Orsolina28 Group · Document INF-MOP.04 Rev. 02 of 10 October 2024

Privacy notice for the website and digital services

Joint controllership pursuant to Art. 26 GDPR

This privacy notice is provided pursuant to Articles 12, 13 and 14 of Regulation (EU) 2016/679 of 27 April 2016 (hereinafter the “GDPR”) for all processing of personal data carried out by the web services connected to the domains owned by the Orsolina28 Group (Orsolina28 Art Foundation – Bio28).

1. Who this document is addressed to

The following information is addressed to everyone who consults or uses the services provided through the Orsolina28 Group websites. In particular:

• general users of our institutional websites;
• customers and participants in events, performances and courses;
• users who wish to use our hospitality services;
• users who interact with our social media;
• performing artists;
• users of the platforms embedded in the websites.

2. Joint Controllers

For the purposes set out in this privacy notice, the following companies (hereinafter collectively the “Orsolina Group”) process your personal data as Joint Controllers pursuant to Art. 26 GDPR:

2.1 Data Protection Officer – DPO

The Orsolina Group companies, as well as all the companies with which we enter into joint controllership agreements (Art. 26 GDPR) or data processing agreements (Art. 28 GDPR) concerning the services offered, have always paid close attention to the security of the information they process, with particular regard to information that may contain personal data or special categories of personal data.

For this reason, in order to ensure the highest level of compliance with the applicable legislation at all times, the Orsolina Group has designated a Data Protection Officer (DPO) pursuant to Art. 37 GDPR. You can contact the Data Protection Officer directly at the following e-mail address: privacy@bio28.it.

2.2 Joint Controllers

The Orsolina28 Group companies offer services and products through their own premises and websites. Specific agreements have been entered into between the group companies regarding the purposes for which personal data are collected and the means by which they are processed. Within the limits of these agreements, the Orsolina28 Group companies will process your personal data as Joint Controllers pursuant to Art. 26 GDPR. In particular, the joint controllership concerns the personal data you voluntarily provide in order to purchase the services or products listed in this document.

2.3 Further information on the Joint Controllers

With regard to the processing of your personal data, Orsolina28 Art Foundation ETS and Bio28 are primarily responsible towards users in relation to the products and/or services offered on their website on behalf of the Orsolina28 Group companies.

However, please note that, in accordance with the applicable laws, you may exercise your rights under the GDPR in respect of and against each controller (Orsolina28 Group company).

Without prejudice to your right to contact the Data Controllers or the Data Protection Officer (DPO) directly, should you, as a user and “data subject”, require any clarification regarding the processing of your personal data or the exercise of your rights, you can contact our DPO at the following e-mail address: privacy@bio28.it.

Please note that the essential content of the joint controllership agreements can be found in the annexes to this document.

3. What we use your personal data for (purposes)

3.1 F1 – Providing the digital services you request

Depending on your requests, this includes our commitment to use your personal data to:

• allow you to browse our websites freely;
• allow you to access the content of our institutional or service websites;
• allow you to access the platforms for booking and purchasing performances;
• allow you to access the platforms for booking and purchasing intensive courses, masterclasses and workshops;
• allow you to access the platforms for booking a stay at our residences;
• allow you to access the platforms for booking the restaurant;
• allow you to take part in our courses;
• allow you to access the platforms for submitting a “Call for Creation” project;
• allow you to complete the online purchase of our products and services;
• guarantee you access to reserved areas or applications;
• allow you to make payments for the services that require them;
• allow you to make donations.

In addition, again in the context of providing the services you have requested, we may need to process your personal data to:

• create and manage your user Account and the related authorisation profile on our systems;
• manage our relationship with you regarding your Account in relation to the services to which you have been granted access.

Why we may process your personal data for these purposes

The processing of your personal data is necessary to enable us to fulfil our contractual or pre-contractual obligations relating to the provision of the services you have requested. This processing is permitted and carried out pursuant to Art. 6(1)(b) GDPR.

Further information

If, as a User, you do not wish to provide the personal data we need for the performance of the service contract or for compliance with a legal obligation relating to the service offered, we will be unable to fulfil your request. For example, if you do not provide us with your personal details or contact information, we will not be able to process your order and allow you to use the products or services you have requested.

For more information about your rights, please see section 10 (User rights).

Notes

Where the provision of the services you have requested involves the products and/or services of the Orsolina28 Group companies, your data will be processed jointly with those companies.

