PRIVACY POLICY

Data Controller:

Develhope s.r.l., with its registered office in Palermo (PA), Via Siracusa 16, Tax Code, VAT number and Registration in the Palermo Business Register 06803120820, in the person of the legal representative pro tempore

Data Controller contact details:

privacy@develhope.co

Develhope, with registered office in Palermo (PA), Via Siracusa 16, Tax Code, VAT number and Registration in the Palermo Register of Business 06803120820, in the person of its pro tempore legal representative, as data controller of your personal data (hereinafter also "Data Controller"), informs you, pursuant to Articles 12 and 13 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter referred to for brevity as "GDPR"), that your personal data will be processed by specifically authorised parties and limited to the purposes and in the manner specified below. 

SUBJECT-MATTER AND OBJECTIVES OF THE PROCESSING OF PERSONAL DATA

The Data Controller informs you that it will process, specifically, your personal data, or name and surname, date and place of birth, address of residence/domicile, contact details (Email/PEC, telephone number), Tax Code, (if applicable) VAT number, bank/tax/postal data, credit card identification data, (if applicable) photographic images and audio/video footage, (if applicable) navigation data, identifiers and IP addresses or domain names, according to the purposes and methods defined and specified below. 

In particular, the personal data provided to the Data Controller will be processed for the following purposes: 

1. fulfillment and execution of this training services agreement and completion of any action aimed at fulfilling the mutual obligations arising from the aforementioned contractual relationship, in particular with regard to the attribution of access credentials and the creation of a personal account of the student, to allow them to use the e-learning platform according to the terms and conditions provided for in the training services agreement, of which this information is an integral and fundamental part; 

2. fulfillment of specific requests from the interested party during the execution of this training services agreement; 

3. fulfillment of fiscal, administrative, technical and/or accounting obligations; 

4. management of training via the e-learning platform and control of the correct and complete provision of the training service; 

5. litigation management (breach of contract; notices; settlements; debt collection; arbitration; litigation and legal disputes); 

6. internal control services (safety, productivity, quality of services, integrity of assets) and research and statistical processing, including by automated means, in order to improve and develop the technical and pedagogical functions of the training service;

7. sending of commercial and/or promotional communications relating to products and services similar to those covered by this training services agreement, unless expressly objected to pursuant to Art. 21, par. 2 of the GDPR.

It should be noted that, following registration with the e-learning platform, the information entered by students during the use of the platform will be associated with them exclusively by means of the nickname indicated when creating the profile. The processing of data given in general will be carried out, even following automatic collection during navigation, for the sole purpose of verification and control of access to the Website. e-learning and/or for the sole purpose of improving the functionality of the same to ensure the correct and complete provision of the training service. 

LEGAL BASIS FOR DATA PROCESSING

Apart from that specified for browsing data, your provision to the Data Controller of the personal data specified above, shall have as a basis for the lawfulness of the processing, the following legal bases: 

• Art. 6, par. 1, letter b) of the GDPR, for the purposes referred to in points a), b), d), e), f). 

• Art. 6, par. 1, letter c) of the GDPR, for the purpose referred to in point c). 

• Art. 6, par. 1, letter f) of the GDPR, for the purpose referred to in point g), unless expressly objected to pursuant to Art. 21, part 2 of the GDPR. 

The provision of your personal data is, therefore, necessary for the establishment and execution of the training services agreement, or for the complete fulfillment of the purposes mentioned above and for the fulfilment of the obligations connected to them and, consequently, except as provided for in the above point g), for which any opposition you express would have no effect on the regularity of the provision of the training service covered by this agreement, your refusal to provide your personal data will result in the impossibility of fulfilling said services, since it is not possible to fully proceed with the training services agreement, of which this information constitutes an integral and fundamental part. The processing of your personal data will take place, in any case, according to the principles of lawfulness and fairness, and in order to fully protect your confidentiality, in particular, in compliance with the principles established by Art. 5 of the GDPR. 

PROCESSING METHOD

The Processing of the personal data that you provided is carried out through the operations indicated in Art. 4, paragraph 2) of the GDPR and specifically the: "collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, communication, cancellation, and destruction of data". 

