Privacy Policy

This privacy notice is intended to provide all information regarding the processing of personal data carried out by Rome University of Fine Arts S.r.l. when the User accesses and browses this site and/or the related social media pages (as better specified below).

1. INTRODUCTION – WHO WE ARE

Rome University of Fine Arts S.r.l., with registered office at Giuseppe Gioachino Belli, 86, 00193 Rome, Tax Code no. 09227921005, VAT no. 12581670960 and company registration number: 09227921005 in the Companies Register (hereinafter, the “Data Controller”), owner of the website www.scuoladesign.com and the related social media pages (hereinafter, the “Site”), as the controller of the personal data processing of users browsing the Site (hereinafter, the “Users”), hereby provides this privacy notice pursuant to Article 13 of EU Regulation 2016/679 of 27 April 2016 (hereinafter, the “Regulation”, or the “Applicable Legislation”).

2. HOW TO CONTACT US?

The Data Controller places the utmost importance on the right to privacy and the protection of its Users’ personal data. For any information relating to this privacy notice, Users may contact the Data Controller at any time using the following methods:

  • By sending a registered letter with return receipt to the Data Controller’s registered office at Via Giuseppe Gioachino Belli, 86, 00193 Rome;
  • By sending an email to privacy@scuoladesign.com.

The Data Controller has not appointed a Data Protection Officer (DPO), as it is not subject to the obligation of appointment under Article 37 of the Regulation.

3. WHAT DO WE DO? – PURPOSES OF THE PROCESSING AND LEGAL BASIS

By browsing the Site, as well as by consulting the related social media pages of the Data Controller, the User may obtain information about the services offered by the Data Controller, the events organized (e.g. open days), educational offers, news relating to the school and its campuses. Through the social media pages, the User may also interact with the Data Controller and its community.

In addition, the User may:

    1. Request information and guidance services, submit requests as well as take part in educational and professional activities promoted by the school, such as:
      • Sending requests relating to the publication of content, profiles, or projects in the dedicated sections of the site (e.g. Alumni area or similar initiatives) and managing the resulting communications with the data subject
      • more information on the various courses offered by the school (hereinafter, “Course Information”);
      • booking a guidance meeting to obtain detailed information or visit the campuses (hereinafter, “Guidance Meeting”);
      • requesting information on all scholarships (hereinafter, “Scholarships”);
      • submitting a spontaneous application in the “Work with us” section through the “Register” form;
      • contacting the Data Controller using the contact details provided or by filling in the form, both available in the “Contacts” section (hereinafter “Contact the data controller”);
      • submitting a direct enrollment application (for which, however, reference should be made to the relevant privacy policy, accessible from the dedicated form).
      • Interact with the Data Controller’s social community (hereinafter, “Social Interaction”),
      • Enroll in the Short Courses, Three-Year Programs, Master’s Programs and/or Preparatory Courses offered by the Data Controller (hereinafter, “Enrollment in Courses”);
      • Book an individual orientation meeting to obtain detailed information or visit the campuses (hereinafter, “Individual Interview”).

(hereinafter, collectively, the “Service” or the “Services”).

In relation to the Service, the Data Controller collects personal data relating to Users.

In particular, Users’ personal data will be lawfully processed by the Data Controller for the following purposes of processing:

a) Provision of the Service: to enable the provision of the Service through the User’s browsing of the Site.

Depending on the specific aspect of the Service used, the Data Controller may process:

  • Browsing data: all personal data whose transmission is implicit in the use of Internet communication protocols, such as: IP addresses used by users connecting to the Site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, log files, and other parameters relating to the User’s operating system and IT environment.
  • First name, last name, email address, phone number, as well as all further personal information requested in the various forms and/or communicated in the chat, as well as any additional data voluntarily provided by the User, including, where deemed necessary by the data subject/functional to the request, any data belonging to special categories under Article 9 of the Regulation (e.g. health-related data).
  • (in the case of Social Interactions) the User’s nickname and contact details on the specific social network used, as well as comments and interactions with the content of the Data Controller’s social media pages.

Unless the User gives the Data Controller specific and optional consent to process their data for the further purposes set out in the following paragraphs, the User’s personal data will be used by the Data Controller exclusively to verify the User’s identity (including by validating the email address), thus avoiding possible fraud or abuse, and to contact the User solely for service-related reasons (e.g. to send notifications relating to the services offered by the Data Controller). Without prejudice to what is provided elsewhere in this privacy notice, under no circumstances will the Data Controller make Users’ personal data accessible to other Users and/or third parties.

