PRIVACY POLICY PURSUANT TO ARTICLES 13 – 14 OF GDPR 2016/679
GDPR – GENERAL DATA PROTECTION REGULATION

Next Fashion School di Carla Secoli s.r.l.
Via G. Prina 5
20154 Milan
Telephone: +39 02 38237568
Email: info@nextfashionschool.com

Next Fashion School di Carla Secoli s.r.l., acting as Data Controller, hereinafter referred to as the Controller, informs you, pursuant to Articles 13 and 14 of GDPR 2016/679, that your data will be processed in the manner and for the following purposes:

1. SUBJECT MATTER OF THE PROCESSING

The Data Controller processes the personal data – both identifying and non-sensitive (in particular, first name, surname, date of birth, residential address, tax code, email address, telephone/mobile number – hereinafter referred to as “personal data” or simply “data”) – provided to it.

2. PURPOSE OF THE PROCESSING

The legal basis for the processing of your data is your consent, and it is carried out for the following purpose:

• to fulfil pre-contractual, contractual and tax obligations (VAT register, etc.) arising from existing relationships;
• to comply with obligations laid down by law, by a regulation, by EU legislation or by an order from the Authority;
• to exercise the Data Subject’s rights, such as the right to a defence in legal proceedings;
• to allow the sending of newsletters and/or mailing lists for service or promotional communications, the organisation of events, upcoming courses and any further services requested.

3. METHODS OF PROCESSING

The processing of personal data is carried out by means of the operations set out in Article 4 of the GDPR 2016/679 and in Article 4(2) of the GDPR, namely: collection, recording, organisation, storage, consultation, processing, modification, selection, retrieval, comparison, use, interconnection, blocking, disclosure, erasure and destruction of data.
Personal data is therefore processed both on paper and electronically and/or automatically.

4. PERSONAL DATA COLLECTED BY THE APPLICATION

Personal data on this app is collected using the following services:

Operation, Maintenance and SSL Encryption

This application uses SSL encryption. This encryption is particularly useful when processing requests made via the application, but it is always active. It is easy to tell when encryption is in use: the address bar in your browser changes from “http://” to “https://”. Data encrypted with SSL cannot be read by third parties.

Only send confidential information when SSL encryption is enabled. If you receive security warnings from your web browser, do not continue browsing or sending data.
For operational and maintenance purposes, this application and any third-party services it uses may collect system logs, i.e. files that record interactions and which may also contain Personal Data, such as the user’s IP address.

Contact Forms

By filling in the contact forms with their personal details, users consent to their use for the purpose of responding to requests for information, bookings or any other matter specified in the form header.
Personal details: name, email address, telephone number.

Newsletter (MailChimp)

We use MailChimp to manage the registration process and send out our newsletter, which provides email updates on news from the world of Next, events, upcoming courses, special offers and much more.
Registration takes place in two steps (double opt-in): the first when the user enters their details and requests to subscribe, and the second when the system processes the registration and sends an email containing a link to the user to confirm their wish to receive the service. You can unsubscribe from the newsletter at any time by clicking on the link provided in every email.
Personal details: email address and full name.
Place of processing: USA – https://mailchimp.com/legal/privacy/

Statistics (Google Analytics with anonymised IP addresses)

Google Analytics is a web analytics service provided by Google LLC or Google Ireland Limited (“Google”). Google uses the personal data collected to track and analyse the use of this application, compile reports and share them with other services developed by Google. Google may use personal data to contextualise and personalise adverts on its advertising network. This integration of Google Analytics anonymises your IP address.

Anonymisation works by truncating users’ IP addresses within the borders of the Member States of the European Union or in other countries party to the Agreement on the European Economic Area. Only in exceptional cases will the IP address be sent to Google’s servers and truncated within the United States.
Personal Data: cookies and usage data, tracking tools.
Place of processing: Ireland/USA – https://policies.google.com/privacy

Users can selectively disable Google Analytics by installing the opt-out tool provided by Google on their browser. To disable data collection by Google Analytics, please refer to the following link: https://tools.google.com/dlpage/gaoptout?hl=it

Font (Google Fonts)

Google Fonts is a typeface rendering service operated by Google LLC or Google Ireland Limited (“Google”) which enables this application to embed such content within its pages.

