Privacy Policy

Istituto Marangoni S.r.l., as Data Controller, would like to inform you of what data it collects and how, in order to guarantee respect for your rights and fundamental freedoms, with particular reference to the confidentiality and security with which the data is processed.

Istituto Marangoni S.r.l. collects and stores your following data:

• credentials to access the application;

• personal and identifying information (such as first name, surname and student ID);

• contact details (e-mail, telephone number);

• related to the course you attended (such as programme, status, time validity, lessons);

• geolocation of the device from which you access CampusM;

• any service tickets requested via the appropriate section.

Istituto Marangoni S.r.l. uses your data for the following purposes:

a) Allow you to access the application;

b) Allow you to view your Student Card;

c) Enable you to access information relating to your training at Istituto Marangoni (e.g. view the courses you have attended and the relevant lesson plans and timetables).

In relation to the purposes set out in points 3 a), b) and c), the processing is necessary for the performance of an existing contract with Istituto Marangoni to which you are a party (Art. 6(1)(b) GDPR);

d) Manage any problems reported by you in the form of open support tickets through the appropriate section;

e) Relating to service tickets, for statistical purposes.

In relation to the purpose referred to in point d) and e), the processing is necessary for the pursuit of the legitimate interest (Art. 6(1)(f) GDPR);

f) To provide you with directions on how to get to the selected school from your location;

In relation to the purposes referred to in point f), the legal basis for the processing is your consent, which can be revoked at any time as indicated in Art. 9 of this notice (Art. 6, para. 1, Letter a) of the GDPR).

For the purposes of 3 a), b) and c) above, we keep your personal data for the duration of the contractual relationship.

For the purpose of point d) we keep your data for as long as is strictly necessary to solve the problem for which assistance was requested.

For the purpose of (e) above, we permanently store data on service tickets.

For the purposes set out in f) above, we will retain your data until your consent is revoked, without prejudice to your right to revoke your consent at any time.

Once the retention period has expired, the data will be destroyed or anonymised.

Please note: If, in the event of litigation, it is necessary to ascertain, exercise or defend the rights of the Data Controller, the period of retention of the data collected, for the above-mentioned purposes, may be extended due to the possibility that it may be necessary to prepare defensive elements within this timeframe. In this case, the data will only be kept until the conclusion of the litigation.

The processing of your data will be carried out by means of information and/or automated systems suitable for guaranteeing its confidentiality, integrity and availability and will include all the operations or series of operations provided for by Article 4 of the GDPR necessary for the processing in question, including communication to the persons in charge of processing. The data in question will not be subject to dissemination; instead, they will or may be communicated to public or private entities operating within the scope of the purposes described above.

Only people authorised within the scope of the tasks assigned by Istituto Marangoni S.r.l. can access your data.

Istituto Marangoni S.r.l. is part of Galileo Global Education Italia. Galileo Global Education Italia employees may also have access to some of your data.

Personal data will not be disclosed in any way, it may also be communicated and processed by third parties duly appointed as Data Processors, such as Ex Libris Group and Clarivate as well as other external collaborators and companies that provide specific instrumental services.

Personal data may also be accessible or may be communicated to subjects whose right to access your personal data is recognised by provisions of the law or secondary or EU regulations.

Your personal data will be managed and stored on servers located within the European Economic Area (EEA) and belonging to the Data Controller and/or third party companies appointed and duly identified as Data Processors.

In addition, some third party companies appointed as Data Processors, such as ExLibris, may transfer your personal data to servers located in the United States only where strictly necessary for the performance of the contract to which you are a party and on the basis of appropriate safeguards such as the Standard Contractual Clauses (SCC) referred to in Article 46(2)(c) of the GDPR. Further information on these guarantees can be requested from the Data Controller.

The provision of your data as per point 3 a), b), c), d) is necessary to execute the contract with Istituto Marangoni to which you are a party. For the purpose of point e) it is optional, if you do not consent to geolocation you will still be able to use the app but you will not be able to get directions on how to reach the school you have selected starting from your position.

According to the provisions of the GDPR, Istituto Marangoni S.r.l. guarantees the following rights:

• Right to withdraw consent [Art. 7(3) of the EU Regulation] (right to withdraw consent given.

Note: revocation of consent does not affect the lawfulness of processing based on consent before revocation);

• Data subject's right of access [Art. 15 of the EU Regulation] (right to obtain confirmation of the existence or non-existence of personal data relating to him/her and a copy thereof in intelligible form);

• Right of rectification [Art. 16 of the EU Regulation] (right to rectification of inaccurate personal data concerning him/her);

• Right to erasure ('right to be forgotten') [Art. 17 of the EU Regulation] (right to erasure of one's own data;

• Right to restriction of processing [Art. 18 of the EU Regulation] (right to obtain restriction of processing, e.g. if the accuracy of the data is contested or in the event of unlawful processing);

• Right to data portability [Art. 20 of the EU Regulation] (right to receive in a structured, commonly used and machine-readable format the personal data concerning him/her provided to Istituto Marangoni S.r.l. and the right to transmit such data to another Data Controller without hindrance by Istituto Marangoni S.r.l. if the processing is carried out on the basis of consent and is performed by automated means);

• Right to object [Art. 21 of the EU Regulation] (right to object to the processing of one's own personal data);

• Right not to be subject to automated decision-making [Art. 22 of the EU Regulation] (right not to be subject to a decision based solely on automated processing).

The aforementioned rights may be exercised in writing by sending an e-mail to dpo@istitutomarangoni.com. The same contact person may be asked for further information on the processing of personal data at any time. It should also be noted that the exercise of one's rights must not prejudice and/or infringe the rights and freedoms of others.

Istituto Marangoni S.r.l. undertakes to respond to requests within one month, except in the case of particularly complex requests, for which a maximum of 3 months may be required. In any case, Istituto Marangoni S.r.l. will explain the reason for the wait within one month of the request.

The outcome of the request will be provided in writing (at the request of the interested party) or electronically (and, in this case, free of charge). Istituto Marangoni S.r.l. specifies that a possible contribution may be requested from the interested party if their requests are manifestly unfounded, excessive or repetitive: in this regard Istituto Marangoni S.r.l. will keep track of the requests.

Istituto Marangoni S.r.l., in compliance with art. 19 of the EU Regulation, undertakes to inform the recipients to whom the personal data of the data subject have been communicated of any rectification, cancellation or restriction of processing requested by the data subject, where possible.

If the data subject considers that his or her rights have been compromised or infringed, or that the processing of his or her data is contrary to the legislation in force, he or she has the right to lodge a complaint with the Italian Data Protection Authority in accordance with the procedures indicated by the Authority itself at the following address:

https://www.garanteprivacy.it/diritti/come-agire-per-tutelare-i-tuoi-dati-personali/reclamo.

The Data Controller is: Istituto Marangoni S.r.l. - Via Pietro Verri, 4 20121 Milano MI

Mail: privacy@istitutomarangoni.com

The Data Protection Officer can be contacted at the following e-mail address: dpo@istitutomarangoni.com

This policy is subject to change. Any substantial changes will be communicated to you by e-mail or via our website.