Privacy Policy

Studenti Contatti Occasionali Photo-video Disclaimer

Privacy Policy Students

PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ART. 13 OF EU REGULATION 679/2016

Premise

For the “Ente per le Arti Applicate alla Moda ed al Costume”, hereinafter “Polimoda”, the protection of your personal data is particularly important. For this reason, your personal data are collected and processed with the utmost care and attention, while adopting specific organizational and technical measures to ensure full security of their processing.

Pursuant to Art. 13 of EU Regulation 679/2016 (hereinafter “GDPR”), Polimoda provides the following information regarding the processing of personal data of enrolled students and those who benefit from Polimoda’s educational services based on agreements with third-party institutions.

1. Data Controller

The Data Controller is the Ente per le Arti Applicate alla Moda e al Costume, named “Polimoda”, with registered office in Florence, Via Curtatone 1, 50123, Tax Code 94015750485 – VAT No. 03758580488.

Certified email (PEC): direzione@pec.polimoda.biz

Email: privacy@polimoda.com

2. Data protection officer (DPO)

The Data Protection Officer (DPO) may be contacted by data subjects for all matters concerning the processing of their personal data and the exercise of rights under EU Regulation 679/2016 at: rpd@polimoda.com

3. Personal data processed

The Data Controller will process the following categories of personal data and information:

so-called “ordinary” personal data, such as: name, surname, residential address, contact details, and any further information voluntarily provided;

data related to prior school, academic or professional experience and related to the academic career at Polimoda, such as: curriculum vitae, projects, dissertations, study abroad experiences, exams taken, etc.;

information on economic and personal situation, where necessary to access benefits provided by law or by Polimoda for your needs;

special categories of personal data under Art. 9 GDPR, such as those necessary for the management of accidents, insurance claims, etc.

4. Purposes and Legal Basis of Processing, Nature of Provision

	Purpose of processing	Legal Basis	Nature of provision
a)	Enrollment in Polimoda and administrative management of all processes related to the academic career.	Performance of pre-contractual measures and of the contract pursuant to Art. 6(1)(b) GDPR.	Necessary in order to follow up on your enrollment request.
b)	Performance of institutional activities necessary for participation in initiatives related to mandatory curricular activities, supplementary activities, or institutional events, placement and internship services, networking, even after the end of the course of study. Polimoda may also carry out customer relationship management, identifying profiles, interests, experiences, skills, knowledge, in order to offer individualized opportunities for professional and personal growth.	Performance of pre-contractual measures and of the contract pursuant to Art. 6(1)(b) GDPR.	The provision of personal data is necessary to allow Polimoda to carry out the requested training activity.
c)	Access to Polimoda’s services, including consultation and use of Library resources, access to Housing self-service.	Performance of pre-contractual measures and of the contract pursuant to Art. 6(1)(b) GDPR.	The provision of personal data is necessary to allow Polimoda to carry out the requested training activity.
d)	Sending of institutional communications related, for example, to the academic career or to events/initiatives promoted by Polimoda during the period of enrollment, participation in courses, seminars, orientation events, etc.	Performance of pre-contractual measures and of the contract pursuant to Art. 6(1)(b) GDPR.	The provision of personal data is necessary to allow Polimoda to carry out the requested training activity.
e)	Sending of newsletters in paper and/or electronic format, with contents relating to the educational offer and Polimoda services consistent with the preferences and interests expressed by the student.	Consent pursuant to Art. 6(1)(a) GDPR	The provision of personal data is optional and failure to provide such data does not affect the other purposes.
f)	Promotional activities and surveys related to market research initiatives.	Consent pursuant to Art. 6(1)(a) GDPR	The provision of personal data is optional and failure to provide such data does not affect the other purposes.
g)	Transfer of personal data for marketing purposes to third parties, such as Polimoda’s partners.	Consent pursuant to Art. 6(1)(a) GDPR	The provision of personal data is optional and failure to provide such data does not affect the other purposes.
h)	Internal organizational needs, assignment of badges.	Performance of pre-contractual measures and of the contract pursuant to Art. 6(1)(b) GDPR	The provision of personal data is necessary to allow Polimoda to carry out the requested training activity.
i)	Compliance with legal obligations related to the above purposes.	Compliance with a legal obligation to which the Controller is subject pursuant to Art. 6(1)(c) GDPR	Once data are provided for the other purposes, they will also be processed in order to comply with related legal obligations.
j)	Establishing, exercising or defending a right of the Data Controller.	Legitimate interest of the Controller pursuant to Art. 6(1)(f) GDPR	Once data are provided for the above purposes, they may also be processed to protect the rights of the Controller.

A specific privacy notice is available regarding the Association’s video surveillance system.

5. Data retention period (Data Retention)

For purposes a), b), c), d), h): personal data will be retained for the entire duration of the student’s academic career and archived in the public interest pursuant to Art. 4 GDPR.