In certain forms, required data will be indicated with an asterisk: in the absence of such symbol, all requested data shall be understood to be required.

b) administrative and accounting purposes, namely to carry out activities of an organizational, administrative, financial, and accounting nature, such as internal organizational activities and activities functional to the fulfillment of contractual and pre-contractual obligations;

c) legal obligations, namely to comply with obligations established by law, by an authority, by regulations, or by European legislation.

The provision of personal data for the processing purposes indicated above is optional but necessary, since failure to provide such data will make it impossible for the User to browse the Site and use the Services offered by the Data Controller on the Site.

Without prejudice to what is provided elsewhere in this privacy notice, under no circumstances will the Data Controller make Users’ personal data accessible to other Users and/or third parties.

In relation to the purposes described above, the following legal bases for the processing are identified:

  • Management of the Service (as described in paragraph 3(a) above): the legal basis consists of Article 6(1)(b) of the Regulation, namely that the processing is necessary for the performance of a contract to which the User is party or in order to take steps at the request of the User prior to entering into a contract. In the event of processing personal data belonging to special categories, the legal basis consists of Article 9(2)(a) of the Regulation, namely the explicit consent given by the data subject by voluntarily communicating such data to the Data Controller within the open fields of the forms or the chat.
  • Administrative and accounting purposes (as described in paragraph 3(b) above): the legal basis consists of Article 6(1)(b) of the Regulation, since the processing is necessary for the performance of a contract and/or in order to take steps at the request of the User prior to entering into a contract.
  • Legal obligations (as described in paragraph 3(c) above): the legal basis consists of Article 6(1)(c) of the Regulation, since the processing is necessary for compliance with a legal obligation to which the Data Controller is subject.

4. FURTHER PURPOSES OF PROCESSING

4.1 Marketing (sending advertising material, direct sales and commercial communications)
If the user registers through a dedicated web form and/or provides consent in connection with another request, certain personal data of the User (namely first name, last name, email address, and phone number) may also be processed by the Data Controller for marketing purposes (sending advertising material, direct sales, and commercial communications), so that the Data Controller may contact the User by email (newsletter), post, telephone (landline and/or mobile, with automated calling or communication systems with and/or without the intervention of an operator) and/or SMS and/or messaging services and/or for the purpose of creating custom audiences or lookalike audiences on the Data Controller’s social media pages, in order to propose services offered by the Data Controller itself and/or by partners, present offers, promotions, and commercial opportunities.

If consent is not given, the possibility of registering on the Site will in no way be affected.
If consent is given, the User may revoke it at any time by requesting this from the Data Controller using the methods indicated in paragraph 8 below.

Specific note on communications by email (newsletter): the User may also easily object to further promotional communications by email by clicking on the appropriate link to withdraw consent, which is included in each newsletter email. If the User intends to withdraw consent to receiving promotional communications by telephone while continuing to receive promotional communications by email, or vice versa, they are requested to send a request to the Data Controller using the methods indicated in paragraph 8 below.

The Data Controller informs Users that, following the exercise of the right to object to the sending of promotional communications by email, it is possible that, for technical and operational reasons (e.g. contact lists having already been prepared shortly before the Data Controller receives the objection request), the User may continue to receive some additional promotional messages. Should the User continue to receive promotional messages after 24 hours have elapsed since exercising the right to object, they are requested to report the issue to the Data Controller using the contact details indicated in paragraph 8 below.

Specific note on promotional activities through social networks: in particular with regard to interaction with social media pages, if the User has given consent to the use of profiling cookies on the Site, the Data Controller may also process the User’s contact data (in particular the email address) and the data communicated by the user during interaction with the social media pages – such as information provided by the user to the social media platform based on the privacy settings selected on that social media platform – to show the User promotional advertisements and content consistent with their interests, based on preferences and consumption habits identified through cookies and/or other tracking systems of the social media managers (to whose terms and conditions reference is made) and/or following the analysis that the social media platforms themselves carry out on their users.

In particular, the Data Controller may show relevant marketing content and interest-based advertising through digital platforms, where information about the User’s preferences and interests, consumption habits, spending capacity, etc. has been acquired: (i) following profiling activity carried out on the Site and shared (also via API) with the digital platforms; or (ii) based on the match between the preferences and interests expressed by the User who visited the Site and accepted profiling cookies and the cluster of users identified by the social platform (e.g. retargeting); (iii) using the targeting tools made available by social platforms, by defining the target of users potentially interested in the Data Controller’s services and addressing the social platforms to distribute advertising messages in a targeted manner to users of those platforms who match the defined target. If the User interacts with that advertisement on the social platform, such interaction may be assessed for the purposes of the effectiveness of the campaign itself, where the User has accepted the use of tracking tools, such as by way of example the Meta Pixel or TikTok Pixel installed on the Site, through the cookie management tools (e.g. prospecting). Further information on processing carried out through tracking tools is available in the Cookie Policy.

