PRIVACY POLICY

 

PRIVACY POLICY DETAILS

Information pursuant to art. 13 of Legislative Decree 196/2003 and Article 13 of EU Regulation no. 2016/679

Pursuant to art. 13 of Legislative Decree 196/2003 (hereinafter “Privacy Code”) and art. 13 of the EU Regulation n. 2016/679 (hereafter “GDPR 2016/679”), laying down provisions for the protection of persons and other subjects regarding the processing of personal data, we wish to inform you that the personal data you provide will be processed in compliance with the aforementioned law and the confidentiality obligations to which The Academy Srl is held.

Data controller

Data controller
The data controller is The Academy srl in the person of the legal representative Ann Philomena Byrne domiciled for the office in Syracuse, in Via San Giovanni alle Catacombe n. 7.
The Academy S.r.l., with headquarters in Via San Giovanni Alle Catacombe n. 7 in Syracuse (SR), operates as Data Controller and can be contacted at the email address privacy@academysiracusa.com or at the telephone number +39 0931 61424.

 

Data Protection Officer (DPO)

Given the type of data processed and the entity of the company, a Data Protection Officer (DPO) has not been appointed; for any information or request, contact the data controller (The Academy S.r.l.).

Purpose of the processing (Article 13 of the GDPR)

The Academy S.r.l. collects and / or receives information concerning the data subject, such as:

Personal data: name, surname, address, nationality, date and place of birth, telephone number, e-mail address.


The data are used by the data controller to follow up the registration request and the contract for the provision of the chosen service, manage and execute the contact requests sent by the data subject, provide assistance, fulfill the legal and regulatory obligations to which the holder is held in function of the activity exercised.In no case The Academy S.r.l. resells the personal data of the data subject to third parties or uses them for undeclared purposes.
In particular the data of the data subject will be processed for:

 

  • registration of personal data and requests for contact and / or information material and management of the contractual relationship

 

The processing of personal data of the data subject takes place to carry out preliminary activities and consequent to the registration request, to the management of requests for information and contact and / or sending information material as well as the purchase of a service, management of the reservation, the provision of the service itself, the related invoicing and the management of the payment, the handling of complaints and / or reports and the provision of the assistance itself, the prevention of fraud and the fulfillment of any other obligation arising from the contract.
The legal basis of these processing is the fulfillment of the services related to the request for registration, information and contact and / or sending information material and the contractual relationship.

 

  • promotional activities on services / products similar to those purchased by the data subject, if any (Recital 47 GDPR)

The data controller, even without explicit consent, may use the contact details provided by the data subject, for the purpose of direct sale of their services / products, limited to the case in which these services / products are similar to those sold, unless the person concerned objects explicitly.

  • the commercial promotion activities on services / products different from those purchased by the data subject

The personal data of the data subject may also be processed for purposes of commercial promotion, surveys and market research with regard to services / products that the holder offers only if the data subject has authorized the processing and does not oppose this.

    • e-mail
    • sms
    • telephone

and can be done:

  • if the data subject has not revoked his consent for the use of the data;
  • if, in the event that the processing takes place through contact with the telephone operator, the data subject is not registered in the register of oppositions referred to in the D.P.R. n. 178/2010;

The legal basis of such processing is the consent given by the data subject prior to the processing itself, which can be revoked by the data subject freely and at any time.

 

  • profiling
    The personal data of the data subject may also be processed for profiling purposes (such as analysis of the transmitted data and of the selected Services / Products, to propose advertising messages and / or commercial proposals in line with the choices expressed by the users themselves) only in case the data subject has provided an explicit and informed consent.

The legal basis of such processing is the consent given by the data subject prior to the processing itself, which can be revoked by the data subject freely and at any time.

 

  • the protection of minors
    The Services / Products offered by the Data Controller are reserved to subjects legally able, on the basis of the national reference legislation, to conclude contractual obligations.In order to prevent unlawful access to its services, the data controller implements prevention measures to protect their legitimate interest, such as the control of the tax code and / or other checks, when necessary for specific services / products, the correctness of the data identification of identity documents issued by the competent authorities.

 

The scope of communication and dissemination

We also inform you that the data collected may be disclosed to third parties for the performance of the activities related to the relationship established and to meet certain legal obligations, such as administrative, accounting and contractual obligations, provision of services, management of revenues.

Entities (and categories of entities) to whom personal data can be communicated:

  1. Public bodies and offices with regard to legal obligations.
  2. Entities that will provide consulting services strictly connected and instrumental to the management of administrative activities, accounting, security, educational activities and services related to the reception and movement of the subjects involved.
  3. Companies specialized in services related to security, educational activities, and services related to the reception and transportation of the subject, with the appointment of external bodies.

