PERSONAL DATA PROCESSING POLICY WITH REGARD TO REQUESTS FOR MEETINGS, INFORMATION, NEWSLETTERS, OR COURSE BROCHURES/ANNOUNCEMENTS
(REG EU 2016/679 and Italian privacy legislation)
DATA CONTROLLER: Accademia d’Arti e Mestieri dello Spettacolo Teatro alla Scala (hereinafter “Academy”)
Registered Headquarters: Via Santa Marta n. 18, Milano tel. (+39) 02-8545111; fax (+39) 02-86460020; email: privacy@accademialascala.it
LAWFULNESS AND PURPOSES OF PERSONAL DATA PROCESSING
- Reception via mail, telephone (including texts), email or other computerized means of information regarding the presentation or promotion of courses (e.g. interview, Open Days, artistic/training events, and/or orientation/career counseling services, or regarding any related events or activities organized or managed by the Academy or its partners) according to the relevant calendar, as well as reception of evaluation materials for statistical purposes;
- enrollment and participation in Open Days or presentations, events which may entail recording of video and/or photographic images;
- downloading the announcement/flyer of the course/event;
- with the consent of the interested party – or of the exercisers of parental authority in the case of a minor user – the receipt by post, telephone (e.g. instant messaging) and computer, of all information relating to the presentation and promotion of courses and / or Open Day and / or events of an artistic and / or educational nature and / or related events and / or activities organized and / or managed by the Academy and / or by its partners and / or by joint data controllers (subject to specific information), according to the calendar in force, as well as the sending of any surveys accompanying the activities for statistical purposes and more generally information-promotional material (including the Newsletter) and communications relating to events and initiatives proposed by the Academy.
PERIOD OF PERSONAL DATA STORAGE
The personal data storage period depends on legislation in force to safeguard the rights of the Data Subject and the Data Controller, and to regulate historical archives of such data. Personal data will be stored until such consent is withdrawn, without prejudice to the legitimate processing based on said consent prior to its withdrawal.
For the purposes referred to in point d) the storage times are subject to the possible revocation of consent by the interested party, without prejudice to the legitimacy of the treatment based on consent before revocation.
Personal data storage times and criteria are documented in detail in the personal data processing registry of the Academy; specific times will be communicated to Data Subject per request; for the purposes from a) to c) the retention period is 36 months – specific times will be communicated on request. The request must be sent to privacy@accademialascala.it. Access to these data is subject to an assessment of the legitimacy of the request.
PERSONAL DATA SUBJECT TO PROCESSING AND METHOD OF PROCESSING
In processing personal data that may be used to identify the Data Subject either directly or indirectly, the Academy shall adhere to the principle of strict necessity and seek to ensure the confidentiality of the processed data. The Academy shall thus collect personal data and provide them to the data recipients and subjects authorized to process said data, including internship hosts and third parties where applicable (see “Data Recipients and Subjects Authorized to Process Personal Data” below), only those data necessary for accomplishing the above-specified purposes. Personal data will be processed in printed or computerized form by Academy offices and departments using methods and within the limits necessary for accomplishing said purposes.
PERSONAL DATA PROVISION REQUIREMENT
The provision of personal data is necessary for fulfilling the purposes set forth above.
Specifically, for the purposes referred to in points a), b) and c), the provision is essential for the purpose of fulfilling the request made by the interested party.
With reference to the purpose referred to in point b) “registration to the Open Days/presentations”, the provision of data is essential for the purpose of registering and participating in the Open Days/presentations (also online) and in order to receive all information concerning the same, or to allow members to be able to enjoy the event in streaming mode (when provided) and allow the Academy and / or its Partners to promote the various initiatives, according to channels deemed most appropriate. Interested parties who participate live in the event scheduled online (videotaped), can obviously keep their image obscured, register with a nickname or can enjoy the event in streaming mode (when provided); those who participate in face-to-face initiatives will receive instructions to follow to reduce the possibility of being identified in the video-recordings (possibly made).
Certain data (e.g., birthdate, city of residence, gender) may be collected and processed in aggregate form for statistical purposes and to assess the quality of services offered without any possibility of identifying the Data Subject.
The provision of data for the purposes referred to in point d) must be considered optional, and is subject to consent. Refusal to provide data for this purpose will in no way preclude the interested party’s right to receive information relating to the course / event of his interest managed by the Academy and / or its partners.
LEGAL BASIS FOR PERSONAL DATA PROCESSING
The legal basis for personal data processing for purposes a) – c) is to respond to the requests of the Data Subject.
