Pursuant to art. 13 of EU Regulation 2016/679 of April 27, 2016 (“Regulation” or “Applicable Law”), we wish to provide, as data controllers, appropriate information about the fundamental elements of the treatment we carry out. IRCCS G.B. Bietti Foundation for the Study and Research in Ophthalmology ONLUS (hereinafter, the “Data Controller”) considers the right to privacy and the protection of personal data as guaranteed by the Applicable Law.

IRCCS The courses organized by the IRCCS G.B. Bietti Foundation are reserved for those who have reached the age of eighteen. The Data Controller does not collect personal data relating to minors. . At the request of users, the Data Controller will promptly delete all personal data involuntarily collected and related to subjects under 18 years.

For any information in relation to this privacy policy, you can contact the Data Controller, at any time, using the following methods:

• By sending a registered letter with return receipt to the registered office of the Data Controller (Via Livenza, no. 3, 00198 – Rome);
• By sending an e-mail to privacy@fondazionebietti.it.

You can also contact the Data Protection Officer (DPO) of the Data Controller, whose contact details are listed below: dpo@fondazionebietti.it.

1. Purposes of the processing

The personal data of users who register for the courses (hereinafter, respectively, “Users” and “Course”) collected by the Data Controller, will be processed lawfully by the Data Controller pursuant to art. 6 of the Regulation exclusively for the following processing purposes:

a) Contractual obligations and provision of the service, namely exclusively for purposes related to the management and execution of the course. The data collected by the Data Controller for this purpose include: name and surname, tax code, profession, entity of belonging, address, telephone, fax, email address (city, postal code, province), tax code, telephone/mobile number, email address, date and place of birth, profession and specialization, as well as all personal information possibly and voluntarily provided to the Data Controller. Notwithstanding the provisions elsewhere in this privacy policy, under no circumstances will the Data Controller make the personal data of Data Subjects accessible to third parties.

b) Administrative and accounting purposes to carry out activities of an organizational, administrative, financial and accounting nature, such as internal organizational activities and activities functional to the fulfilment of contractual and pre-contractual obligations, including the possible protection of the Data Controller’s rights.

c) Legal obligations to comply with obligations laid down by law, by an authority, by a regulation or by European legislation.

The provision of personal data for the purposes of processing indicated above is optional but necessary since failure to provide them could make it impossible for the user to participate in the course.

2. Data processing and storage methods

The Data Controller will process the personal data by means of manual and computerized tools, with logics strictly related to the purposes themselves in order to guarantee the security and confidentiality of the data.

The personal data will be kept for the time strictly necessary to achieve the main purposes described above in Section 1, or, in any case, for the protection under Civil Law of the interests of both the Users and the Data Controller.

3. Scope of communication and dissemination of data

Users’ personal data may be disclosed to the Data Controller’s employees and/or collaborators assigned to managing the course. These subjects are formally appointed by the Data Controller to process personal data exclusively for the purposes indicated in this information and in compliance with the provisions of the Applicable Law.

Third parties, who may process personal data on behalf of the Data Controller as “External Data Processors” or as independent data controllers, such as, by way of example: Agenas / Consortium for the Management of Health Professions (Co.Ge.A.P.S.), may also become aware of your personal data.

Users have the right to obtain a list of any data processors appointed by the Data Controller, by making a request to the Data Controller in the manner indicated in paragraph 4 below.

4. Rights of the Data Subjects

The rights guaranteed by the Applicable Law may be exercised by contacting the Data Controller in the following ways:

• By sending a registered letter with return receipt to the registered office of the Data Controller (Via Livenza, no. 3, 00198 – Rome);
• By sending an e-mail to privacy@fondazionebietti.it.

Pursuant to the Applicable Law, the Data Controller advises that the Data Subjects have the right to obtain information on (i) the source of the personal data; (ii) the purposes and methods of processing; (iii) the reasoning applied in the event of processing carried out with the aid of electronic instruments; (iv) the identification details of the data controller and data processors; (v) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of it in their capacity as data processors or persons in charge of processing.

Furthermore, you have the right to:

a) update, amend or, where interested therein, integrate the data;

b) delete, process in anonymous way or block all data that violates laws currently in force, including these data whose storage is not required by the purposes they have been collected and/or processed for;

c) certify that the operations and their content under a) and b) have been made known to those to whom the data has been communicated or distributed, except in the event in which such compliance proves to be impossible or leads to the use of manifestly disproportionate means in respect of the right defended.

Furthermore, you have:

– the right to withdraw consent at any time, if the processing is based on their consent;

– if applicable, the right to data portability (the right to receive all personal data concerning the Data Subject in structured format, commonly used and readable by automatic devices), the right to limit the processing of personal data and the right to be deleted (“right to be forgotten”);

– the right to object, in whole or in part, for legitimate reasons to the processing of your personal data, even if relevant for collection purposes.

– if the user considers that the processing of personal data carried out by the Data Controller violates the Regulation, the user has the right to make a complaint to a controlling Authority (in the country in which you normally reside, in the one in which you work or in the one in which the alleged violation has occurred). The Italian supervisory authority is the Italian Data Protection Authority, with head office in Piazza Venezia no. 11, 00187 – Rome (http://www.garanteprivacy.it/).