3.2 F2 – Improving the user experience and ensuring the security of our services

We use personal data to provide you with ever better services and products so as to deliver the best possible User experience. This includes, for example:

• doing everything necessary to provide our products and services to you as a user;
• ensuring that your account is adequately protected;
• ensuring that our website, network and ICT infrastructure are secure and used appropriately;
• better understanding how our products, services and website are used and making improvements;
• researching and analysing desired products and services;
• tailoring our content so that it is more relevant to the User;
• ensuring the security of our business and of our partners;
• developing and maintaining relationships with suppliers, partners, other companies and the people who work for them;
• managing sites and services during routine maintenance, including troubleshooting and understanding any errors encountered during their use;
• maintaining an adequate level of security and managing and administering our IT systems in order to configure network protocols correctly, enable screens and content to be displayed, and protect services from viruses, malware, malicious software and unauthorised access;
• examining any complaints and providing customer support;
• investigating any complaints made by you or by third parties and providing you with a more efficient support service;
• ensuring the quality and effectiveness of our handling of complaints or requests to the user support service;
• defending or enforcing our rights or those of a third party.

Why we may process your personal data for these purposes

We process your personal data for these purposes because we consider it to be in our legitimate interest to do so, within the meaning and for the purposes of Art. 6(1)(f) GDPR.

Further information

Pursuant to Art. 21 GDPR, as a data subject you may object to the processing of your personal data for these purposes. However, the Orsolina28 Group companies will refrain from further processing your personal data only if they are unable to demonstrate that their legitimate interest overrides your own.

3.3 F3 – Complying with legal obligations and making mandatory disclosures

We may need to process your data in order to comply with specific legal obligations or to make the necessary disclosures in response to requests that we are legally required to fulfil, such as meeting tax obligations or disclosing your data at the request of a competent governmental or judicial authority (e.g. the Italian Revenue Agency (Agenzia delle Entrate), the Ministry of Education (MIUR), law enforcement agencies or the judicial authorities).

Why we may process your personal data for these purposes

The processing of your personal data is necessary for compliance with a legal obligation to which we are subject and is permitted pursuant to Art. 6(1)(c) GDPR.

3.4 F4 – Promoting the activities, products and services of the Orsolina28 Group (newsletter)

If, when completing our sign-up Forms for the services offered, you give us your consent or subscribe to our “newsletter”, we may use the data you provide for marketing purposes, in order to send you updates or other communications that we believe may be of interest to you. In particular, depending on the consents you choose to give us, we may promote activities, products and services in the following ways:

Direct marketing: we will use your data to communicate with you, to keep you updated on the activities of the Orsolina28 Group and to provide you with suggestions and recommendations about events, activities, projects, products or services that may be of interest to you. We will provide you with this information using the contact details you have voluntarily provided and authorised (e.g. by e-mail).

We may also use your personal contact details, your preferences, your suggestions and any other relevant information you choose to provide in order to send you more relevant information. These data may also be used in aggregated and/or anonymised form to conduct satisfaction surveys.

How we use your personal data in the newsletter service

The data will be managed through your registration on our CRM portal, and newsletters will be sent via the Mailchimp newsletter service (https://www.mailchimp.com/).

You can unsubscribe at any time using the link at the bottom of every communication we send.

Why we may process your personal data for these purposes

The processing is based on your freely given consent pursuant to Art. 6(1)(a) GDPR.

For example, in addition to the newsletter service, we may ask for your consent when technologies such as cookies are used or when we use images in which you appear in our publications.

Further information

You have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal. For more information about your rights, please see section 10 (User rights).

3.5 F5 – Soft spam

Unless you have already refused this option, where the conditions laid down in Art. 130(4) of Legislative Decree no. 196 of 30 June 2003 are met, we may send you commercial communications offering services or products similar to those you have already used or purchased. The lawfulness of this activity (so-called “soft spam”) is based on our legitimate interest (Art. 6(1)(f) GDPR) in directly promoting products and services to our customers, as they are already users of products or services similar to those we intend to promote. Soft spam may be sent even if you have not given your consent, using the information you provided to us in order to purchase a product or use a service. You have the right to object to this processing.

With regard to the above, please note that you may object at any time to receiving commercial information, including soft spam, by contacting us using the contact details we have provided or simply by selecting the option to refuse further commercial communications, which is always available at the bottom of our communications (e.g. e-mails).

3.6 F6 – Cookies and other similar technologies

As stated above, we automatically collect data through the use of “cookies”.

