for such purposes. We remember you that if you consent to the purposes stated above at point from B.3.c to B.3.e, your data will be disseminated throug internet or other publications.
E. Your data protection rights
Under GDPR, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.
– Your right to withdraw your consent at any time (art. 7, para 3 GDPR). The withdrawal of consent shall not affect the lawfulness of processing based on consent before the withdrawal.
– Your right of access (art. 15 GDPR). You have the right to obtain from us confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access your personal data and ask to us a copy of your personal data.
– Your right to rectification (art. 16 GDPR). You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
– Your right to erasure (art. 17 GDPR). You have the right to ask us to erase your personal information in certain circumstances (“right to be forgotten”).
– Your right to restriction of processing (art. 18 GDPR). You have the right to ask us to restrict the processing of your information in certain circumstances.
– Your right to data portability (art. 20 GDPR). This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.
– Your right to object to processing (art. 21 GDPR). You have the right to object to processing if we are able to process your information because the process forms part of our public tasks, or is in our legitimate interests.
– Your right to not be subject to a decision based solely on automated processing, including profiling, in certain circumstances (art. 22 GDPR).
– Your right to know the the recipients or categories of recipients of the personal data, if any (art. 13.1.e) GDPR).
If you wish to execute any of these rights, please contact us by email: [email protected] or by standard mail: Via Pietro Giannone 9 – 20154 Milano. You may also request additional information about: the purpose of the processing; the categories of personal data concerned; who else outside ISTUD might have received the data from us; what the source of the information was; and how long it will be stored. Finally, you have the right to lodge a complaint with a supervisory authority and the right to brigde if you think that the processing of your personal data is not compliant with the relevant laws. The website of the Italian supervisor authority “Garante per la Privacy” is www.garanteprivacy.it.