The personal data communicated are processed in paper, computerized and/or electronic form and included in the relevant registers and/or related databases (administration, accounting, commercial, technical, marketing, etc.) for the time strictly necessary to achieve the purposes for which they were collected, with technical and organizational methods adopted to prevent the loss of data, unlawful and/or incorrect use and unauthorized access, and such, therefore, as to guarantee a level of security appropriate to the risk pursuant to Art. 32 of the GDPR, by specially authorized parties, in compliance with the provisions of Art. 29 of the GDPR, or by employees and/or collaborators of the Data Controller in their capacity as authorized parties, who may carry out consultation, use, processing, comparison and any other appropriate operation in compliance with the legal provisions necessary to guarantee, among other things, the confidentiality and security of the data as well as the accuracy, updating and relevance of the data in respect of the stated purposes and methods.

Pursuant to Art. 13, paragraph 1, lett. (e), your personal data may be processed by authorized persons and/or delegated representatives within the company of the functions assigned to this purpose and/or also by external data processors pursuant to Art. 28 of the GDPR (in the person of individual professionals and/or complex professional associations, whose list is available at the request of the interested party at the registered office of the data controller), in charge, in particular, of accounting and financial management, administrative, legal. 

SCOPE OF THE COMMUNICATION OF DATA

In relation to the purposes indicated above, in general, your personal data will be processed only at the headquarters of the Data Controller, and therefore will not be communicated and/or disclosed to third parties, except as specified below. 

If necessary, in fact, your data may be disclosed to the following subjects and/or categories of subjects indicated below, or may be disclosed to companies and/or persons, who provide services, including external services, on behalf of the Data Controller - by way of example and not exhaustively: subjects who carry out, in total autonomy as separate Data Controllers or as external Data Processors appointed for this purpose by the Data Controller, auxiliary purposes for the execution of this training services agreement and the related commercial contractual relationships, that is, companies connected to the Data Controller for purposes other than administrative-accounting and commercial, postal services and shipping and delivery agencies, business partners, companies that manage databases for the assessment of credit risk, banking and insurance institutions, public administrations and supervisory and control authorities, legal and notary offices, debt collection companies, service centers, companies or consultants responsible for providing specific professional and advisory services to the Data Controller, always within the limits of the purposes for which your personal data were collected. 

The Data Controller, except as indicated in the following paragraph, informs you that, in general, it will not transfer your personal data to a third country outside the EU or to an international organization based outside the EU; in the event that this is necessary for any reason, the Data Controller hereby ensures that the transfer of the data will take place in accordance with the applicable legal provisions and, in particular, in accordance with Articles 44 – 45 – 46 – 47 – 48 and 49 of the GDPR and other applicable legal provisions. With exclusive reference to any photographic images and audio/video films that portray it, the Data Controller may have to share some of the data collected with services located outside Italy and the European Union area, in particular with Google, Facebook, LinkedIn, YouTube, Instagram, Twitter, also through social plugins and the Google Analytics service, whose web pages are fully referenced for the detailed analysis of personal data processing policies. 

DATA STORAGE PERIOD

In compliance with the principles of lawfulness, limitation of purposes and storage and minimisation of data, pursuant to Art. 5 of the GDPR, the period of retention of your personal data is established for a period of time not exceeding the achievement of the purposes for which they were collected and processed, or for the entire duration of the fulfillment of the purposes in question with reference to this training service agreement, and, at the end of the latter, also for a time in any case not exceeding 10 (ten) years following the conclusion of the same relationship, corresponding to the contractual prescriptive term, but, in the latter case, only and exclusively with reference to the personal data necessary for the possible fulfillment of legal and/or administrative obligations, or for defence purposes in court and/or in order to assert a right in judicial/extrajudicial litigation. 

Once the retention period has elapsed as identified above, your personal data will be deleted from each Database, application and/or archive, computer and/or paper, in which they have been recorded and stored, with methods suitable to not allow their recovery.

AUTOMATED DECISION-MAKING AND PROFILING

The Data Controller informs you that, for the purposes of processing your personal data, it does not make use of automated decision-making processes, namely those aimed at making decisions based solely on technological means based on predetermined criteria (i.e. without human involvement), or carrying out profiling activities, that is those aimed at using your personal data to analyze or predict aspects of professional performance, economic situation, health, personal preferences, interests, reliability, behavior, location or travel etc. 

