Privacy Policy

PRIVACY NOTICE – NEWSLETTER

Dear User,

Pursuant to Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), this Privacy Notice is provided in relation to the processing of personal data through the website https://www.centrostuditaliani.org/ and the related newsletter and promotional communication services.

DATA CONTROLLER

The Data Controller is CENTRO STUDI ITALIANI S.R.L., with registered office at Via Guerrantonio Boscarini 1 – 61049 Urbania (PU), Italy, Tax Code 08384670587 / VAT No. 02040841005.

The Data Controller may be contacted using the following details:

• Email address: milano@centrostuditaliani.org;
• Certified email (PEC): amministrazione@pec.centrostuditaliani.org.

PURPOSES AND LEGAL BASIS FOR PROCESSING

Personal data are processed for the following purposes:

1. Subscription to the newsletter service: sending informational email communications concerning our products and/or services.

2. Collection and use of data through tracking pixels for promotional and statistical purposes: subject to separate additional consent, small images, usually transparent and not visible to the recipient, hosted on remote servers, will be embedded in newsletters. When the email client loads the image, a request is sent to the server, allowing the opening of the message and any subsequent openings to be recorded and associated with the recipient through a unique identifier.

Email opening data are analysed to measure the effectiveness of promotional campaigns, calculate opening rates and statistics, compare campaign results, and improve the subject lines, content, relevance and frequency of communications. Opening information may be associated with individual recipients in order to assess their interest in the communications and tailor subsequent mailings accordingly.

The processing activities relating to purposes 1) and 2) are based on your consent, pursuant to Article 6(1)(a) of the GDPR.

Consent must constitute a freely given, specific, informed and unambiguous indication of the data subject’s wishes, expressed by means of a statement or a clear affirmative action, as provided for in Article 4(11) of the GDPR. The procedures for obtaining and withdrawing consent are described in the section entitled “METHODS OF PROCESSING”.

Failure to consent to the tracking activities referred to in point 2) will prevent such activities from being carried out but will not affect your ability to receive the newsletter. Failure to provide the requested data or consent, as well as withdrawal of consent, will not affect access to other products or services, nor any existing contractual or pre-contractual relationships.

TYPES OF PERSONAL DATA PROCESSED

The following categories of personal data are processed:

1. Identification data: the data subject’s first and last name;

2. Contact data: the data subject’s email address, subject to consent being given solely for the purpose of receiving newsletters;

3. Data collected through tracking pixels: subject to separate additional consent and limited to the information actually transmitted and recorded by the platform:

• Technical identifiers relating to the pixel, recipient and message or campaign, which may be associated with the email address through the correspondence records maintained by the platform;
• Date and time when the pixel is loaded, indicating that the email has been opened, and the number of detected openings, including subsequent openings;
• IP address from which the request to load the pixel originates, which may also correspond to a proxy server operated by the email service provider rather than directly to the recipient’s device;
• Technical information about the email client, browser and type of device, where transmitted in the request and made available by the platform;
• Data derived from the detected events, such as opening rates and indicators of presumed interest in the communications. These indicators are the result of data analysis and are not information directly read by the pixel.
• The pixel records the loading of the image and, on its own, does not allow the actual reading of the message or the time spent viewing it to be established. Automatic loading, image blocking and email security systems may affect the results. The pixel described herein does not directly track clicks on links, downloads of attachments or the contents of the recipient’s mailbox. Any monitoring of such additional interactions requires specific tools and is not included in the processing activities described in this Privacy Notice.

METHODS OF PROCESSING

Personal data are processed using electronic means, in compliance with the principles set out in Article 5 of the GDPR and with appropriate security measures in accordance with Article 32 of the GDPR.

To subscribe to the newsletter, the data subject must enter their email address in the relevant section of the Data Controller’s website and provide consent to receive communications by ticking the corresponding checkbox, which is not pre-selected and contains the following wording:

“I wish to receive the newsletter and consent to the processing of my email address for this purpose, as described in the Privacy Notice.”

A short privacy notice, including a link to this full Privacy Notice, is also available in the same section of the website.

