This notice is provided pursuant to Art. 13 of Regulation (EU) 2016/679 (GDPR) and concerns the processing of personal data of users visiting the website https://www.florenceacademy.it.
1. Data Controller
The data controller is:
Florence Academy
FLORENCE ACADEMY S.R.L.
VAT No. IT07201330482
Registered office: VIA DE GINORI 15 – 50123 – FLORENCE (FI)
PEC: florenceacademy@pec.it
2. Types of data collected
The following personal data may be collected through the Website:
- Browsing data: IP addresses, browser type, operating system, date and time of access, pages visited.
- Data provided voluntarily: first name, last name, email, phone number, and other data provided through contact forms or newsletter subscriptions.
3. Purpose and legal basis of processing
Personal data are processed for the following purposes:
| Purpose | Legal basis |
|---|---|
| Responding to requests for information sent via the website | Legitimate interest of the Controller |
| Enrollment in courses or activities offered by the school | Performance of a contract or pre-contractual measures |
| Sending newsletters or promotional communications | Consent of the data subject |
| Website security and prevention of abuse | Legitimate interest of the Controller |
| Fulfillment of legal obligations | Legal obligation |
4. Processing methods
Data are processed using electronic and/or manual tools, with technical and organizational measures appropriate to ensure their security and confidentiality.
5. Data retention
Data will be kept for the time strictly necessary to achieve the purposes for which they were collected, and in any case no longer than:
- 24 months for data collected for marketing purposes (unless consent is withdrawn)
- 10 years for tax or accounting obligations
- Up to 6 months for technical browsing logs
6. Communication and transfer of data
Data may be communicated to authorized third parties appointed as data processors (e.g., web service providers, hosting, newsletter management, consultants).
Data will not be transferred outside the European Economic Area, unless adequate safeguards are in place according to the GDPR.
7. Rights of the data subject
At any time, the user may exercise the rights provided for in Articles 15-22 of the GDPR, in particular:
- right of access
- rectification or erasure
- restriction of processing
- objection
- data portability
- withdrawal of consent (without affecting the lawfulness of the previous processing)
- complaint to the Data Protection Authority (www.garanteprivacy.it)
To exercise your rights, you can write to: [Insert email or PEC]
8. Changes to this notice
This notice may be subject to updates. Users are invited to consult it periodically.