The data processing carried out by these subjects serves the following purposes:

  1. to provide supplies and services connected to the activity described in b)
  2. to manage the relationships with customers and suppliers and the fulfillment of their obligations.
  3.  to apply statistical processing in strictly anonymous forms.


We clarify that these subjects, as external entities,  will autonomously perform the processing of data, communicated by the Controller of Data, as expressed in article 28 of the GDPR.


The data controller imposes on his third parties suppliers and the data processors the respect of security measures equal to those adopted towards the data subject, restricting the perimeter of action of the data processors to the processing connected to the requested service.

 

Transfer of personal data
The owner does not transfer personal data to countries where GDPR (non-EU countries) is not applied, unless there are specific indications to the contrary for which you will be informed in advance and, if necessary, your consent will be requested.

 

Special categories of personal data
The Academy S.r.l. does not require the data subject to provide “sensitive” data, that is, according to the provisions of the GDPR (Article 9), personal data revealing racial or ethnic origin, political, religious or philosophical orientation, or union membership, as well as genetic data, biometric data, which should uniquely identify an individual, data concerning health or sex life or sexual orientation of the person. In the event that the performance required at The Academy S.r.l. imposes the processing of such data, the data subject will receive prior notice and will be required to give appropriate consent.

 

Methods of processing and conservation
In compliance with the principles of lawfulness, purpose limitation and data minimization, pursuant to art. 5 GDPR 2016/679, subject to your free and explicit consent expressed at the bottom of this information, your personal data will be kept for the period of time necessary to achieve the purposes for which they are collected and processed.
Unless he explicitly expresses his will to remove them, the personal data of the data subject will be kept until they are necessary with respect to the legitimate purposes for which they were collected.
In particular, they will be kept for the entire duration of their registration and in any case no longer than a maximum period of 36 (thirty-six) months of inactivity, or if, within this period, no services and / or purchased products are associated through the registry itself.

 

In the event that a user sends to the data controller personal data which are not requested or not necessary for the execution of the requested service or for the provision of a service closely connected to it, The Academy S.r.l. cannot be considered the owner of these data, and will delete them as soon as possible.

 

Rights of the data subject
At any time, the data subject may exercise, pursuant to art. 7 of Legislative Decree 196/2003 and articles from 15 to 22 of EU Regulation no. 2016/679, the right to:

  • request confirmation of the existence or not of personal data;
  • obtain information about the purposes of the processing, the categories of personal data, recipients or categories of recipients to whom the personal data have been or will be communicated and, where possible, the retention period;
  • obtain data correction and deletion;
  • obtain treatment limitation;
  • obtain data portability, ie receive them from a data controller, in a structured format, commonly used and readable by an automatic device, and transmit them to another data controller without impediments;
  • oppose the processing at any time and also in the case of treatment for direct marketing purposes;
  • oppose an automated decision-making process concerning individuals, including profiling.
  • revoke the consent at any time without prejudice to the lawfulness of the treatment based on the consent given prior to the revocation;
  • propose a complaint to the supervisory authority.

 

  • What happens if the data subject does not provide his data identified as necessary for the execution of the requested service? (Article 13, paragraph 2, letter and GDPR)


The collection and processing of personal data are necessary to follow up the requested services as well as the provision of the service and / or the supply of the requested product if there was a need / requirement. If the data subject does not provide the personal data expressly provided for as necessary in the order form or the registration form, the data controller will not be able to process the processing related to the requested services and / or contract and services / products connected to it, or to the obligations that depend on them.

 

  • What happens if the data subject does not give consent to the processing of personal data for commercial promotion activities on services / products different from those purchased?


In the event that the data subject does not consent to the processing of personal data for such purposes, said processing will not be carried out for the same purposes, without this having effects on the provision of the services requested, or for those for which he has already given their consent, if required.
In the event that the data subject has given consent and should subsequently withdraw or oppose the treatment for commercial promotion activities, his data will no longer be processed for such activities, without this having consequences or detrimental effects for the data subject and for the requested services.

 

Existence of an automated decision-making process
The Academy S.r.l. does not adopt any automated decision-making process, including profiling, referred to in Article 22, paragraphs 1 and 4, of EU Regulation no. 679/2016.

The data subject can exercise his rights with a written request sent to The Academy S.r.l., to the postal address of the registered office or to the e-mail address privacy@academysiracusa.com