Introduction

ROI Group S.r.l. considers the protection of its users’ privacy to be fundamental; therefore, it adopts all necessary measures to this end and is constantly committed to handling personal data with the utmost care and seriousness. In fact, in processing the personal data collected, ROI Group S.r.l. takes every suitable measure to ensure the security and confidentiality of the data, in compliance with current regulations.

This notice explains how the personal information of our clients is managed in relation to requests for information about our courses, events, and activities, as well as subscriptions to the newsletter. It outlines the methods and purposes of collecting, using, and processing information in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (commonly referred to as GDPR).

Data Controller

The Data Controller is ROI Group S.r.l., with registered office in Macerata (MC), Galleria del Commercio n. 6 (hereinafter, the “Data Controller”).

Legitimation for Data Provision

The Data Controller declines all responsibility in the event that the Data Subject provides incorrect or untrue data, or data relating to third parties for whom they are not entitled and/or expressly authorized to provide the data and express consent to the processing. The Data Subject assumes full responsibility for such conduct.

Categories of Data Processed

The personal data processed by the Data Controller are as follows:

a. Personal Data: personal details (name and surname);
b. Contact Data (telephone, email).

This site uses cookies. To learn more, you can consult the extended cookie policy at the following link: https://www.performancestrategies.it/en/cookie-policy/

Purposes of Processing and Legal Basis

The provision of the aforementioned data is carried out for the following purposes:

a. Pre-contractual activities related to courses/events, at the request of the Data Subject (for the request for information);

The aforementioned processing is based on the consent of the Data Subject (Art. 6, paragraph 1, letter a GDPR).

The Data Subject has the right to withdraw consent at any time without prejudice to the lawfulness of the processing carried out before the withdrawal. On the methods of exercising the right of withdrawal, see section “Exercise of the rights of the data subject”.

If the messages sent by the user are of a contractual or pre-contractual nature, the processing will be based on the negotiation relationship between the Data Controller and the User, pursuant to Art. 6, paragraph 1, letter b, GDPR and the data may be processed regardless of the consent of the data subject.

The provision of data is optional. Any withdrawal of consent by the data subject will make it impossible for the Data Controller to follow up on the request sent by the User, except for communications of a contractual and pre-contractual nature. The provision of data for the aforementioned processing is mandatory, as it is necessary for the correct sending of the information requested by the data subject and constitutes the execution of pre-contractual measures (legal basis: contract, art. 6, paragraph 1, letter b GDPR).

b. Sending by ROI Group S.r.l., at the request of the Data Subject, of free informative content in the form of a newsletter (for subscription to the newsletter).

The processing is based on the consent of the data subject (Art. 6, paragraph 1, letter a GDPR), to be expressed as a condition of validity of the related request. The provision of data is optional. Any refusal by the Data Subject to provide the data and/or give consent or its withdrawal will make it impossible to use the requested service.

The data subject has the right to withdraw consent at any time without prejudice to the lawfulness of the processing carried out before the withdrawal. On the methods of exercising the right of withdrawal, see section “Exercise of the rights of the data subject”. For the newsletter, it is also possible to withdraw consent via the appropriate link at the bottom of each communication.

The processing of the aforementioned data also takes place for the following purpose:

c. Management of any litigation.

d. Transmission, to the email address provided, of proposals relating to services and products similar to those being sold, pursuant to art. 130, paragraph 4, Privacy Code, without prejudice to the customer’s right to object at any time to this purpose, pursuant to art. 21 GDPR, also via the appropriate link at the bottom of each email message (so-called unsubscribe).

The processing for this purpose is based on the legitimate interest of the Data Controller (Art. 6, paragraph 1, letter f GDPR) in the judicial and extrajudicial protection of its rights and in the sending of commercial information pursuant to art. 130, paragraph 4, Privacy Code.

Automated decision-making processes are not foreseen.

Data Retention Period

Personal data will be kept:

– for the purposes under a) and c) for the time necessary to manage the message and process any response. In the case of communications of a contractual or pre-contractual nature, 10 years from the sending of the communication or from the complete execution of the related contract;

– for the purpose under b) the sending of the newsletter will continue for the period for which the Data Controller will keep the service active or until the withdrawal of consent by the User, if earlier. In each message, the User will be reminded that he has the right to unsubscribe from the service with a specific link. In case of less frequent messages, this option will be further reminded to the interested party on an annual basis;

– for the purpose under d): the sending of information will continue for a period of 5 years from the provision of data, without prejudice to the data subject’s right to object exercisable at any time.

Data Communication

Personal data may be communicated to external parties, if necessary, duly appointed as data processors (Art. 28 GDPR), who process the data on behalf of the Data Controller.

In particular, the data processed may be communicated to the following categories of recipients:

• technical experts and software houses that assist the Data Controller for the purposes of development, maintenance and care of the website and IT infrastructure;

• external parties that assist the data controller in the organization and conduct of the purposes referred to in points a, b and c;

• companies, including newly established ones, belonging to the same group as the Data Controller.

Data processing takes place within the European Union.

The dissemination of personal data being processed is not foreseen.

Security Measures

Personal data will be processed in paper and electronic form. To this end, all suitable procedures will be adopted to protect the confidentiality, integrity and availability of the information in compliance with current regulations.

Rights of the Data Subject

Pursuant to Articles 13-21 of the GDPR, under the conditions provided therein, the Data Subject may at any time exercise the following rights against the Data Controller:

• right to withdraw consent to data processing (see section “Purposes of processing and legal basis”)

• right of access (the Data Subject has the right to obtain confirmation as to whether or not personal data concerning him or her are being processed, as well as information on the data processed and to receive a copy of the same);

• right to rectification (the Data Subject may request the updating or correction of their personal data);

• right to erasure (“right to be forgotten”) (the Data Subject may request the erasure of their personal data, in the cases and under the conditions referred to in Article 17 GDPR);

• right to data portability (in the cases and under the conditions referred to in Article 20 GDPR, the Data Subject has the right to receive their data in a structured, commonly used and machine-readable format and, where technically feasible, to obtain its transfer without hindrance to another controller).

• restriction of processing (the Data Subject may request the restriction of the processing of their data, in the cases referred to in Article 18 GDPR. In this event, the data may be processed by the Data Controller, in addition to storage, with the consent of the data subject or for the protection of its own or others’ rights in court or for reasons of public interest).

• right to object (the Data Subject, when personal data are processed by the Data controller for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or for the purposes of the legitimate interests pursued by the controller, has the right to object to processing on grounds relating to their particular situation. If the personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing).

• right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it).

Exercise of the Rights of the Data Subject

To exercise the aforementioned rights, the Data Subject must send a written request to the Data Controller at the contact details indicated below.

Contact details

For any request and for the exercise of their rights, the Data Subject may contact the Data Controller at the following email address: privacy@roigroup.it.

Changes to this privacy policy

The Data Controller reserves the right to make changes to this privacy policy at any time by providing adequate information to Users, who may withdraw their consent to the processing of their personal data.

Last update: April 21, 2022