Privacy Notice on the Processing of Personal Data

1. Introduction and legal references
This notice explains the processing of personal data collected through this website, including those obtained via cookies, tracking technologies and—where present—contact forms, restricted areas, digital services, and economic transactions carried out electronically.
This notice is addressed to anyone who accesses or uses this site, describing how users’ personal data are collected, used and protected, as well as the rights granted by law.
These provisions do not concern other websites, pages or online services accessible through any external links that may be present on the site; please refer to the respective privacy notices of those third parties.
This notice is provided in compliance with the main national and international data protection regulations, including:

• Regulation (EU) 2016/679 (GDPR)
• Other regulations that may apply.

2. Who manages your data and how can you contact us?
Your personal data are processed by:
Parents’ Association of the European School of Varese
Via Enrico Fermi, 2749 Ispra
parents.association@agsev.it

For any information regarding the processing of personal data or to exercise your rights under the law, data subjects can contact the Controller.

3. On what legal bases do we process your data?
The processing of personal data collected through this site (including via cookies, similar technologies, contact forms, restricted areas, digital services and transactions, where applicable) is based on one or more of the following legal bases:

1. Performance of a service/pre-contractual measures requested by the user through the provided contact forms;
2. Compliance with legal, regulatory or statutory obligations;

An additional legal basis, the legitimate interest of the Controller, may be used for specific purposes (e.g., ensuring IT security, preventing fraud, protecting the Controller’s rights in legal proceedings).

Failure to give or withdrawal of consent may reduce or limit certain functionalities or personalized services.

4. What data do we collect when you visit the site?
While browsing this site, the following data may be collected—also via cookies and similar technologies such as pixel tags, web beacons, local storage and equivalent technologies:

• Browsing and technical data: information such as IP address, device identifiers, operating system and browser data, requested URLs, connection times, technical logs, technical preferences, usage data collected via cookies and tracking technologies (pixel tags, web beacons, local storage and equivalent tools).

• Data communicated via social integrations and third-party platforms: data transmitted through social features (login, plugins, shares, etc.), processed in accordance with the rules of the respective platforms as well as this notice.

5. How do we process your data, how do we protect it, and how long do we keep it?
Personal data collected through this site are processed mainly with electronic and digital tools in accordance with the principles of lawfulness, fairness, data minimization, integrity, and confidentiality.

Data are retained according to the following timelines:

• Cookie preferences and consents: retained for 180 days, as per the Cookie Policy on this site.
• Browsing and technical data: retained only for the time necessary to ensure the security, integrity and functionality of the site and subsequently anonymized or aggregated.
• Data collected for contractual and transactional purposes: retained for the time required by applicable laws (for example, tax or accounting laws).
• Data processed for marketing purposes: retained until consent is withdrawn or deletion is requested.
• Data entered via forms or specific requests: retained for the time necessary to respond or fulfil the related purpose.

6. Who may receive your data?
The personal data collected through this site may be accessed, within the limits of their respective responsibilities and purposes, by:

• Internal subjects authorized by the Controller, duly trained in privacy and security matters;
• Suppliers and third parties appointed as Processors (for example: technical providers, IT companies, customer support companies, consultants, payment service providers and logistics providers, where applicable);
• Business partners, third parties and affiliates, exclusively for promotional/marketing purposes if you have given specific consent or exercised opt-out where provided;
• Providers of plugins, social networks and services for interaction with external platforms, which may process personal data according to their own logic as independent controllers (please refer in that case also to the individual privacy notices of such third parties);
• Competent public authorities and supervisory bodies, within the limits imposed by law or to comply with requests from judicial authorities;

The updated list of external recipients can be made available upon request by writing to the Controller’s contacts.

7. Where can your data be transferred?
Personal data collected through this site may be processed and transferred—for the purposes indicated—to the following countries:

• to countries belonging to the European Economic Area (EEA), Switzerland or other countries recognized by the competent authorities as providing an “adequate” level of protection required by law;

Updated list of “adequate” countries:

• EU
• Switzerland

8. What are your rights regarding the data collected?
The user, based on applicable law, has the right to:

• Obtain confirmation as to whether or not personal data concerning them are being processed and, where that is the case, access such data and related information (right of access).
• Request the rectification, update or deletion of inaccurate data or data that are no longer necessary (right to rectification and erasure).
• Request restriction of processing or object to the processing of data, including for promotional/profiling purposes, where provided.
• Request data portability in a structured and interoperable format (where technically feasible).
• Withdraw consent given to the use of non-technical cookies and to the processing of data collected through tracking tools.
• Report any irregularities or abuses to the competent supervisory authorities.

To exercise these rights, simply send a request to the Controller’s contacts, who will respond within the timeframes provided by the applicable local regulation.

9. How are minors’ data processed?
The protection of minors is a fundamental priority.

The services and content of this site are not intended for individuals under 18 years of age.

We do not knowingly collect personal data of minors without the verifiable consent of a parent or legal guardian.

If a parent or guardian believes that a minor has provided personal data without authorization, they may request its removal, update, or restriction of processing by writing to the contacts indicated in this notice.

10. How to make reports or complaints to the authorities?
If you believe that the processing of your personal data through this site does not comply with applicable law, you may lodge a complaint free of charge with the competent supervisory authorities, including:

• The Data Protection Authority of your country of citizenship or residence;
• European Data Protection Supervisor

How will we inform you about changes to this notice?
This notice is subject to periodic review due to regulatory updates or changes to the services offered through the site. Any significant change will be communicated on this page.

This notice is made available by My Agile Privacy.