For purposes e), f): personal data will be processed for 24 months from the date of consent. After this period, you may be asked to renew your consent. Without renewal, your data will be deleted.

For purpose g): once consent is given, data will be transferred to commercial partners acting as independent Data Controllers, who will determine retention periods autonomously. Consent withdrawal may be communicated to Polimoda, which will in turn inform each partner.

For purpose i): data will be processed for the time required by law and for a maximum of 10 years from provision;

For purpose j): if necessary to protect a right of the Data Controller, data will be retained for the entire duration of any extrajudicial or judicial proceedings and for the time required to enforce any resulting decision.

In the event of consent withdrawal, processing based on consent will be interrupted, but personal data will continue to be retained for the subsequent statutory period to demonstrate the lawfulness of prior processing, for up to 10 years after withdrawal.

6. Recipients of personal data

The following categories of subjects may access personal data:

a) Within the organizational structure of the Data Controller, designated persons under Art. 2-quaterdecies Legislative Decree 196/2003, or authorized persons under Art. 29 GDPR, strictly to the extent necessary to pursue the purposes described above, on the basis of specific instructions provided by the Data Controller.

b) Data Processors appointed under Art. 28 GDPR, processing personal data on behalf of the Data Controller (e.g., IT support providers), on the basis of specific contracts ensuring secure processing.

A complete list of such subjects may be requested from the Data Controller at the contact details provided.

If necessary to protect a right or if required by law, personal data may be transmitted to administrative and judicial authorities, acting as independent Data Controllers.

With your explicit consent, personal data may be transferred to third parties, such as Polimoda’s commercial partners, acting as independent Data Controllers, who will provide a specific privacy notice.

7. Transfer of Personal Data Outside the EEA

The Data Controller does not transfer your personal data outside the EEA.

If any third party is established or use Cloud services outside the EU, please note that such countries provide an adequate level of protection as determined by European Commission adequacy decisions.

Transfers to non-EU countries without adequate safeguards will only occur:

• with the consent of the data subject, or
• on the basis of agreements including Standard Contractual Clauses approved by the European Commission, or
• where necessary for the performance of the contract between Polimoda and the data subject or to manage his/her requests.

8. Data Subjects’ Rights

You may exercise the following rights under the GDPR with respect to the personal data covered by this notice:

1. Right of access and rectification (Arts. 15–16 GDPR): to access your personal data and request corrections, modifications, or updates. You may also obtain a copy of your data.
2. Right to erasure (Art. 17 GDPR): in the cases provided for by law, you may request deletion of your personal data.
3. Right to restriction of processing (Art. 18 GDPR): to request restriction of processing in case of unlawful processing or contestation of accuracy.
4. Right to data portability (Art. 20 GDPR): to receive your personal data from the Data Controller in order to transmit them to another controller.
5. Right to object (Art. 21 GDPR): to object at any time to processing based on the Controller’s legitimate interest, explaining reasons justifying your request.
6. Right to lodge a complaint (Art. 77 GDPR): to lodge a complaint with the competent Data Protection Authority if you believe your rights have been violated.
7. Right to withdraw consent (Art. 7 GDPR): to withdraw consent at any time by contacting the Data Controller. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

You may exercise your rights at any time by writing to the Data Controller at the contact details indicated in this privacy notice.

9. Security Measures pursuant to Art. 32 GDPR

Polimoda adopts adequate organizational and technical security measures to safeguard the confidentiality, integrity, completeness and availability of personal data, and to prevent damage, accidental loss, alteration, misuse or unauthorized access.

10. Amendments to this Privacy Notice

This privacy notice may be subject to modifications or integrations over time due to changes in legislation or in the Data Controller’s operations. Updated versions will be provided accordingly.

Occasional Contacts Privacy Policy

This policy statement describes the standard processing carried out by Polimoda on the personal data in order to respond to the request for information, questions or any other kind of request made by its forms.

Data collected from you will be processed according to the following principles: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality. 

1. Data Controller

The Data Controller is Ente per le Arti Applicate alla Moda e al Costume, hereinafter referred to as “Polimoda” having its registered office in Villa Favard, Via Curtatone n.1, Florence

Certified email direzione@pec.polimoda.biz; Standard email: privacy@polimoda.com

2. Type of personal data we may collect

Your name and contact information (such as address, email address and telephone number, as well as your date of birth, national insurance number, or other tax identification number, passport number or national identity card details, country of domicile and nationality, your image – picture and/or video).

Information related to your education and/or employment history and professional profile. We will also keep records on your interaction with the Institute and your preferences.

3. Modality of the Treatment

The personal data is processed either in paper or electronic format. In the latter case, automatic instruments will be used. The data will be kept strictly for the time and scope for which they were collected. Specific security measures are adopted for preventing data breaches, illicit or non-correct uses and non-authorised access.