Personal Data: usage data and various other types of data, as specified in the service’s privacy policy.
Place of processing: Ireland/USA – https://policies.google.com/privacy

Maps (Google Maps)

Google Maps is a map-viewing service operated by Google LLC or Google Ireland Limited (“Google”), which enables this application to embed such content within its pages.
Personal Data: cookies, usage data and various other types of data, as specified in the service’s privacy policy.
Place of processing: Ireland/USA – https://policies.google.com/privacy

Interaction with social media (Twitter, Facebook, Instagram, YouTube) and external platforms

Embedding of YouTube videos, social media content from Twitter, Facebook, Instagram and generally, as needed, content from other platforms. As we cannot control the cookies that these third-party sites set, we advise you to check directly with each third party for greater control over cookies. Below are some useful links to the privacy policies of the third parties mentioned:

Facebook/Instagram: https://www.facebook.com/privacy/policy/
Twitter: https://twitter.com/privacy?lang=it
YouTube: https://policies.google.com/privacy

Conversion tracking (Google Ads)

Google Ads conversion tracking is a statistics service provided by Google LLC or Google Ireland Limited (“Google”), depending on how the Data Controller manages the data processing, which connects data from the Google Ads advertising network with actions performed within this application.
Personal Data: usage data, tracking tool.
Place of processing: Ireland/USA – https://policies.google.com/privacy

Tag management (Google Tag Manager)

5. DATA ACCESS AND EXPORT TO THE USA

The data may be made accessible for the purposes referred to in art. 2.A) and 2.B):

• To employees and collaborators of the company of which the Data Controller is a part, in their capacity as persons authorised and/or internal data processors and/or system administrators;
• To the company of which the Data Controller is a part, (for the need to communicate or organise activities together with the student and for the normal conduct of the training course);
• The email addresses of individuals who have given explicit consent to receive marketing communications and/or are subscribed to our newsletter are shared with the technical partner The Rocket Science Group LLC MailChimp.

6. DISCLOSURE OF DATA

Without explicit consent (art. 6 lett. b) and c) GDPR), the Data Controller may nevertheless communicate the data for the purposes referred to in art. 2.A) to supervisory bodies, judicial authorities as well as to all other subjects to whom communication is mandatory by law for the accomplishment of the said purposes. Your data will not be disseminated.

Should it prove to be an opportunity for the student, in their full interest, such as a job offer from a company, the Data Controller will communicate the opportunity to the student and only upon their explicit written consent, will proceed with communicating the student's contact details to the aforementioned third party.

7. DATA TRANSFER

The management and storage of personal data will take place on servers located within the premises of the Data Controller and/or the Data Processor.
The data will not be transferred outside the European Union, except for emails (related to the mailing list and/or newsletter) which, as indicated above, will be shared with the technological partner MailChimp located in the USA.
It remains understood in any case that the Data Controller, should it become necessary, shall have the right to relocate the server if the need arises. In such an event, the Data Controller hereby ensures that the data transfer will take place in compliance with legal provisions.

8. NATURE OF THE PROVISION OF DATA AND CONSEQUENCES OF REFUSING TO ANSWER

Data necessary for the execution of the course contract
Please note that, given the purposes of the processing as illustrated above, the provision of data is mandatory and any failure to provide them, or their partial or inaccurate provision, may result in the impossibility of carrying out the registration, enrolments in the various courses, various communications and updates, and fulfilling the contractual obligations as provided for in the contract entered into. Should the refusal to use such data occur after the conclusion of a contract, the contract shall be terminated due to impossibility of performance in the absence of such data, and withdrawal policies shall be implemented.

Contact details for informational and marketing communications
Consent to the provision of such data is instead optional and withdrawal may take place at any time.
It is possible to withdraw consent, requesting removal from the mailing list and/or newsletter, while still continuing the relationship with the Data Controller (i.e. the school).
Following the revocation, no further communications will be received and the data will be deleted.

Data provided voluntarily by the user and/or via contact forms
The optional, explicit and voluntary sending of electronic mail to the addresses indicated and/or via the application's contact forms entails the subsequent acquisition of the sender's e-mail address, which is necessary to reply to requests, as well as any other personal data included in the message and/or form.

