Pursuant to Article 13 of EU Regulation 2016/679 (GDPR), this notice explains the processing of personal data of students and participants in the training activities organised by M.C.G. Consulting Srl (Tax Code/VAT No. 02724720996), the data controller.
1. Purposes of processing
- To meet pre-contractual requirements (processing of quotes or orders, creditworthiness checks, etc.);
- To fulfil contractual and legal obligations (bookkeeping, tax formalities, administrative management);
- Operational, organisational, management, tax, payment, financial, insurance and accounting requirements;
- To comply with obligations imposed by laws, regulations or EU legislation;
- Indirect marketing, through the publication of photos, images and videos for the purpose of advertising the Controller's products and services – subject to your explicit consent.
2. Categories of data processed
First and last name; place and date of birth; residential address; tax code; e-mail address; telephone number; identity document details; school attendance certificate; residence permit, where applicable.
During the lessons and events organised, photos and video footage may be taken, with your explicit consent, which may be published on the Company's website, on the Controller's social media channels or other means of dissemination.
3. Processing methods
Processing will be carried out manually and in a partially automated manner, using both paper records and electronic, IT and telematic tools, in compliance with Article 32 of the GDPR and Legislative Decree 196/03 on security measures.
4. Nature of the data provided
The provision of data is mandatory and essential for purposes 1-4 and does not require your consent; it is optional and requires your explicit consent for purpose 5. Refusal to provide mandatory data may make it impossible to provide the training service; refusal of marketing processing causes no detriment.
5. Parties who may access the data
- employees and staff of the Controller, acting as persons in charge and/or processors and/or system administrators;
- third-party companies or other parties (credit institutions, professional firms, consultants, insurance companies, etc.) that carry out outsourced activities on behalf of the Controller, acting as external data processors.
Data strictly necessary to obtain the certification provided for under the contract will be transferred outside the European Union, specifically to the United Kingdom, solely for the fulfilment of contractual purposes.
6. Your rights (Article 15 GDPR)
- obtain confirmation of the existence of personal data concerning you and its disclosure in an intelligible form;
- obtain information on the source, purposes, methods and logic of processing, and on the recipients;
- obtain the updating, rectification, completion, erasure, anonymisation or blocking of data processed unlawfully;
- object, in whole or in part, on legitimate grounds or in respect of advertising communications.
Where applicable, you also have the rights under Articles 16-21 GDPR (rectification, erasure, restriction, portability, objection) and the right to lodge a complaint with the Data Protection Authority.