Personal Data Protection Policy
Pursuant to Article 13 of Regulation EU No. 2016/679 (hereinafter “GDPR”), we inform you that your data will be processed in the following ways and for the following purposes:
1. Object of Processing
The Data Controller processes personal, identification data (e.g., name, surname, company name, address, telephone number, email, bank and payment details) – hereinafter, “personal data” or “data” – communicated by you when concluding contracts for the Data Controller’s services.
2. Purpose of Processing
The purposes of processing are: carrying out the activities of the Data Controller, which involve communication agency activities and advertising concessions, as well as for management, statistical, commercial, marketing, credit protection, credit management and transfer, pre-contractual, contractual, and tax obligations, obligations provided by law, regulation, EU legislation, or an order of the Authority (e.g., anti-money laundering), exercising the rights of the Data Controller, such as the right to defense in court.
3. Legal Basis for Processing
Processing is lawful as it meets at least one of the following conditions:
a) The data subject has given consent to the processing of their personal data for one or more specific purposes;
b) Processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures taken at the request of the data subject;
c) Processing is necessary to comply with a legal obligation to which the Data Controller is subject.
4. Methods and Duration of Processing
The processing of your personal data is carried out by means of the operations indicated in Article 4, no. 2) GDPR, specifically: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure, and destruction of data. Your personal data is processed both on paper and electronically and/or automatically. The Data Controller will process the personal data for the time necessary to fulfill the above purposes and, in any case, for no longer than 10 years from the termination of the relationship.
5. Data Access and Communication
Your data may:
– be known by employees and collaborators of the Data Controller in their capacity as persons in charge of and/or internal data processors and/or system administrators;
– be communicated to third-party companies or other subjects (such as agents’ network, factoring companies, credit recovery companies, commercial information companies, banks, professional firms, consultants, insurance companies, etc.) that perform outsourcing activities on behalf of the Data Controller, in their capacity as external data processors.
6. Data Transfer
Personal data is stored on servers located within the European Union. In any case, it is understood that the Data Controller, if necessary, will have the right to move the servers even outside the EU. In this case, the Data Controller ensures that the transfer of data outside the EU will be in accordance with applicable legal provisions, subject to the stipulation of the standard contractual clauses provided by the European Commission.
7. Nature of Data Provision and Consequences of Refusal to Respond
The provision of requested data is necessary for the correct performance of the activities of the Data Controller and for the effective management and provision of the related services. In some cases, it may be necessary to acquire specific data to ensure maximum efficiency in the provision of services connected to the activities of the Data Controller. Specific consent is required for such data.
8. Rights of the Data Subject
The data subject has the right to obtain from the Data Controller confirmation of whether or not personal data concerning them is being processed and, if so, to obtain access to the personal data, its rectification, erasure, or restriction of processing. They have the right to object to processing at any time, including for direct marketing purposes, and to automated decision-making; moreover, they have the right to data portability, to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal, and to lodge a complaint with a supervisory authority.
9. Exercising Rights
You may exercise your rights at any time by sending a written request to Cross-border Film School, Piazza della Vittoria, 41 34170 Gorizia or by emailing info@crossborderfilmschool.org.
10. Data Controller
The Data Controller is Cross-border Film School, with its registered office at Piazza della Vittoria, 41 34170 Gorizia, email: info@crossborderfilmschool.org.
11. Data Protection Officer
The Data Protection Officer is Cross-border Film School, with its registered office at Piazza della Vittoria, 41 34170 Gorizia, email: info@crossborderfilmschool.org.