Some of our website pages use cookies to offer you a better service when you use the website again. You can set your browser to notify you before you receive a cookie, so that you can decide whether or not to accept it. You can also set your browser to disable cookies; however, if you do so, some of our websites may not work properly and may forget your settings (e.g. the language selected).

In order to ensure compliance with the consent and information requirements laid down by the applicable legislation, we use certain technologies to track, monitor and control in real time the cookies and your consent to their use. Up-to-date and detailed information on the components active on our sites is available in the respective cookie policies linked in the footers of our websites.

We also use e-mail read-tracking technologies to monitor users subscribed to the newsletter service and to identify the content preferred by each User, in order to send personalised information. This system also helps us understand whether your e-mail address is still active and whether our e-mails are being read.

3.7 F7 – E-commerce

If you purchase products or services through our websites (e.g. https://www.orsolina28.it/; https://www.bio28.it/), your personal data, in addition to being used to conclude the supply contract (see purpose F1), will be used to manage payments and to comply with the related tax obligations.

For more information on this processing, please consult the more specific CUSTOMER PRIVACY NOTICE (INF-MOP.02) of the Orsolina28 Group company from which you purchased the product or service. This processing is carried out by the individual Orsolina28 Group companies as independent controllers within the meaning of Art. 4(7) GDPR. The customer privacy notices of the Orsolina28 Group companies are available at the following URL: https://www.bio28.it/it/privacy.

3.8 F8 – Social networks

The Orsolina28 Group companies also promote their activities through social media in order to develop the Brand and raise awareness of their products and/or services. The personal data you choose to provide voluntarily through our profiles on social channels will be used by the Orsolina28 Group companies solely for the purposes set out in this section and in compliance with the terms of service of the social media platforms.

In this regard, the Group companies may send you promotional communications, using the contact details of your social media profile, concerning products or services advertised on a page or in a post of which you have become a “fan”, or if you have joined a “group” of followers of one of our companies or of one of our products or services, thereby choosing to “follow” the related news, updates or comments. It is in fact considered that in doing so you have also expressed your wish to consent to receiving promotional messages from us regarding the services and products in which you have shown an interest.

4. Categories of personal data processed

4.1 Common data provided voluntarily

These data are processed for the following purposes:

F1 F2 F3 F4 F5 F6 F7 F8

As a User, you may voluntarily provide us with your personal data, including data that make it possible to identify you, while consulting our institutional websites or using the associated web services. In particular, this happens when you contact us to obtain information, when you register for our services or when you fill in our forms on the relevant pages.

As a User, you may choose to provide us with additional information when you contact us or otherwise interact with us. We collect your personal data when you communicate with us in person, using the contact details we have provided through our websites, or by any other means.

If you are a regular User of our website or wish to access specific services, you may need to create a User Account (“Account”). The information provided when setting up the Account depends on the service and may include your first name, surname, e-mail address, contact person, contact details and other data useful for configuring the service in line with your reasonable expectations and for tailoring our products or services to your interests. If you register to create an Account, you will be able to create a unique password that will allow you to access your Account in order to use our services and manage your personal information independently (so-called User profile).

If you subscribe to our newsletter or to other forms of direct communication from us, you may need to provide us with your name, e-mail address or other specific data indicated from time to time.

4.2 Data collected automatically by our systems

In addition to the common data that you choose to provide to us directly and intentionally as a User, the IT systems and software procedures used to operate our websites and services acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols.

When you visit our website, we may automatically collect so-called “browsing data”. By way of example but not limitation, these include: IP address, login data, browser type and version, browser plug-in types and versions, operating system and platform, data relating to the visit, including the Clickstream URL to, through and from our website, products viewed or searched for, downloads, times and duration of visits to certain pages and page interaction, and session or system errors.

In some cases, we also collect browsing data through “cookies” or similar technologies. In these cases, where required by law, you will always be informed in advance by means of a specific banner, through which you can give your consent to the use of cookies. For more information, please consult the cookie policy at the bottom of each of our websites.

We also collect browsing data through our security systems (for example antivirus and firewall) while you browse our web pages or use our cloud applications.

These data are processed for the following purposes:

F1 F2 F3 F4 F5 F6 F7 F8

4.3 Data received from our partners or from other sources

We may receive data about you from other sources. This happens if you use any external service, offered by one of our partners or by third parties, with which we are registered. In particular:

• we may receive your data from event promotion and management platforms following your registration for an event organised by us or by one of our partners;
• we may receive your personal information from ticketing, e-commerce or online payment management platforms;
• we may receive your contact details from our “Artists/Partners” and contact you on their behalf in order to promote their initiatives.

