INFORMATION ON THE PROCESSING OF PERSONAL DATA

(Art. 13 EU Regulation 679/2016)

Pursuant to the current Regulation (EU) 2016/679 (GDPR), the Istituto Tecnico Superiore del Turismo e dell’Ospitalità IATH (“IATH”), with registered office in via Regina 5 – 22012 Cernobbio (Como) (tel: 031341873; e-mail: info@iath.it) as Data Controller, informs you that your personal data will be processed in full compliance with the obligations and principles of the law, guaranteeing full protection of the fundamental rights and freedoms recognized to you.

1. PURPOSES OF PERSONAL DATA PROCESSING AND LEGAL BASIS

The processing of your personal data is carried out for the following purposes:

• evaluation of your application for admission to the IATH Academy courses
• sending correspondence and information on IATH initiatives including sending newsletters
• preliminary planning of his/her study path
• respond to requests for information and fulfill obligations required by public administration and other entities that finance us
• any other purpose required by the regulatory provisions for the correct fulfillment of the contractual obligations between you and our Foundation

The processing of your personal data is necessary for the execution of pre-contractual measures adopted at your request (art. 6.1.b GDPR).

2. DATA ACQUISITION AND TYPES OF DATA PROCESSED

The IATH Foundation acquires your personal data directly from you. The categories of data acquired and processed are as follows:

• Personal and contact details Including the photographic image taken from your identity document
• Information regarding your educational and professional background and your employment status
• Information about your country of origin and other information from your CV

3. NECESSITY OF PROVIDING PERSONAL DATA

The collection of your personal data is mandatory in order to carry out the selection process and evaluate your application for admission. Failure to consent to the processing and therefore to the collection of data, resulting in the impossibility of fulfilling our obligations, does not allow us to accept your application for admission.

 

4. PERIOD OF PERSONAL DATA PROCESSING

Your data will be processed for the time necessary to carry out the aforementioned verification and selection process and until the deadline established by law for enrollment in the IATH Academy courses and will be deleted if you are not admitted.

5. METHODS OF PERSONAL DATA PROCESSING

The processing of your data will be carried out using paper and computer tools, in compliance with all the technical and organizational measures established by the IATH Foundation to guarantee the security and confidentiality of the information. The processing will be carried out according to principles of correctness, lawfulness, transparency, in order to protect your rights in compliance with the provisions of the EU Regulation.

6. PERSONNEL AUTHORIZED TO PROCESS PERSONAL DATA

Your personal data are processed by internal staff of the IATH Foundation organization, trained and authorized by the Data Controller, who will be bound by professional secrecy and maximum confidentiality.

Your data may also be processed by consultants and service providers external to our organization such as, for example, IT service companies. These entities process personal data in compliance with the regulations on the protection of personal data and under the control of the Data Controller and, where applicable, are appointed as Data Processors.

The personal data provided by you are also known by the system administrators only for maintenance and security control needs of the computer systems.

7. COMMUNICATION OF PERSONAL DATA

Your data may be communicated to third parties, exclusively for technical and operational needs strictly connected to the purposes stated above and in particular to the following categories of subjects:

• to public authorities and administrations (e.g. Provincial Administration of Como, Lombardy Region) for purposes connected with the fulfillment of legal obligations;
• to our financing bodies (e.g. European Union);
• to subjects to whom the faculty of accessing personal data is recognized by provision of law or secondary or community legislation;
• to subjects to whom the communication of personal data is necessary or is otherwise functional to the performance of contractual obligations in place.

The personal data acquired will not be disclosed and will not be transferred outside the European Union.

8. RIGHTS OF THE DATA SUBJECT

You may at any time ask the Data Controller to access, rectify, delete, limit, transfer (Articles 15 to 20 of the GDPR) your personal data. You also have the right to ask the Data Controller not to be subjected to automated decision-making processes (Art. 22).

At any time, by contacting the Data Controller, you also have the right to modify or revoke your consent to the processing of your data (Art. 21) without prejudice to the lawfulness of the processing prior to the revocation and in any case being informed of what is reported in point 3 of this Information.

In addition to the rights listed above, you may at any time lodge a complaint with the Supervisory Authority on the website www.garanteprivacy.it.