Privacy Notice in Accordance with Article 13 of EU Regulation no. 2016/679 (GDPR)

This privacy notice is provided by The World School S.r.l. Società Benefit, with its registered office at Via della Chiusa 9, 20123 Milan (MI), VAT and tax code 13813560961 (hereafter “TWS” or “Data Controller”), as the Data Controller, in compliance with Article 13 of EU Regulation 2016/679 (GDPR). TWS is committed to protecting the privacy and security of personal data belonging to its employees, collaborators, students, and families.

1. DATA PROCESSING SCOPE

Data processing is conducted based on the legal grounds specified in Article 6 of the GDPR. TWS processes the personal data of parents, guardians, and students, such as names, surnames, contact details, personal identification information, video and photographic images (hereinafter referred to as “personal data” or simply “data”), provided by the data subject or collected from third parties during the enrollment process and in the execution of the contractual relationship.

TWS informs that processing of special categories of personal data may be necessary under Article 9 of the GDPR (e.g., health-related data). Such data will only be processed with explicit consent from the individual or, in the case of minors, from a parent or guardian.

2. PURPOSE OF DATA PROCESSING

The personal data collected may be processed for the following purposes:

• Contract execution: To fulfill obligations arising from the contract related to the educational services provided.
• Compliance with regulations: To comply with legal obligations established by national or European Union laws.
• Management of school services: organize and manage the services, activities, and assistance offered by the school.
• Administrative purposes: To carry out administrative, accounting, and other activities related to the management of the contractual relationship.
• Marketing activities: To promote products, services, or events organized by the school or third parties.
• Promotion and communication of events: promote and share events and projects organized by the school through its communication channels (website, blog, and social media). In such cases, the data processed may include images of students.

3. METHODS OF PROCESSING

Your data will be processed according to principles of fairness, legality, and transparency, using automated systems to store, manage, and transmit data. Processing will be conducted with appropriate tools, according to the latest technological standards, to ensure security and confidentiality. Measures are in place to prevent loss, unauthorized access, unlawful use, and dissemination.

Data processing may involve operations listed in Article 4.2 of the GDPR, including collection, recording, organization, structuring, storage, adaptation, modification, extraction, consultation, use, blocking, and destruction. Your personal data may be processed in paper or electronic/automated formats by individuals specifically authorized for such processing.

4. LOCATION OF DATA PROCESSING

Data is currently processed and stored at the Company’s operational headquarters. It may also be processed, on behalf of the Data Controller, by employees, collaborators, professionals, and/or companies tasked with technical, development, management, and administrative-accounting activities. Data may be shared or transferred abroad, including to non-EU countries, for technical reasons related to the IT system or for rendering the services provided by the contract.

5. DATA RETENTION PERIOD

Personal data will be stored in the company database for the activities mentioned in Section 2 and will be retained as long as the student is enrolled at Milan World School. Once enrollment has ceased, data will be kept for additional 12 months. After this retention period, the data will be destroyed or anonymized.

6. DATA ACCESS

Access to personal data is restricted to authorized TWS personnel and third parties collaborating with the Data Controller for specific purposes. These parties are bound by confidentiality obligations and process data only for the authorized purposes.

7. NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL

The provision and processing of data for activities listed under points a) to d) of Section 2 are necessary for fulfilling contractual or legal obligations; refusal to provide or allow TWS to process such data will result in the inability to execute the contract correctly and promptly. The provision of and consent for the processing of additional data is optional.

8. DATA COMMUNICATION

Data may be disclosed to third parties identified in this notice for the purposes outlined in paragraph 2. No form of dissemination of your data is planned.

9. DATA TRANSFER

Personal data is stored on hardware devices located in Italy or within the European Union. However, should it be necessary, the Data Controller may transfer data servers outside the EU. In such cases, the transfer will comply with legal requirements, including signing standard contractual clauses as specified by the European Commission.

10. RIGHTS OF THE DATA SUBJECT

Under GDPR Articles 15 to 22, data subjects have the following rights: Access, Rectification, Erasure, Restriction of Processing, Data Portability, Objection. To exercise these rights, please contact TWS by email at info@milanworldschool.com or PEC at milanworldschool@pec.it.

11. UPDATES TO THIS PRIVACY NOTICE

This notice may be updated periodically. The latest version will always be available on TWS’s website, and updates will be communicated to data subjects as necessary.