Please note that we also work closely with third parties (including, for example, technology and business partners, technical, payment and delivery services, or analytics service providers) and, where the contractual conditions are met, we may receive data relating to you from them (including publicly available data).

These data are processed for the following purposes:

F1 F2 F3 F4 F5 F6 F7 F8

4.4 Special categories of data

The Orsolina28 Group companies do not deliberately collect special categories of personal data (within the meaning of Art. 9 GDPR) through their websites or web services.

These data are processed for the following purposes:

F1 F2 F3 F4 F5 F6 F7 F8

The highlighted purposes are those for which the data are processed.

5. Further information on links to other websites

Where we provide links to other websites not belonging to the Orsolina28 Group companies, we do so solely for information purposes. Such websites are outside our control and this Policy does not apply to them. If you access other websites using the links we have provided, the operators of those sites will act as independent Data Controllers and may collect your data and use it in accordance with their own Privacy Policy, which may differ from this Policy.

The Group companies have no control over, make no representations about and accept no responsibility for the accuracy or any other aspect of the information available on such sites. A link to a third-party site cannot be understood as an endorsement by the Orsolina28 Group companies of the content and services of such parties. The Group companies make no statements or warranties regarding the use or storage of User data on third-party sites. We invite you to carefully review the privacy notice (generally located in the website footer) governing the third-party sites linked to our websites in order to gain a full picture of the possible use of your personal data.

6. Data retention

Your data will be retained for the period necessary to achieve the purposes for which they were collected. In particular:

7. Security of data and processing

The Orsolina28 Group companies have adopted a specific shared organisational model, called the Privacy Organisational Model (MOP – Modello Organizzativo Privacy). Taking into account the organisational context of the respective companies, the needs of the sector (artistic promotion and courses) and the expectations of the stakeholders involved, the MOP establishes the leadership and commitment of the individual Data Controllers by defining the organisational roles, internal and external responsibilities and authority of the parties involved.

The MOP identifies the security objectives and plans the actions necessary to achieve them. It also ensures the resources and skills needed for the constant and continuous improvement of the System over time, periodically verifying its scope and its alignment with the companies’ objectives.

Furthermore, the Group companies have shared and implemented appropriate technical and organisational security measures in order to minimise the risks of destruction or loss, including accidental loss, of the data processed, of unauthorised access, or of processing that is not permitted or not consistent with the purposes of collection set out in this privacy notice.

User responsibility

If you have a password that allows you to access our services or websites, it is your responsibility to keep it secure and confidential in order to protect your information.

We invite you to check the security of the devices you use to access our content or services periodically. You should install up-to-date software providing protection against malicious code or viruses. The security of the information you send us also depends on the integrity and proper functioning of your IT devices.

8. Who we disclose your data to

Your personal data are known to and processed by employees and collaborators of the Orsolina28 Group companies listed in section 2.3. These persons will act as persons authorised to process the data and will be instructed accordingly by the respective Controllers.

Your data may be disclosed to third parties (e.g. companies/professional firms) that provide support and/or consultancy services to the Orsolina28 Group companies when:

• it is necessary to involve a third-party service provider in order to facilitate or extend our services;
• you have explicitly requested it;
• it is required by an order of the judicial authorities or by any legal or regulatory obligation;
• in connection with the sale, transfer or reorganisation of a business;
• in order to enforce our contracts.

In this regard, third parties are understood to mean entities that provide us with a service or act as our representatives, such as, by way of example but not limitation, subcontractors (including their representatives), professional advisers, IT suppliers, database providers, backup and disaster recovery specialists, e-mail providers and other service providers needed to operate or improve our products and services. Our suppliers and service providers will be required to comply with our data processing and security standards. The data we disclose, including your personal data, will be provided only in connection with, and to the extent strictly necessary for, the performance of their function. They will not be permitted to use your personal data for purposes other than those set out in this privacy notice.

Your personal data may be known to and processed by the police or the judicial authorities, in accordance with the law and following a formal request from such bodies, or where (1) there are reasonable grounds to believe that the disclosure of such data is reasonably necessary to investigate; (2) to prevent or take action regarding suspected unlawful activities or to assist state supervisory and regulatory authorities; (3) in the event of a legal claim, where required, the data may be transferred to defend ourselves against such a claim; (4) to ensure the safety of our users, customers and third parties; and (5) to protect our rights and property and the rights and property of our customers and third parties.

