INFORMATION ON THE PROCESSING OF PERSONAL DATA

REQUEST FOR INFORMATION

World International School S.p.a. a socio unico (hereinafter referred to as WINS or the Data Controller) provides the following information pursuant to Article 13 of EU Regulation No. 2016/679 of April 27, 2016 (hereinafter GDPR), to describe the characteristics of the processing carried out in relation to your personal data and those of your family members and the measures adopted to protect their rights.

Data Controller

The Data Controller is World International School S.p.a. a socio unico (VAT No. 09284580967) with registered office at Via Michelangelo Buonarroti No. 39, 20145 Milan – Contacts: Tel. +39 011 1972111 | Fax +39 011 1972150 | E-mail: info@worldinternationalschool.com

Data Protection Officer

WINS has appointed a Data Protection Officer who can be contacted if you have any questions or doubts about the characteristics and methods of processing. The DPO can be reached at the following addresses: dpowins@worldinternationalschool.com dpo_wins@pec.it dpo_wins@pec.it.

Data subject to processing

The Data Controller essentially collects the following personal data:

  • contact data

Purposes of processing and retention periods

Personal data will be processed for the following purposes:

  • Responding to a request from the Data Subject

The personal data collected will be retained for a period not exceeding fifteen months.

Why the processing we carry out is lawful

The processing is lawful because it is based on the following legal grounds:

  • Responding to a request from the Data Subject (pre-contractual measure).

 

Methods of processing personal data and place of storage

I dati personali sono trattati sia in modalità cartacea che elettronica (es: server, database in cloud, software applicativi).

I dati verranno conservati all’interno dello spazio economico europeo. Nel caso in cui il trasferimento dovesse essere effettuato al di fuori dello spazio Economico Europeo, lo stesso sarà sottoposto a garanzie adeguate ai sensi dell’art. 46, comma 2 lettere b, c d, del Regolamento EU 679/2016 (GDPR).

 

Optional or mandatory nature of the data provided

The provision of data is mandatory and failure to provide it will prevent WINS from managing the meeting request.

Categories of subjects to whom personal data may be communicated

The processing of the personal data provided may be carried out, in compliance with the principle of strict necessity of processing:

  • By WINS employees, who act and process the data under the authority and instructions of the Data Controller, pursuant to Article 29 of the GDPR or by employees designated by the Data Controller, pursuant to Article 2 quaterdecies of Legislative Decree No. 101/2018.
  • By natural or legal persons whose ability to access personal data is recognized by legal provisions provided by European Union law or Italian law, such as, by way of example, competent authorities and/or supervisory bodies for the fulfilment of legal obligations, and public administrations for their institutional purposes.
  • By natural or legal persons used by the Data Controller to carry out activities instrumental to the achievement of the purposes mentioned above (by way of example: IT and application service providers, security services) or to whom WINS is required to communicate the data, by virtue of legal or contractual obligations. The service providers appointed as external data processors will be subject to contractual and regulatory obligations to maintain the confidentiality of the data and will only have access to the information necessary to perform their functions.

A list of external data processors is available at the Data Controller’s office.

Data dissemination

The processed data will not be disseminated in any case.

Rights of the Data Subject

In relation to the processing of personal data, pursuant to the GDPR, the Data Subject has the following rights:

  • Right of access: has the right to obtain a copy of their personal data held by WINS and which are subject to processing.
  • Right to rectification: has the right to rectify personal data held by WINS if they are not up-to-date or correct.
  • Right to withdraw consent: can also withdraw consent given for a specific processing at any time.
  • Right to contact the Data Protection Authority if they have doubts about the processing of personal data carried out by WINS.

The Data Subject can also exercise the following rights under certain circumstances:

  • Right to erasure: can request that WINS delete personal data if the purposes of the processing have ceased and there are no legitimate interests or legal norms requiring its continuation.
  • Right to object to processing: can request that WINS cease a specific processing of personal data. The right to object does not apply when the processing of data is carried out on a contractual basis.
  • Right to data portability: has the right to obtain a copy of personal data in a commonly used structured format readable by an automatic device and has the right to obtain the direct transmission of personal data from one controller to another without hindrance27.
  • Right to restrict processing: has the right to request that WINS limit the processing operations on their personal data.

To exercise any of the aforementioned rights, the Data Subject can send an email or write to the following address specifying the request and providing WINS with the information necessary for the correct identification of the sender (also attaching a copy of their identity document):

WINS will respond within one month. If for any reason WINS is unable to respond, they will provide a detailed explanation of why they cannot fulfil the request32.

This information may be subject to changes or additions over time, so we invite you to periodically consult the Data Controller’s website https://worldinternationalschool.com  to stay constantly updated.

 

Last version: March 2025