4. Purposes of Data Processing and legal basis

The processing of your information (also by electronic or automated means) are carried out in the performance of the institutional tasks of Polimoda. Please note that this privacy policy shall apply as long as you do not enter in another relationship with the Institute.

The personal data may be processed for the following purposes:

a) to respond to your particular queries and the usage of requested services

b) for providing you with information related to similar services to those requested, in line with the preferences and interests as shown, institutional communications and retargeting purposes

c) for security and internal organization purposes

d) for research and statistical purposes

e) with your consent, for sending of newsletters in hard copy and/or electronic format with content concerning Polimoda’s educational offer and services.

Polimoda may process your personal data because it is necessary for responding to a particular request from you, for its legitimate interests, because there is a legal obligation or because you have expressed consent.

Please note that the following data are not subject to consent: data processed for security and internal organization purposes; data for the usage of available academic goods and services; data processing institutional tasks of the Institute as well as the performance of activities and communications related to products and services where the individual has shown particular interest; data processing for the compliance of legal obligations.

5. Data communication

Data may be accessed by employees and collaborators of Polimoda, for the purpose of supplying the services requested and limited to information that is instrumental and connected to same.

Moreover, the Data Controller will share the Data Subject’s information to some suppliers for the purpose of providing specific services as requested; for this purpose, these suppliers are named “Processors”. The access of data is always linked to the purposes pointed out previously.

6. International data transfer

The subject’s personal data may be transferred abroad for the provision of certain services; in these cases, transfers are based on decisions of suitability or on the standard clauses of the European Commission

7. Data Subject’s Rights

As data subject, you have the following rights:

– to require us to correct the personal data we hold about you if it is incorrect;

– to require us to erase your personal data;

– to require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent without affecting the lawfulness of our processing based on consent before its withdrawal);

– to receive from us the personal data we hold about you which you have provided to us in a reasonable format specified by you including the purpose of your transmittal to another data controller;

– to object, on grounds related to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights.

Please note that the above rights are not absolute and we may be entitled to refuse requests where exceptions apply.

If you have given your consent and you wish to withdraw it, please contact the responsible of the relevant department using the contact details set out below. Please note that where our processing of your personal data relies on your consent and where you then withdraw that consent, we may not be able to provide all or some aspects of our services to you and/or it may affect the provision of those services.

8. Contact us

If you have any queries about this privacy notice or how we process your personal data, you can contact our Data Protection Officer at the following e-mail address: privacy@polimoda.com.

Privacy Policy e photo-video Disclaimer

This policy statement describes the standard processing carried out by Polimoda on the personal data of individuals visiting or interacting with the internal website platform, for virtual events (Event) promoted by Polimoda, as Data Controller.

For the purpose of the GDPR

    Data Subject is the natural person to whom personal data refers

    The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of the personal data (The data Controller is the Ente per le Arti Applicate alla Moda e al Costume, known as “Polimoda”, with headquarters at Villa Favard, Via Curtatone n.1, Florence. Certified email direzione@pec.polimoda.biz; standard email: privacy@polimoda.com)

    A processor is a natural or legal person who processes personal data on behalf of the controller.

Purpose of data processing and legal basis

The treatment of personal data is based on your consent, which is free and optional, but also necessary for the performance of the service requested; denying to provide it, makes Polimoda not able to supply all or some aspects of its services.

Processing is required:

• to provide the services requested (e.g. registration to the Platform, application to participate in the Events, virtual visits, live broadcasts, workshops, access to the Meeting rooms, interaction with other participants, and persons in charge of the service, webinar, videoconferences…)
• to respond to your particular queries and the usage of the services on the site;
• to perform all the administrative and organizational activities related to these services;
• for the compliance with contractual and legal obligations;
• for the performance of Polimoda’s institutional tasks as well as the performance of activities and communications related to Polimoda’s products and services: this will also include sending multimedia aids, circulation of periodical publications (soft spam) from Polimoda or third parties in so far as Partner of the Event, for services in line with the preferences and the choice you make with regard to the Event. It is intended that you may always object to the processing by simply contacting the DPO (Data Protection Officer) at the address at the end of this notice.

The data you provide may also be processed to analyze your interests and preferences within the activities promoted by Polimoda, in order to provide targeted communications, focused on the interests you have shown, and for improving our services.

The described processing is lawful in so far as the following applies:

• free and express consent (art.6.1. a GDPR);
• it is necessary for responding to a particular request of service from you, to interact with you, to deal with any concerns or feedback you may have (art. 6.1. b GDPR);
• it is necessary to comply with a legal obligation (art. 6.1.c GDPR);
• it is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, believing that such interests are not overridden by your interests or fundamental rights (art 6.1. f GDPR, art. 130, D.lgs 196/2003) in that related products and services that objectively might be of professional interest or in line with the preferences expressed. Your consent can be freely withdrawn, in any case.

