Arsutoria School S.r.l. is very committed to the privacy and protection of personal data. We hereby inform you about how we will process your Personal Data in accordance with the European Data Protection Regulation.

This policy applies to the website arsutoriaschool.com , and governs the processing of your Data when you access the Websites, when you complete the registration process for the sites, when you request information or want to be contacted.

What personal data will we use?

You can access the Websites without being asked to provide any of your Personal Data. However, the computer systems used to manage the Websites acquire, during their normal operation, some personal data whose transmission is implicit in the use of internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature, could allow identifying users, through processing and associations. This category includes, for example, the IP addresses of computers that connect to the Websites, the URL of the resources requested and the time of the request. This Data is used, anonymously, for statistical purposes in connection with the use of the Websites and to check their proper functioning, and are deleted immediately after being processed. This Data does not involve the processing of directly identifying information. In order to register on the Websites, to place online purchase orders, to process your requests for information on our products and services and to use the App, we need to process the data requested in the relevant forms (the failure to provide data marked with an asterisk will make it impossible to complete the registration process and/or to purchase our products or use the App). With your consent, we may also use other information that you freely provide at the time of registration or relating to the methods in which you interact with us (hereinafter collectively, the “Data”). More precisely, we can collect:

• navigation data
• anonymised IP address
• in case of online registration or purchase: first and last name, address, email, telephone number
• optional information requested through the registration and purchase forms
• information we may collect by reviewing your interaction with us, through the Websites, email and newsletters.

For what purposes do we use your Data and on what legal basis?

We use your Data, also by electronic means:

1. to enable you to browse the Websites. For this purpose, we will only process navigation data.

2. to enable you to ask for information and quotations. Your Data will be used for purposes relating to the contact you have with us, management and/or cancellation of your application, and also for fulfilling the legal obligations. Any refusal to provide, in whole or in part, such Data may prevent us from correctly executing orders and/or fulfilling the specific requests and/or allowing you to participate in our courses.

With your consent, we may also use your Data for the following purposes:

3. to send you newsletters, information on products and services provided by our company, offers and promotions, as well as conduct market surveys. For example, we can send you emails, promotional materials to your postal address or contact you by telephone via an operator.

4. to review your preferences, the way you interact with us and your purchasing behaviour.  In particular, in order to better understand your tastes and interests in our products and services, we may examine – also through the use of automated systems – the information provided.

In any event, this profiling activity does not have any legal consequences on you, nor does it have any significant effect on you.

How long do we keep your Data?

Your Data will be processed no longer than is strictly necessary to achieve the purposes for which it was collected, in accordance with the current legislation. In any case, for marketing and/or profiling purposes, the data relating to your purchases will not be processed for a period exceeding 24 months, while the information related to your interaction with us will not be processed for a period exceeding 12 months.

Who do we share your Personal Data with?

To achieve the aforesaid processing purposes, your Data may be disclosed to third parties, including service providers (e.g. providers of IT services) as well as other external parties in accordance with the law or regulation. You can have a complete list of these companies by sending a written request to the addresses indicated below.

How will the transfer of your data to countries outside the EU be regulated?

Your Data may be transferred outside the territory of the European Union, even in countries where the level of protection of personal data may be lower than that guaranteed by European legislation. This transfer will take place, in any case, in compliance with the standard contractual clauses approved by the EU Commission with decision no. 2010/87/CE: More info on https://ec.europa.eu/info/law/law-topic/data-protection_en

What rights can you exercise?

You have the right to request:

• access to your Data
• rectification or erasure of them
• restriction to the processing or to oppose their use by us
• the delivery of some of these

Right of access

The Data Subject shall have the right to obtain from the Data Controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, to obtain access to personal data and to the following information:

1. the purposes of the processing;
2. the categories of personal data concerned;
3. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations and if so, the existence of appropriate safeguards;
4. where possible, the envisaged period for which the personal data will be stored, or if not possible, the criteria used to determine that period;
5. the existence of the right to request from the Data Controller rectification or erasure of personal data or restriction of processing of personal data concerning the Data Subject or to object to such processing;
6. the right to lodge a complaint with a supervisory authority;
7. where the personal data are not collected from the data subject, any available information as to their source;
8. the existence of automated decision-making process, including profiling, which produces legal effects concerning him  or her or similarly significantly affects him or her and, at least in those cases, meaningful information about the logic used, as well as the significance and consequences of such processing for the Data Subject.

Right to rectification

The data subject shall have the right to obtain from the data controller without undue delay the rectification of inaccurate personal data.

Right to erasure

The data subject shall have the right to obtain from the data controller the erasure of personal data concerning him or her without undue delay, and the controller shall have the obligation to erase said personal data without undue delay where one of the following grounds applies:

1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing;
3. the data subject objects to the processing, and there are no overriding legitimate grounds for the processing;
4. the personal data have been unlawfully processed;
5. the personal data have to be erased for compliance with a legal obligation provided by Union or Member State law to which the data controller is subject;

Right to restriction of processing

The data subject shall have the right to obtain from the data controller restriction of processing where one of the following applies:

1. the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of said personal data;
2. the processing is unlawful, and the data subject opposes the erasure of personal data and requests the restriction of their use instead;
3. the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
4. the data subject has objected to the processing, pending the verification whether the legitimate grounds of the controller override those of the data subject.

Right to object

The data subject shall have to right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her, including profiling. The data subject also has the right to object at any time to the processing of personal data concerning him or her for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing.

Right to data portability

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a Data Controller, in a structured, commonly used and machine-readable format and has the right to transmit those data to another Controller without hindrance from the Controller to which the personal data have been provided: a) the processing is based on consent and on a contract; and b) the processing is carried out by automated means. In exercising his or her rights to data portability, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

How can you change your preferences or withdraw your consent?

You may control, change or withdraw your consent at any time in relation to the purposes referred to in letters (c) and (d) (including by declaring that you do not wish to receive commercial information by email or instant messages (e.g. SMS)). Simply change the settings in your private area or contact the Company.

How to contact Arsutoria School to exercise your rights?

You may exercise your rights by writing to the data controller, Arsutoria School S.r.l. at the addresses indicated below: Arsutoria school S.r.l. Tel: 02 319121 Email: dc@arsutoria.com Certified email (PEC): arssutoriaschoolsrl@legalmail.it Registered office: Via Ippolito Nievo 33 – 20145, Milan

How can I contact the competent supervisory authority for submitting a complaint?

Any complaints can be submitted to the Guarantor for Personal Data Protection available at the following contacts:

Guarantor for Personal Data Protection

Piazza di Monte Citorio n. 121 00186 Rome, Italy Fax: (+39) 06.69677.3785 Tel: (+39) 06.696771 E-mail: garante@gpdp.it Certified email (PEC): protocollo@pec.gpdp.it

Changes to this privacy policy

This privacy policy may be subject to changes or updates, in whole or in part, due to changes in the applicable laws; if changes are made to the way in which your data is processed, we will inform you of such changes. In any event, we invite you to periodically review the updated privacy policy posted on the websites.