Consent to the use of tracking pixels is optional and is requested separately from newsletter subscription. The data subject may express their choice in the same section of the website by selecting a second checkbox, separate from the first and not pre-selected, containing the following wording:

“I consent to tracking through pixels in newsletters in order to detect email openings, as described in the Privacy Notice.”

For customers who have already been contacted, their choice regarding tracking must be communicated by replying to the email through which the Data Controller sends the consent request and the link to this Privacy Notice, stating either:

“I consent to tracking through pixels in newsletters”

or

“I do not consent to tracking through pixels in newsletters”.

The Data Controller records the choices expressed and retains evidence of the consents obtained, including replies received by email.

In the absence of an affirmative indication of consent to tracking, or in the event of refusal, newsletters will be sent without tracking pixels, provided that a valid legal basis for sending them exists. Failure to reply, merely acknowledging or reading the Privacy Notice, or opening the email shall not be considered consent. Refusal to consent to tracking does not prevent subscription to the newsletter or continued receipt of newsletter communications.

The data subject may modify or withdraw their choices at any time, including separately, by replying to any email received and stating either:

“Disable tracking and continue sending me the newsletter”

or

“Unsubscribe me from the newsletter”.

These options are also referred to in the footer of every email, which additionally contains a direct “Unsubscribe” link.

Pursuant to Article 7(3) of the GDPR, the data subject has the right to withdraw their consent at any time, as easily as it was given. Withdrawal is free of charge and does not affect the lawfulness of processing based on consent before its withdrawal.

Consent to receive the newsletter and consent to tracking through pixels may be withdrawn separately, using the procedures described above.

The Data Controller will update the relevant mailing lists and platform settings without undue delay and will discontinue the processing activities affected by the withdrawal. Any subsequent activation or reactivation of tracking requires a new affirmative indication of consent; subscribing to the newsletter again does not automatically reactivate tracking.

Data processed for the purpose of sending newsletters will be retained until consent is withdrawn or the service is discontinued, subject to periodic reviews of the necessity of retaining such data.

DISCLOSURE AND DISSEMINATION OF PERSONAL DATA

Personal data are processed by authorised personnel who are bound by confidentiality obligations and assigned to the relevant activities in connection with the purposes pursued.

Your personal data may be disclosed to third parties providing specific services on behalf of the Data Controller, solely for the purpose of ensuring the proper fulfilment of the aforementioned purposes.

Recipients include service providers and, more generally, all entities appointed as Data Processors pursuant to Article 28 of Regulation (EU) 2016/679.

The list of Data Processors is regularly updated and is available upon request at the registered office of the Data Controller.

Personal data will not be disseminated.

TRANSFER OF PERSONAL DATA OUTSIDE THE EUROPEAN UNION

No transfers of personal data to countries outside the European Union are envisaged.

Should such transfers become necessary, personal data will be transferred to countries outside the European Union only in full compliance with the provisions set out in Chapter V of the GDPR (“Transfers of Personal Data to Third Countries or International Organisations”).

DATA SUBJECT RIGHTS

Pursuant to Chapter III of Regulation (EU) 2016/679, data subjects may exercise the following rights at any time:

• The right to obtain from the Data Controller confirmation as to whether or not personal data concerning them are being processed and, where that is the case, to access such personal data (Article 15);
• The right to rectification (Article 16);
• The right to erasure (“right to be forgotten”) (Article 17);
• The right to restriction of processing (Article 18);
• The right to data portability (Article 20);
• The right to object (Article 21);
• The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them (Article 22);
• The right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3));
• The right to lodge a complaint with a supervisory authority (Article 77);
• The right to an effective judicial remedy against a supervisory authority (Article 78) or against the Data Controller or Data Processor (Article 79).

You may request further information from the Data Controller at any time by using the contact details provided above.

COMPLAINTS

If you believe that the processing of your personal data has been carried out unlawfully, you may lodge a complaint with one of the competent supervisory authorities responsible for ensuring compliance with personal data protection legislation.

In Italy, complaints may be lodged with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

Further information on how to submit a complaint is available on the Authority’s website: https://www.garanteprivacy.it/.

AMENDMENTS TO THIS PRIVACY NOTICE

This Privacy Notice may be subject to amendments. You are therefore advised to regularly check the latest version, which will be available on the website https://www.centrostuditaliani.org/.