Type of personal data processed

We may collect the following types of personal data about you:

• the contact information you input in open text fields in help/contact us forms of our websites: your name, address, email address and telephone number, as well as your date of birth, tax identification number and your passport number or national identity card details, country of domicile, nationality, bank data;
• information related to your education and employment history and your professional profile. We will also keep records on your interaction with Polimoda and your preferences;
• information passively collected during your visit to our websites that may include navigational data and device information (like IP address, hardware model, operating and mobile network information);

We can process specific data (information relating to your health or your personal situation, art 9.1 GDPR) only if expressly requested by you in order to provide personalized assistance. 

Your data can only be accessed by employees and collaborators of Polimoda to supply the services requested and limited to information that is instrumental and connected to the same. 

Moreover, Polimoda will share your information with some suppliers to provide specific services, these suppliers are named “Processors” (their list is constantly updated and available on request by contacting the address below or sending an e-mail to privacy@polimoda.com).

In all other cases, Polimoda as Data Controller will not communicate personal information to other parties without your consent, unless this is required by law or a public authority.

Data recorded on web-Platform will not be disseminated or disclosed to third parties without your expressed consent.

With reference to personal images, please refer to the following special article. 

Modality of treatment

Personal data is processed either in paper or electronic format. In the latter case, automatic instruments will be used.

The Data will be kept strictly for the time and scope for which they were collected, except data for which retention is required by law or accounting or for taxation purposes, or to safeguard the entity, which is set at 10 years by law.

Images and films used will be stored for as long as the institutional aims are in place.

Images and films that are processed based on consent will be retained until the withdrawal of consent, in which case, your distinguishing features will be obscured or deleted.

Specific security measures are adopted for preventing data breaches, illicit or incorrect use, and unauthorized access.

Use of the services offered by the web application

As this processing is required to allow the registration in the web-Platform and related services provided (Events, including virtual visits, live broadcasts, workshops, access to the Meeting rooms, interaction with other participants and the persons in charge of the service, live chats, videoconferences) please note that browsing some areas inevitably makes visible some personal data (e.g. your name or image to other users online) as well as interacting with the reference persons for the Events (as above specified) allows them to view and acquire some data.

Processing of images

During the event, your user name and profile image may be displayed if some social network functions are used (e.g. by registering on-line with a Google account, Facebook account, Linkedin account, etc).

In addition, for the performance of Polimoda’s institutional tasks, as well as the performance of institutional communication campaigns, we can use video footage, pictures, and more materials about the Events which may accidentally include your personal image. The implementation of such activities is for informational and promotional purposes concerning the Events and can be promoted on media as well as social networks.

In no case are individual virtual meetings recorded. Your images will not be identified using full names or personal identifying information without prior written approval, except in the case you are logged into one of your social media accounts.

The abovementioned contents are protected and defended by current legislation on copyright and the use of images (RD 633/1941) as well as the GDPR. 

That said, as Data subject, having nothing to claim, you:

• authorize Polimoda or any Data processor appointed by Polimoda, for the abovementioned legitimate purposes, to acquire pictures, video, audio recordings, and grant Polimoda – free of charge – the right to use those recordings for their dissemination and publication on its official communication channels and/or in any other form of publication aimed at promoting the Events; 
• acknowledge and accept that Polimoda cannot be considered in any way responsible for any incorrect use of your images that anyone may make, waiving any claims against it;
• declare to have read and agreed to the privacy policy and by ticking the box specifically approve the release and transfer of rights, under your own responsibility.

Data Subject’s rights

In your capacity of the data subject, you will be guaranteed all the rights specified in art. 15 – 20 GDPR. 

You have the right to:

• obtain access to your personal data;
• rectify inaccurate personal data;
• have personal data erased without undue delay if none of the grounds indicated in art. 17 applies;
• restrict the processing of your personal data under the condition laid down in art. 18;
• the portability, in a specific format, of your personal data that is in Polimoda’s possession;
• withdraw your consent, without compromising the legitimacy of the consent-based processing before your consent is revoked;
• oppose one of our specific processing activities, for reasons connected to individual specific situations, if it is deemed that the impact is disproportionate to your rights;

In any case, you shall have the right to complain to the supervisory national Authority, through the apposite form on the website (http://www.garanteprivacy.it/).

The abovementioned rights can be exercised in writing by email, certified email, or fax, or by registered letter with recorded delivery to the headquarters of Polimoda at the following address:

Email: privacy@polimoda.com 

Certified email: direzione@pec.polimoda.biz 

Fax no.: +39 055275020

Post: Via Curtatone n.1 – 50123 Florence