Privacy policy

Data Controller

Scuola Grande dei Carmini
Dorsoduro 2616-2617 – 30123 Venice (Italy)
Controller email address: info@scuolagrandecarmini.it

Types of Data Collected

Among the personal data collected by this application, either independently or through third parties, there are: email; tracking tools; usage data. Personal data may be freely provided by the user or, in the case of usage data, collected automatically whilst using this application. Unless specified otherwise, all data requested by this application is mandatory. If the user refuses to provide it, it may be impossible for this application to provide the service. In cases where this application explicitly states that some data is optional, users are free not to communicate this data without any consequences on the availability or operation of the service. Users who are uncertain about which data is mandatory are encouraged to contact the controller. Any use of cookies by this application or by the controllers of third-party services used by this application is intended to provide the service requested by the user. The user assumes responsibility for the personal data of third parties obtained, published, or shared through this application.

Methods of Processing the Collected Data

The controller takes appropriate security measures to prevent unauthorised access, disclosure, modification, or destruction of personal data. The processing is carried out using IT and/or telemetric instruments, with organisational methods and logic strictly related to the purposes indicated. In addition to the controller, in some cases, other parties involved in the organisation of this application (administrative, sales, marketing, and legal staff, and system administrators) or external parties (such as third-party technical service providers, postal couriers, hosting providers, IT companies, and communication agencies) appointed, if necessary, as data processors by the controller, may have access to the data.

Place of Processing the Collected Data

The data is processed at the controller’s operating offices and in any other place where the parties involved in the processing are located.

Retention Period

Personal data is processed and stored for the time required by the purpose for which it was collected and may be kept for a longer period due to any legal obligations or based on the users’ consent. Personal data collected for purposes related to the performance of a contract between the controller and the user will be retained until the performance of such contract has been completed. Personal data collected for purposes related to the controller’s legitimate interest will be retained until such interest is fulfilled. When processing is based on the user’s consent, the controller may retain personal data for longer until such consent is withdrawn. Furthermore, the controller may be obliged to retain personal data for a longer period to comply with a legal obligation or by order of an authority. At the end of the retention period, personal data will be deleted. Therefore, upon the expiry of this term, the right to access, erasure, rectification, and the right to data portability can no longer be exercised.

Purposes of Processing the Collected Data

The user’s data is collected to allow the controller to provide the service, comply with legal obligations, respond to enforcement requests, protect its rights and interests (or those of users or third parties), detect any malicious or fraudulent activity, as well as for managing contacts and sending messages.

Additional Information for Users in the European Union

This section applies to all users in the European Union, in accordance with the General Data Protection Regulation (GDPR) and, for such users, supersedes any other divergent or conflicting information contained in the privacy policy.

Legal Basis for Processing

The controller processes personal data relating to the user if one of the following conditions applies:

The user has given consent for one or more specific purposes;
Processing is necessary for the performance of a contract with the user and/or for any pre-contractual obligations;
Processing is necessary for compliance with a legal obligation to which the controller is subject;
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

It is always possible to ask the controller to clarify the specific legal basis of each processing activity.

User Rights Under the General Data Protection Regulation (GDPR)

Users may exercise certain rights regarding the data processed by the controller. In particular, within the limits provided by law, the user has the right to:

Withdraw consent at any time: The user has the right to withdraw consent where they have previously given their consent to the processing of their personal data;
Object to the processing of their data: The user has the right to object to the processing of their data if the processing is carried out on a legal basis other than consent;
Access their data: The user has the right to learn if data is being processed by the controller, obtain disclosure regarding certain aspects of the processing, and obtain a copy of the data undergoing processing;
Verify and seek rectification: The user has the right to verify the accuracy of their data and ask for it to be updated or corrected;
Restrict the processing of their data: The user has the right to restrict the processing of their data, in which case the controller will not process the data for any purpose other than storing it;
Obtain the erasure or removal of their personal data: The user has the right to obtain the erasure of their data from the controller;
Receive their data or have it transferred to another controller: The user has the right to receive their data in a structured, commonly used, and machine-readable format and, if technically feasible, to have it transmitted to another controller without any hindrance;
Lodge a complaint: The user has the right to bring a claim before their competent data protection authority or take legal action.

Users are also entitled to learn about the legal basis for data transfers abroad, including to any international organisation governed by public international law or set up by two or more countries, as well as about the security measures taken by the controller to safeguard their data.

How to Exercise Rights

Any requests to exercise user rights can be directed to the controller through the contact details provided in this document. These requests can be exercised free of charge and will be addressed by the controller as soon as possible, providing the user with all the information required by law. Any rectifications, erasures, or restrictions of processing will be communicated by the controller to each recipient, if any, to whom the personal data has been disclosed, unless this proves impossible or involves a disproportionate effort.

Who to Contact to Lodge a Complaint

If you believe that the processing of your data violates the provisions of the Regulation, you can always lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali – www.garanteprivacy.it), or, if different, to the Data Protection Authority of the country where you reside, work, or where the alleged violation occurred.

System Logs and Maintenance

For operation and maintenance purposes, this application and any third-party services it uses may collect system logs, which are files that record interactions and may also contain personal data, such as the user’s IP address.

Information Not Contained in This Policy

More details concerning the collection or processing of personal data may be requested from the data controller at any time using the contact details.

Changes to This Privacy Policy

The data controller reserves the right to make changes to this privacy policy at any time by notifying its users on this page.