9. Transfers outside the EU

The web services offered by the Orsolina28 Group companies are based on systems hosted on local servers and private and public clouds, with data centres normally located within the European Economic Area.

However, precisely because of the nature of cloud services, your personal data may be transferred to countries located outside the European Economic Area (EEA). In such cases, we will ensure that you are afforded appropriate safeguards in accordance with the requirements of the GDPR (Arts. 44–50). However, since the Internet is by its nature a public environment, its use involves the transmission of data in contexts that lie beyond the control and responsibility of the Orsolina28 Group companies. Such transfers, carried out mainly for technical reasons related to the use of specific protocols or services, may also take place internationally to third countries outside the European Economic Area. In particular, this may depend on the technologies you use to access our services.

For more information on the security measures implemented in the case of data transfers outside the EEA, you can contact us using the details provided in section 2 (Data Controllers).

10. User rights

As a data subject, in accordance with the applicable law and in relation to your personal data, you may exercise the following rights in respect of and against each controller of the Orsolina28 Group:

1. Right of access to personal data. You have the right to obtain confirmation as to whether or not personal data concerning you are being processed by us and, where that is the case, to obtain access to the personal data processed. You have the right to obtain a copy of the data undergoing processing. This right applies only where it does not adversely affect the rights and freedoms of others. Please note that, should you request further copies, we may charge you a fee based on our administrative costs.
2. Right to rectify, erase or restrict the processing of personal data. If you wish to rectify, erase or restrict the processing of your personal data, please contact us using the details provided in section 1. It is your responsibility to ensure that you provide truthful, accurate and complete data and that you keep them up to date.
3. Right to withdraw consent. If you have given us your consent to the processing of your data, you may withdraw it at any time.
4. Right to data portability. Where the processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller without hindrance from us.
5. Right to object. As a User, you have the right to object to the processing of your data in certain circumstances. For example, you may exercise this right where the processing is based on our legitimate interests (or those of third parties). You may challenge the validity of our legitimate interests; however, we may be entitled to continue processing such personal data on the basis of our legitimate interests or where this is relevant to legal proceedings, or where the data are necessary for the establishment, exercise or defence of legal claims. You also have the right to object to the processing of your personal data for direct marketing purposes.
6. Right not to be subject to automated decision-making. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This right does not apply where the processing is necessary for entering into or performing a contract between you and an Orsolina28 Group company, or where you have given those companies your explicit consent. In such cases, you have the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.
7. Compensation. We also remind you that any person who has suffered material or non-material damage as a result of an infringement of Regulation (EU) 2016/679 has the right to receive compensation for the damage suffered from the controller or processor.
8. Right to lodge a complaint with a supervisory authority. Please note that you have the right to lodge a complaint with the competent independent administrative authority in the EU Member State of your habitual residence, place of work or place of the alleged infringement of the law on the protection of your personal data. In Italy, you may lodge a complaint with the supervisory authority, the Italian Data Protection Authority (Garante per la protezione dei dati personali).

11. How to exercise your rights

If you have an Account, you can access your personal data directly in order to obtain a copy of them, as well as correct, modify or delete any inaccurate data. You can also request the closure of your Account at any time by sending a request to privacy@bio28.it.

If you receive commercial communications or have subscribed to one of our information channels through the newsletter service, you can withdraw your consent at any time by clicking on the link provided at the bottom of each of our communications.

As a data subject, you may exercise your rights using the details set out in this document by sending your request by certified e-mail (PEC), ordinary e-mail or registered post.

We will also use the communication channel you have chosen to send our response (whether positive or negative).

If you are not already identified in the context in which the request is made (e.g. you are not an authenticated User of one of our web services), we will ask you, whatever the means by which the request is submitted, to attach or otherwise provide a document enabling you to be identified.

If your request is submitted through a third party (connected to you in any capacity), it must be accompanied by a specific written proxy or another document certifying any powers of representation.

Communications and actions taken in response pursuant to Arts. 15 to 21 GDPR are free of charge.

However, if, following the verification you have requested as a data subject, the existence, including in the past, of data concerning you is not confirmed at the Orsolina28 Group companies, or if the request proves to be manifestly excessive and/or repetitive, we may charge a fee for the response, solely for requests under Arts. 15 to 21 GDPR.

