Privacy Policy 

The purpose of this document is to inform the individual (hereinafter “Data Subject”) regarding the processing of their personal data (hereinafter “Personal Data”) collected by the data controller, Associazione Fatoma Yaiw ETS, with registered office at Via Gian Antonio Boltraffio, 7, Milan (MI) 20159, Tax Code/VAT Number: 97943670154, email address: info@scuolafatoma.it, (hereinafter “Controller”), through the website www.scuolafatoma.it (hereinafter “Application”). 

Changes and updates will be binding as soon as they are published on the Application. If the Data Subject does not accept the changes made to the Privacy Policy, they are required to cease using this Application and may request the Controller to delete their Personal Data.

1. Categories of Personal Data Processed

The Controller processes the following types of Personal Data voluntarily provided by the Data Subject:

• Contact data: first name, last name, address, email, phone number, images, authentication credentials, any additional information sent by the Data Subject, etc. 

Failure to provide Personal Data for which there is a legal or contractual obligation, or if it is a necessary requirement for the conclusion of a contract with the Controller, will result in the Controller being unable to establish or continue the relationship with the Data Subject.

The Data Subject who provides Personal Data of third parties to the Controller is directly and exclusively responsible for their origin, collection, processing, communication, or dissemination.

2. Cookies and Similar Technologies

The Application uses cookies, web beacons, unique identifiers, and other similar technologies to collect Personal Data of the Data Subject on the pages, links visited, and other actions performed when the Data Subject uses the Application. These are stored to be transmitted on the Data Subject’s subsequent visit. The full Cookie Policy can be viewed at the following address: https://scuolafatoma.it/privacy-policy-3/ 

3. Legal Basis and Purposes of Processing

The processing of Personal Data is necessary:

• For the performance of the contract with the Data Subject and specifically: 

1. Fulfillment of any obligation arising from the pre-contractual or contractual relationship with the Data Subject 

2. Registration and authentication of the Data Subject: to allow the Data Subject to register on the Application, access, and be identified, even via external platforms 

3. Support and contact with the Data Subject: to respond to the requests of the Data Subject 

4. Payment management: to process payments via credit card, bank transfer, or other tools 

• For legal obligations and specifically: 

1. Fulfillment of any obligations required by applicable laws, regulations, and rules, particularly in tax and fiscal matters 

• Based on the legitimate interest of the Controller, for: 

1. Marketing purposes via email for products and/or services of the Controller , to directly sell the products or services of the Controller using the email provided by the Data Subject in the context of the sale of a product or service similar to the one being sold 

2. Management, optimization, and monitoring of the technical infrastructure: to identify and resolve any technical issues, to improve the performance of the Application, to manage and organize information in an IT system (e.g., servers, databases, etc.) 

3. Security and anti-fraud: to ensure the security of the assets, infrastructure, and networks of the Controller 

4. Statistics with anonymous data: to perform statistical analysis on aggregated and anonymous data to analyze the behaviors of the Data Subject, to improve the products and/or services provided by the Controller, and better meet the expectations of the Data Subject 

• Based on the consent of the Data Subject, for: 

1. Profiling of the Data Subject for marketing purposes: to provide the Data Subject with information about products and/or services of the Controller through automated processing aimed at collecting personal information to predict or assess their preferences or behaviors 

2. Retargeting and remarketing: to reach the Data Subject with a personalized advertising message if they have already visited or shown interest in the products and/or services offered by the Application using their Personal Data. The Data Subject can opt-out by visiting the Network Advertising Initiative page Network Advertising Initiative 

3. Marketing of products and/or services of the Controller: to send commercial or promotional information or materials, to perform direct sales activities for products and/or services of the Controller, or to carry out market research through automated and traditional methods 

4. Marketing of products and/or services of third parties: to send commercial or promotional information or materials from third parties, to perform direct sales activities, or to carry out market research for their products and/or services through automated and traditional methods 

Based on the legitimate interest of the Controller, the Application allows interactions with external platforms or social networks, the processing of Personal Data of which is governed by their respective privacy policies, which should be consulted. The interactions and the information acquired through this Application are, in any case, subject to the privacy settings the Data Subject has chosen on such platforms or social networks. This information, in the absence of specific consent for further processing purposes, will be used solely to allow the use of the Application and provide the requested information and services.

The Personal Data of the Data Subject may also be used by the Controller to protect itself in court before the competent judicial authorities.

4. Processing Methods and Recipients of Personal Data

Personal Data processing is carried out using paper and electronic tools, with organizational methods and logic strictly related to the purposes indicated and through the adoption of appropriate security measures.

Personal Data is processed exclusively by: 

• Persons authorized by the Data Controller who are committed to confidentiality or have a legal obligation of confidentiality;

• Entities that operate independently as distinct data controllers or entities designated as data processors by the Controller to carry out all necessary processing activities to pursue the purposes of this policy (e.g., business partners, consultants, IT companies, service providers, hosting providers);

• Entities or authorities to which Personal Data must be communicated due to legal obligations or orders from authorities.

The above-mentioned entities are required to use appropriate safeguards to protect Personal Data and can access only the data necessary to perform the tasks assigned to them.

Personal Data will not be indiscriminately disclosed in any way.

5. Location

If necessary, Personal Data may be transferred to entities located outside the European Economic Area (EEA). Whenever Personal Data is transferred outside the EEA, the Controller will take all appropriate contractual measures to ensure an adequate level of protection of Personal Data, including, among others, agreements based on standard contractual clauses for the transfer of data outside the EEA, approved by the European Commission. To request information on the specific safeguards adopted, the Data Subject can contact the Controller at the following email address: info@scuolafatoma.it. 

6. Retention Period for Personal Data

Personal Data will be stored for the time necessary to fulfill the purposes for which they were collected, specifically: 

• For purposes related to the execution of the contract between the Controller and the Data Subject, they will be stored for the duration of the contractual relationship and, after termination, for the ordinary limitation period of 10 years. In the event of legal proceedings, for the duration of the proceedings, until the expiry of the appeal deadlines.

• For purposes related to the legitimate interest of the Controller, they will be stored until the completion of that interest.

• For the fulfillment of legal obligations, by order of an authority, and for legal protection, they will be stored in compliance with the timelines established by such obligations, regulations, and in any case until the expiration of the statutory limitation period.

• For purposes based on the consent of the Data Subject, they will be stored until consent is revoked. 

At the end of the retention period, all Personal Data will be deleted or kept in a form that does not allow the identification of the Data Subject.

7. Rights of the Data Subject

Data Subjects may exercise certain rights regarding their Personal Data processed by the Controller. In particular, the Data Subject has the right to:

• Be informed about the processing of their Personal Data

• Withdraw consent at any time

• Limit the processing of their Personal Data

• Object to the processing of their Personal Data

• Access their Personal Data

• Verify and request correction of their Personal Data

• Obtain the limitation of the processing of their Personal Data

• Obtain the deletion of their Personal Data

• Transfer their Personal Data to another controller

• File a complaint with the data protection authority and/or take legal action.

To exercise their rights, Data Subjects can send a request to the following email address: info@scuolafatoma.it. Requests will be handled by the Controller promptly and fulfilled as soon as possible, in any case within 30 days. 

8. Data Protection Officer

The Data Protection Officer is Associazione Fatoma Yaiw ETS, with registered office at Via Gian Antonio Boltraffio, 7, Milan (MI) 20159, Tax Code/VAT Number: 97943670154, email address: dpo@scuolafatoma.it. 

Last updated: 01/06/2023