5. METHODS OF PROCESSING AND DATA RETENTION PERIODS

The Data Controller will process Users’ personal data using manual and IT tools, with logic strictly related to the purposes themselves and, in any case, in such a way as to ensure the security and confidentiality of the data.

The personal data of Users of the Site will be retained for the time strictly necessary to fulfill the primary purposes illustrated in paragraph 3 above, or in any case according to what is necessary for the protection of the interests of both the Users and the Data Controller in civil proceedings.

In the cases referred to in paragraph 4 above, Users’ personal data will be retained for the time strictly necessary to fulfill the purposes illustrated therein and, in any case, until the User withdraws their consent.

6. SCOPE OF COMMUNICATION AND DISCLOSURE OF DATA

The User’s personal data may be transferred outside the European Union and, in such case, the Data Controller will ensure that the transfer takes place in compliance with the Applicable Legislation and, in particular, in compliance with Articles 45 (Transfer on the basis of an adequacy decision) and 46 (Transfer subject to appropriate safeguards) of the Regulation.

Employees and/or collaborators of the Data Controller responsible for managing the Site and Users’ requests may become aware of Users’ personal data. Such persons, who have been instructed accordingly by the Data Controller pursuant to Article 29 of the Regulation, will process Users’ data exclusively for the purposes indicated in this notice and in compliance with the provisions of the Applicable Legislation.

Third parties may also become aware of Users’ personal data, where they may process personal data on behalf of the Data Controller as Data Processors, such as, by way of example, IT and logistics service providers functional to the operation of the Site, outsourcing or cloud computing service providers, professionals, and consultants. Specifically, with reference to the newsletter service, the data are also processed through the platform and IT tools offered by the “Benchmark Email” service, provided by the American company Benchmark Internet Group, LLC, 10621 Calle Lee, Building 141 Los Alamitos, CA 90720.

Users have the right to obtain a list of any data processors appointed by the Data Controller by submitting a request to the Data Controller using the methods indicated in paragraph 8 below.

7. DATA SUBJECTS’ RIGHTS

Users may exercise the rights guaranteed to them by the Applicable Legislation by contacting the Data Controller using the following methods:

  • By sending a registered letter with return receipt to the Data Controller’s registered office at Giuseppe Gioachino Belli, 86, 00193 Rome;
  • By sending an email to: privacy@scuoladesign.it.

The Data Controller has not appointed a Data Protection Officer (DPO), as it is not subject to the obligation of appointment under Article 37 of the Regulation.

Pursuant to the Applicable Legislation, the Data Controller informs Users that they have the right to obtain information on: (i) the origin of the personal data; (ii) the purposes and methods of the processing; (iii) the logic applied in the event of processing carried out with the aid of electronic tools; (iv) the identification details of the controller and processors; (v) the subjects or categories of subjects to whom personal data may be communicated or who may become aware of them as processors or persons in charge.

In addition, Users have the right to obtain:

  1. access to, updating, rectification or, where interested therein, completion of the data;
  2. erasure, anonymization or restriction of data processed in breach of the law, including data that need not be retained in relation to the purposes for which the data were collected or subsequently processed;
  3. certification that the operations referred to in letters a) and b) have been made known, including as regards their content, to those to whom the data were communicated or disclosed, except where this requirement proves impossible or involves a manifestly disproportionate effort compared with the right protected.

In addition, Users have:

  1. the right to withdraw consent at any time, where the processing is based on their consent;
  2. the right to data portability (the right to receive all personal data concerning them in a structured, commonly used, and machine-readable format);
  3. the right to object:
    1. in whole or in part, on legitimate grounds, to the processing of personal data concerning them, even though relevant to the purpose of collection;
    2. in whole or in part, to the processing of personal data concerning them for the purpose of sending advertising material or direct sales or for carrying out market research or commercial communication;
    3. where personal data are processed for direct marketing purposes, at any time, to the processing of their data carried out for such purpose, including profiling to the extent that it is related to such direct marketing.
  4. where they consider that the processing concerning them infringes the Regulation, the right to lodge a complaint with a supervisory authority (in the Member State in which they habitually reside, work, or where the alleged infringement occurred). The Italian supervisory authority is the Garante per la protezione dei dati personali, with registered office in Piazza Venezia no. 11, 00187 – Rome (http://www.garanteprivacy.it/).

The Data Controller is not responsible for updating all links viewable in this Notice; therefore, whenever a link is not working and/or updated, Users acknowledge and accept that they must always refer to the document and/or section of the websites referred to by such link.