Please note that the burden of demonstrating the manifestly unfounded or excessive nature of your request lies with the Data Controller. In any case, the fee charged to you may never exceed the costs actually incurred and documentable in the specific case.

11.1 Form for exercising your rights

To exercise your rights against the controller, we recommend that you use the following form:
https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/1089924

Please remember that, in order for you to exercise your rights, we need to identify you.

12. Changes to this policy

Document INF-MOP.04 Rev. 02 has been in force since 10 October 2024.

This privacy notice is updated periodically in order to keep you informed at all times.

If the fundamental parts of this privacy notice are amended (such as the purposes, methods, who we disclose data to, where we transfer them, etc.), we will make sure the change is brought to your attention.

13. Short privacy notice for minors

This privacy notice is provided in short form to minors aged 14 or over.

Who we are and why we ask for your data

We will process your personal data solely to allow you to create the user profile (account) you need to access the course content and use it safely.

Will you receive advertising from us? NO

No one will send you advertising messages. If you receive messages from us, tell your parents immediately. It is important that you do this because whoever is writing to you could be someone pretending to be us in order to trick you.

Will we share your data with anyone else?

We will not share your data with anyone and we will protect it from access by unauthorised or malicious people.

Is it safe to use our services?

We have asked our experts to always protect your data and we will do everything we can to make sure you are not put at risk. But remember that the internet can be a dangerous place. If you have any doubts about the security of your data or of our applications, tell your parents or your teacher immediately.

If you have problems, can you ask someone for help?

If you have any difficulties, you can contact us directly using the contact details you will find in the instructions provided to you with the product or service. Alternatively, we advise you to speak to your parents and NEVER to accept help from people you do not know. NEVER tell anyone your password, not even your friends.

Anyone who wants to help you can find all the contact details in section 2 of the full privacy notice or in the instructions for use of your product or service.

Remember that, in some cases, you can find further instructions or information directly in the dedicated areas of our websites.

Do you have any rights?

You have the right to know whether we process your data, what data we process and why we process it. You have the right of access, rectification and erasure. You also have the right to object to certain processing and to withdraw your consent to processing if the processing is based on that consent. You can find more information about your rights and how to exercise them in the full privacy notice.

14. Annexes

Annex A – Essential elements of the joint controllership agreement for the provision of courses

In order to provide the courses, the Orsolina28 Group companies intend to share data relating to persons who are enrolled, who intend to enrol or who may be interested in enrolling in the courses, to the teachers who will deliver the training course, and to the staff of the Orsolina28 Group companies and other external parties involved in organising and managing the course.

In the context of these processing activities, the Orsolina28 Group companies jointly determine the purposes and essential means of the processing, thereby giving rise to joint controllership. For example, the companies jointly decide on how the course is delivered, the teachers, the staff of the Orsolina28 Group companies to be involved, the type of course to be delivered and how the event is promoted.

Subject matter of the agreement (Art. 1)

List of processing activities carried out under joint controllership:

Processing methods (Art. 3)

1. The personal data of the data subjects (e.g. teachers, learners, staff of the Orsolina28 Group companies involved in the organisational and operational phases) will be processed by the Parties solely in the context of the provision of training services and for strictly necessary purposes, in accordance with any applicable law on the matter, and will not be further processed by the parties in a manner incompatible with the aforementioned purposes.
2. Any further processing of such personal data carried out by the Orsolina28 Group companies falls outside the scope of this agreement.
3. The parties agree on the following processing arrangements:
   • course objectives;
   • categories of personal data necessary and functional to the provision of the course;
   • categories of data subjects involved in the processing activities (course participants, instructors/teachers);
   • selection of the teacher and management of contractual and financial relationships;
   • authorisations and instructions for persons authorised to access data subjects’ data;
   • duration of the processing and of the subsequent retention of the data;
   • software platforms for registration and enrolment in the course;
   • operating instructions for teachers working at events organised by the Orsolina28 Group or using the dedicated platform;
   • arrangements for managing the GDPR compliance of the processing and centralised management of transparency and of the exercise of rights (SGDP – personal data management system).
4. Personal data may be processed on paper or digital media, depending on the activities carried out, provided that the tools are duly identified, inventoried and equipped with adequate security measures pursuant to Art. 32 GDPR, and that their use by any authorised persons is duly regulated.
5. The Parties will use their respective IT systems, undertaking to adopt suitable measures to prevent the loss, erasure or destruction, including accidental, of personal data and any other risk connected with the processing of personal data, in order to ensure adequate protection of the rights and freedoms of data subjects at all times.
6. Each Party undertakes to comply with the shared security policies and to operate in accordance with its own code of ethics.
7. The methods by which personal data are communicated between the Parties are agreed according to specific needs.