9. AS THE DATA SUBJECT, YOU ARE GRANTED THE RIGHTS REFERRED TO IN ART. 15 GDPR, SPECIFICALLY THE RIGHTS TO:

1. Obtaining confirmation as to whether or not personal data concerning you exists, even if not yet registered, and their communication in an intelligible form;
2. Get the following directions:

• The origin of the personal data;
• Regarding the purposes and methods of the processing;
• of the logic involved in processing carried out with the aid of electronic instruments;
• of the identification details of the Data Controller, the processors and the representative designated pursuant to Article 3, paragraph 1, of GDPR 2016/679;
• the subjects or categories of subjects to whom the personal data may be communicated or who may come to know about them as designated representatives within the territory of the State, as data processors or persons in charge of processing;

3. get

• the updating, rectification or, where necessary, integration of the data;
• the erasure, anonymisation or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed;
• certification that the operations referred to in letters a) and b) have been notified, also as regards their content, to those to whom the data were communicated or disseminated, unless this requirement proves impossible or involves the use of means that are manifestly disproportionate to the right protected;

4. object, in whole or in part:

• on legitimate grounds relating to the processing of personal data, where they are not relevant to the purpose of collection;
• to the processing of personal data for the purpose of sending advertising material through the use of automated calling systems without the intervention of an operator, by email, and/or through traditional marketing methods by telephone and/or post. Please note that the data subject's right to object, set out in point (b) above, for direct marketing purposes via automated methods extends to traditional ones and that, in any case, the data subject retains the option to exercise the right to object even in part. The data subject may decide to receive only communications by traditional methods or only automated communications, or neither of the two types of communication.
• Where applicable, you have the rights pursuant to Articles 16-21 of the GDPR (right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the Supervisory Authority.

10. PROCEDURES FOR EXERCISING RIGHTS

It is possible at any time to exercise your rights by sending a document via:
– a registered letter with return receipt addressed to Next Fashion School di Carla Secoli s.r.l. at the address Via G. Prina 5, 20154 Milan, or to simplify the exercise of the right, to the following e-mail address info@nextfashionschool.com.
It is also possible to call the number: +39 02 38237568.
We are committed to ensuring the respect of your rights, as simply and quickly as possible.

11. MINORI

The data collected by the Data Controller is not intended for minors under 18 years of age and the Data Controller does not intentionally collect personal information referring to minors. In the event that information on minors is unintentionally recorded, the Data Controller will delete it promptly upon users' request.

12. DURATION OF TREATMENT

Personal data is retained for the entire duration of the relationship with the Data Controller and, in the event of revocation and/or other type of termination of the relationship.
The Data Controller will process the personal data for the time necessary to fulfil the above purposes and in any case for no more than 10 years from the termination of the relationship.

13. DATA CONTROLLERS, PROCESSOR AND PERSONS IN CHARGE

The Data Controller is Next Fashion School di Carla Secoli s.r.l.
The updated list of data processors and persons in charge of data processing is kept at the Data Controller’s office.

14. USE OF COOKIES

This application uses cookies. We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners, who may combine it with other information that you've provided to them or that they've collected from your use of their services.

Cookies are small text files that can be used by websites to make the user experience more efficient.

The law states that cookies can be stored on the user's device if they are strictly necessary for the operation of this application. This application uses various types of cookies and some cookies are placed by third-party services that appear on our pages. The data subject can prevent the installation of cookies by clicking the “Reject All” option in the banner or through the specific functions available on their browser.

Consent applies only to this Application. For all information regarding cookies, please consult our Cookies Policy.

15. CHANGES TO THIS PRIVACY POLICY

The Data Controller reserves the right to make changes to this privacy policy at any time by giving notice on this page and, if possible, within this application and/or - as far as technically and legally feasible - by sending a notice to Users via any contact information available to the Data Controller.
Therefore, please check this page regularly, referring to the date of last modification indicated at the bottom.

Should the changes affect processing activities whose legal basis is consent, the Data Controller shall collect the User's consent anew, if necessary.

Last modified: 7 March 2023