RIGHTS OF THE DATA SUBJECT

Right of Access pursuant to Art. 15 of the GDPR and Right of Correction pursuant to Art. 16 of the GDPR 

As a data subject, pursuant to Art. 15 of the GDPR, you have the right to obtain from the Data Controller confirmation of the existence or otherwise of a processing of personal data concerning you, to obtain access to them and to all the information referred to in the same Art. 15, paragraph 1, letters (a) to (h), by issuing a copy of the data subject to processing in a structured, commonly used, machine-readable and interoperable format. 

Pursuant to art. 16 of the GDPR, in your capacity as a User, you have the right to obtain from the Data Controller the correction and/or integration of the data being processed if they are not updated and/or accurate and/or complete. 

Right to erasure pursuant to Art. 17 of the GDPR and Right to restriction of processing pursuant to Art. 18 of the GDPR 

Pursuant to Art. 17 of the GDPR, as a Data Subject, you have the right to obtain, without undue delay, from the Data Controller, exclusively in the cases referred to in art. 17, paragraph 1, letters from (a) to (f), of the GDPR, the deletion of data concerning you - with the exception of the hypotheses specifically provided for by Art. 17 paragraph 3. 

Pursuant to Art. 18 paragraph 1, letters from (a) to (d), of the GDPR, in your capacity as a User, you have the right to request and obtain from the Data Controller, the limitation of the processing of your personal data, or that such data are not subjected to further treatments and can no longer be modified. The Data Controller ensures that the limitation of the processing is implemented through appropriate technical devices that guarantee its inaccessibility and the impossibility to modify the data. 

Right to data portability pursuant to Art. 20 of the GDPR 

Pursuant to Art. 20 of the GDPR, in your capacity as data subject, you have the right to receive from the Data Controller personal data concerning you, which is processed by automated means, in a structured format, commonly used and readable by an automatic device, and you also have the right to transmit such data to another data controller, or to obtain from the Data Controller, where technically feasible, the direct transmission of such data to another Data Controller specifically identified.

Right to object to processing pursuant to Art. 21 of the GDPR 

Pursuant to Art. 21 of the GDPR, in your capacity as data subject you have the right to object at any time to the processing of personal data concerning you, for reasons connected with your particular situation, in cases where the processing of your data is necessary (1) for the execution of a task of public interest and/or connected to the exercise of public authority vested in the Controller; (2) for the pursuit of a legitimate interest of the owner or of a third party; (3) for the profiling activity, if performed by the Controller, on the basis of the previous points. 

You also have the right to object to the processing of your personal data for reasons related to your particular situation if they are processed for scientific or historical research purposes or for statistical purposes in accordance with Article 89 (1) of the GDPR, except in the case where the processing is necessary for the performance of a task of public interest. 

MODALITIES FOR THE EXERCISE OF THE RIGHTS OF THE DATA SUBJECT

You can exercise the rights listed above by sending a request to the email address privacy@develhope.co, to the attention of Dr. Alessandro Balsamo.

The Data Controller will confirm the receipt of your request and provide you with information on the action taken, with reference to the exercise of your rights under articles 15 to 22 of the GDPR, within 1 (one) month from receipt of the request. If necessary, and taking into account the complexity and the number of requests, the Controller may extend this term to 2 (two) months, subject to a reasoned communication to be sent within 1 (one) month from receipt of the request. 

The Data Controller will communicate any correction, cancellation or restriction of opposition to all recipients, as identified by Art. 4, paragraph 1, no. 9 of the GDPR, to whom such data have been transmitted, unless this proves impossible and/or involves a disproportionate effort. Following the sending of your request for rectification, cancellation, restriction or opposition, if the Data Controller has reasonable doubts about your identity they will request more information to confirm it. These communications will be sent by email to privacy@develhope.co. 

In the event that the Data Controller fails to comply with your request within the period of 1 (one) month from receipt of the request, the latter will inform you of the reasons for the non-compliance, henceforth informing you of your right to make a complaint to the Supervisory Authority (Guarantor for the protection of personal data), as specified in accordance with art. 13, paragraph 2, letter (d) and governed by articles 77 et seq. of the GDPR. 101/2018.