Transparency (Art. 4)

1. The Parties, taking into account the methods of course delivery, undertake to inform data subjects of the existence of any processing necessary for delivering the training course, and to make them aware of which data are collected (directly or from other sources) and of the purposes of the processing operations envisaged or carried out with such data, now or in the future. To ensure transparency, the Orsolina28 Group companies also individually recognise the data subject’s right of access to their personal data.
2. Village28 s.r.l. is responsible for drafting the Data Controller’s privacy notices pursuant to Arts. 13 and 14 GDPR for the processing covered by this agreement and for incorporating the main terms of this agreement into them.
3. In preparing the aforementioned privacy notice, Village28 s.r.l. provides data subjects with a single point of contact via the e-mail address privacy@bio28.it.
4. The Orsolina28 Group company that collects the personal data is responsible for providing the data subject with the Data Controller’s privacy notice pursuant to Arts. 13 and 14 GDPR.
5. The parties guarantee that data subjects may freely exercise their rights, as data subjects, in respect of and against each individual party or all of them. The parties undertake to notify each other, without undue delay and in any event within five (5) working days, of the receipt of any request from a data subject under any applicable law, including requests to exercise the rights set out in Chapter III of the Regulation, also providing full details of such request.

Annex B – Essential elements of the joint controllership agreement for the provision of services through the websites and registration platforms

In order to manage the websites and provide services through a single web platform linked to the Orsolina28 Group brand (e.g. managing course enrolment and collecting accommodation data through a single platform called “YEP”), the Orsolina28 Group companies intend to share the data of their users and, in the context of these processing activities, the Orsolina28 Group companies jointly determine the purposes and essential means of the processing, thereby giving rise to joint controllership. For example, the companies jointly decide on how users register on the platform and on its security.

Subject matter of the agreement (Art. 1)

List of processing activities carried out under joint controllership:

Processing methods (Art. 3)

1. The personal data of the data subjects will be processed by the Orsolina28 Group companies solely for the purpose of promoting products and services in accordance with any applicable law on the matter, and will not be further processed by the parties in a manner incompatible with that purpose.
2. Any further processing of such personal data carried out by the Orsolina28 Group companies falls outside the scope of this agreement.
3. The parties agree on the following processing arrangements:
   • user registration methods;
   • methods of providing the content and services offered;
   • categories of personal data managed;
   • duration of data retention; Service Level Agreement on the provision of services;
   • technical and organisational security measures;
   • protective actions to combat abuse;
   • categories of data subjects involved in the processing activities;
   • authorisations and operating instructions for persons authorised to access data subjects’ data;
   • duration of the processing and of the subsequent retention of the data;
   • contractual clauses for Data Processing Agreements pursuant to Art. 28 GDPR;
   • arrangements for managing the GDPR compliance of the processing and centralised management of transparency and of the exercise of rights (SGDP management system).
4. The Orsolina28 Group companies enter into this joint controllership agreement pursuant to Art. 26 GDPR to govern the provision of the content and services offered.
5. Personal data may be processed on paper or digital media, depending on the activities carried out, provided that the tools are duly identified, inventoried and equipped with adequate security measures pursuant to Art. 32 GDPR, and that their use by any authorised persons is duly regulated.
6. The Orsolina28 Group companies use their respective IT systems, undertaking to adopt suitable measures to prevent the loss, erasure or destruction, including accidental, of personal data and any other risk connected with the processing of personal data, in order to ensure adequate protection of the rights and freedoms of data subjects at all times.
7. Each party undertakes to comply with the shared security policies and to operate in accordance with its own code of ethics.
8. The parties undertake to record the processing in their respective records pursuant to Art. 30 GDPR, indicating the existence of this joint controllership agreement and the related references.
9. The methods by which personal data are communicated between the Parties are agreed according to specific needs.

