Dear User,

Pursuant to art. 13 EU Regulation No. 2016/679 (hereinafter “GDPR"), we inform you that processing of the data provided by you will be carried out using methods and procedures aimed at guaranteeing that the processing of Personal Data will be carried out respecting the fundamental rights and freedom and dignity of the data subject, with special concern for confidentiality and security, personal identity and right to protection of personal data.

We remind you that processing means any operation or set of operations, carried out with or without the use of automatic processes and applied to personal data or to the sets of personal data, such as collecting, recording, organising, structuring, retaining, adapting or modifying, extracting, using, communicating by transmission, dissemination or any other way of making them available, comparing or interconnecting, limiting, erasure or destruction (art. 4 GDPR).

1 - Subject matter of the processing of processing and origin of the data

The data processed by Scuola Leonardo da Vinci are collected directly from the data subject and refer to:

• personal data (first name, family name, date of birth);
• data about their country of origin.
• contact data (email address).

2 - Legal grounds for processing

The legal grounds for processing are based on express and unmistakeable consent (pursuant to Art. 6.1, lett. A) of the GDPR).

3 - Purpose of the processing

Personal data and any changes you may communicate in the future to Scuola Leonardo da Vinci s.r.l. will be collected and processed exclusively for the following purposes:

1. Taking charge of and answering your contact request through this form;
2. Sending advertising and information material by newsletter.

4 - Manner of processing

The processing is limited to the following operations and methods:

• Collection of data from the data subject, by filling out online forms;
• Recording and processing on computer;
• Organising the files mainly automatically, using company applications and IT databases;
• Communicating your data to third parties, duly authorised by the Data Controller.

Data processing will be carried out using tools which guarantee confidentiality, integrity and availability, in compliance with suitable technical and organisational measures of security provided for by the GDPR.
Processing is carried out using IT and/or automatic systems and will include all the operations or sets of operations laid down under Art. 4 of the GDPR and necessary for such processing, including communication to the parties appointed to carry out the processing.

The data will not be disseminated, but will or may be communicated to public or private parties acting within the context of the purposes described above.

5 - Data retention

The Data Controller will keep your personal data for the time needed to fulfil the purposes above, and in any case for no more than 2 years after their collection.

6 - Access to processing

The data will be made accessible, for the purposes under item No. 3:

• to employees/collaborators in their role as people in charge of handling, after suitable appointment;
• to third parties, identified as data processors by the Data Controller.

Your data will not be communicated to any unauthorised third parties.

Your data will not be disseminated in any way. To this end, the data will be processed using security measures suitable for preventing unauthorised access to the data by third parties and guaranteeing confidentiality.

7 - Transfer of the data

The personal data will be processed and retained on servers located within the European Union belonging to the Data Processor and/or to third party companies appointed and duly named as Data Processors.
The data will not be transferred outside the European Union.

8 - Nature of the data provided and consequences of refusal to answer

Providing the data marked by an asterisk, for the purposes under Art. 3.a) above, is obligatory. Lacking such data, it will not be possible to proceed with accepting and answering your request for contact.

On the contrary, provision of the data for the purposes under item 3.b) is optional, and they will be processed by the Data Controller only with your explicit consent.

9 - Rights of the data subject

According to the provisions of the GDPR, the data subject has the following rights against the Data Controller:

• To obtain confirmation that his data are being processed, and in such case, obtain access to the personal data (Right of access Art. 15);
• To obtain rectification of inaccurate data concerning him without unjustified delay (Right to rectification Art. 16);
• To obtain erasure of personal data without unjustified delay; the data Controller has the obligation to erase without unjustified delay the personal data, if certain conditions exist (so-called “right to be forgotten”, art. 17);
• To obtain limitation of processing in certain cases (right to limitation of processing, art. 18);
• To receive in a structured format, of common use and readable from an automatic device, the personal data which concern him and has the right to obtain direct transmission to another data Controller, without hindrance from the data Controller to whom he has provided the data, in certain cases (Right to data portability art. 20);
• To object at any time for reasons related to his special situation, to processing of personal data concerning you (Right to object, Art. 21);
• To receive without undue delay communication of breach of personal data incurred by the Data Controller (Art. 34);
• To recall at any time the consent expressed (Conditions for consent art. 7).

Where applicable, the data subject also has the rights under Articles 16-21 of GDPR (right to rectification, so-called “right to be forgotten”, right to limitation, right to portability of the Data, right to object), as well as the right to lodge complaint to the Authority for the Protection of Personal Data.

10 - How to exercise your rights

The data subject who wants to exercise his/her rights may contact the data Controller at the email address: This email address is being protected from spambots. You need JavaScript enabled to view it.

11 - Data Controller

The Data Controller is Scuola Leonardo da Vinci s.r.l. – Via Bufalini 3, 50122 Florence – Tel. 055-261181 – Tax Code 01454960483.

The list of data processors and of those in charge of processing can be consulted at the offices of the data controller as defined above.

12 - Updates to this information notice

This Information notice may undergo changes. Any substantial change will be notified to the data subjects by notice or publication on the website.  

Information updated on 2018 May 2nd