For point d) the legal basis is represented by the request for consent. For point b), limited to video and / or photographic footage, the collection of data is functional to the interest of the Academy in promoting and giving visibility to the activities carried out and for updating the historical archive. Furthermore, the collection of data for statistical purposes is motivated by the Academy’s interest in carrying out, anonymously, market surveys in order to improve the quality of user services and the training proposal offered.
DATA RECIPIENTS AND SUBJECTS AUTHORIZED TO PROCESS PERSONAL DATA
Academy personnel (employees, consultants, authorized professionals) may have access to personal data for administrative, organizational, and promotional activities.
Furthermore, due to the existence of specific assignments to third parties for the management and maintenance of information systems and any outsourced services, the user’s data may be processed by the staff of these third parties who operate as external managers of the processing by the Academy and / or system administrators, where appointed as such and who adopt suitable measures to ensure confidentiality and data protection.
For the purposes indicated above, the data may be disclosed to any persons who provide consultancy and / or support services for the management of promotional and marketing activities; to subjects to whom the data must be communicated by law or regulation.
Some personal data provided to authorized external data processors may be transmitted via platforms made available by these processors.
Furthermore, for the purposes referred to in point b), in the case of Open Days / presentations organized in collaboration with a partner, the data may also be accessed by these subjects (public or private bodies, partners), within the limits provided for by the call / agreement and respecting the principle of data minimization. In which case, these subjects may be configured as Partners, Joint Controllers or autonomous Data Controllers, within the limits set by the notice / agreement.
Finally, again in the case of Open Days / presentations, the data collected in the form of video and / or photographic footage, may be disseminated and used directly or indirectly for any purpose, including promotional and advertising, and in any way or form (for example processing, modifications, publication on the site / sites, brochures, social channels), also by Partners, in the ways that will possibly be better specified in the appropriate locations. Such video and / or photographic footage will be acquired without affecting the dignity of the person concerned.
The data may be accessed by persons whose faculty is recognized by provisions of the law or by orders of authorities.
The list of external parties who process personal data on behalf of the Data Controller (the Academy) is available upon request from privacy@accademialascala.it. Access to this list is provided only to those parties whose request is deemed to be legitimate by the Data Controller.
SECURITY OF PERSONAL DATA
Data Subject personal data will be processed using automatic tools in keeping with the principle of necessity and proportionality, avoiding processing of personal data when the operations can be carried out using anonymous data or in other ways. The Academy has implemented specific security measures to prevent loss of personal data, illicit or improper use of personal data, and unauthorized access to personal data.
DATA TRANSFER
Although all parties that process personal data on behalf of the Academy as external data processors are currently based in the European Union, in the future it may be necessary to transfer said data to parties based outside of the European Union in countries that do not ensure an adequate level of protection per the European General Data Protection Regulation (EU 2016/679). The Academy will only transfer personal data outside of the European Union if the relevant external data processors have implemented the security measures set forth in the Italian Personal Data Protection Code and the European General Data Protection Regulation and provided to the Academy the necessary guarantees, and only with the consent of the Data Subject.
Further information, including a list of parties belonging to the specified categories who operate principally as joint data controllers, and a list of data processors is available at Academy offices and may be requested at its Privacy Policy Office.
DATA SUBJECT’S RIGHTS
By contacting the Data Controller via email at privacy@accademialascala.it, the Data Subject may exercise applicable rights as regards his/her personal data, including deletion of personal data, correction of incorrect data, addition of missing data, limitations to processing, data portability, or objection to data processing without prejudicing the rights or freedoms of the Data Controller.
The Data Subject’s consent to processing his or her personal data for any of the purposes indicated herein may be withdrawn at any time.
The Data Subject has the right to lodge a complaint with a supervisory authority in the EU member state where the Data Subject maintains his or her principal residence or in the state in which the presumed violation occurred. Further information on the Data Subject’s right to lodge a complaint may be found at: https://goo.gl/GLbTN9.
The Data Subject will not be subject to a decision based solely on automated processing or profiling.
ACADEMY PRIVACY POLICY CONTACT
For clarifications, information, exercise of Data Subject’s rights, or other requests, contact the Academy Privacy Policy Contact at: privacy@accademialascala.it or by phone: (+39) 02-85451192 or (+39) 02-85451171.
The Accademia Teatro alla Scala Foundation, to protect the interested parties, has appointed the Data Protection Officer, with support and control, consultative, training and information functions, cooperation and contact with the Authority of the Privacy Guarantor for matters related to the processing of personal data. The Data Protection Officer of the Accademia Teatro alla Scala Foundation can be contacted at the following addresses: dpo@accademialascala.it tel. 02-85451192 / 85451171
CHANGES
The data Controller reserves the right to make, if necessary, the appropriate changes to this document, giving it the widest visibility to the interested parties.
Last update: September 2021