Transparency (Art. 4)

1. The Orsolina28 Group companies undertake to inform data subjects of the existence of any Promotion processing, and to make them aware of which data are collected (directly or from other sources) and of the purposes of the processing operations envisaged or carried out with such data, now or in the future. To ensure transparency, the Orsolina28 Group companies also individually guarantee the data subject’s right of access to their personal data.
2. Village28 s.r.l. is responsible for drafting the privacy notices pursuant to Arts. 13 and 14 GDPR for the processing covered by this agreement and for incorporating the main terms of this agreement into them.
3. In preparing the aforementioned privacy notice, Village28 s.r.l. provides data subjects with a single point of contact via the e-mail address privacy@bio28.it.
4. The Orsolina28 Group company that collects the personal data is responsible for providing the data subject with the Data Controller’s privacy notice pursuant to Arts. 13 and 14 GDPR.
5. The parties guarantee that data subjects may freely exercise their rights, as data subjects, in respect of and against each individual party or all of them.
6. The parties undertake to notify each other, without undue delay and in any event within five (5) working days, of the receipt of any request from a data subject under any applicable law, including requests to exercise the rights set out in Chapter III of the Regulation, also providing full details of such request.

Annex C – Essential elements of the joint controllership agreement for the promotion of activities, products and services

In order to promote their products and services, the Orsolina28 Group companies intend to share their respective data on existing and potential customers and to jointly collect new contacts to whom or through whom products and services may be promoted and, in the context of these processing activities, the Orsolina28 Group companies jointly determine the purposes and essential means of the processing, thereby giving rise to joint controllership. For example, the companies jointly decide on the list of persons to whom promotional activities are to be directed, the type of product to be promoted, the type of promotion to be carried out (e.g. campaign or event) and how the promotion is to be carried out (e.g. organisation of the campaign or event).

Subject matter of the agreement (Art. 1)

List of processing activities carried out under joint controllership:

Processing methods (Art. 3)

1. The personal data of the data subjects will be processed by the Orsolina28 Group companies solely for the purpose of promoting products and services in accordance with any applicable law on the matter, and will not be further processed by the parties in a manner incompatible with that purpose.
2. Any further processing of such personal data carried out by the Orsolina28 Group companies falls outside the scope of this agreement.
3. The parties agree on the following processing arrangements:
   • products and services to be promoted;
   • persons to whom promotional campaigns are to be directed;
   • methods by which promotional activities are to be carried out;
   • categories of personal data necessary and functional to the promotional activities;
   • categories of data subjects involved in the processing activities;
   • authorisations and instructions for persons authorised to access data subjects’ data;
   • duration of the processing and of the subsequent retention of the data;
   • software platforms for carrying out the promotion;
   • contractual clauses for Data Processing Agreements pursuant to Art. 28 GDPR;
   • arrangements for managing the GDPR compliance of the processing and centralised management of transparency and of the exercise of rights.
4. Personal data may be processed on paper or digital media, depending on the activities carried out, provided that the tools are duly identified, inventoried and equipped with adequate security measures pursuant to Art. 32 GDPR, and that their use by any authorised persons is duly regulated.
5. The Orsolina28 Group companies use their respective IT systems, undertaking to adopt suitable measures to prevent the loss, erasure or destruction, including accidental, of personal data and any other risk connected with the processing of personal data, in order to ensure adequate protection of the rights and freedoms of data subjects at all times.
6. Each Party undertakes to comply with the shared security policies and to operate in accordance with its own code of ethics.
7. The parties undertake to record the processing in their respective records pursuant to Art. 30 GDPR, indicating the existence of this joint controllership agreement and the related references.
8. The methods by which personal data are communicated between the Parties are agreed according to specific needs.

Transparency (Art. 4)

1. The Orsolina28 Group companies undertake to inform data subjects of the existence of any Promotion processing, and to make them aware of which data are collected (directly or from other sources) and of the purposes of the processing operations envisaged or carried out with such data, now or in the future. To ensure transparency, the Orsolina28 Group companies also individually guarantee the data subject’s right of access to their personal data.
2. Village28 s.r.l. is responsible for drafting the privacy notices pursuant to Arts. 13 and 14 GDPR for the processing covered by this agreement and for incorporating the main terms of this agreement into them.
3. In preparing the aforementioned privacy notice, Village28 s.r.l. provides data subjects with a single point of contact via the e-mail address privacy@bio28.it.
4. The Orsolina28 Group company that collects the personal data is responsible for providing the data subject with the Data Controller’s privacy notice pursuant to Arts. 13 and 14 GDPR.
5. The parties guarantee that data subjects may freely exercise their rights, as data subjects, in respect of and against each individual party or all of them.

The parties undertake to notify each other, without undue delay and in any event within five (5) working days, of the receipt of any request from a data subject under any applicable law, including requests to exercise the rights, also providing full details of such request.