PERSONAL DATA PROCESSING POLICY REGARDING ENROLLMENT IN AUDITIONS, COURSES, WORKSHOPS, SEMINARS, OR EVENTS
(REG EU 2016/679 and Italian privacy legislation)
DATA CONTROLLER:
Accademia d’Arti e Mestieri dello Spettacolo Teatro alla Scala (“Academy”) Registered office: Via Santa Marta n. 18, Milano tel. (+39) 02-8545111; email (for information regarding personal data processing): privacy@accademialascala.it
NB: This document is a translation from the original document in Italian. In the event of any discrepancies of interpretation, reliance shall be placed on said original document.
DATA SUBJECT
The Data Subject indicated herein is the candidate seeking admission to an audition and/or a course, workshop, seminar, or event proposed by the Academy. If said candidate is a minor, his/her natural or legal guardian(s) is/are authorized to provide his/her personal data.
PURPOSES AND LAWFULNESS OF PERSONAL DATA PROCESSING
a) Dispatch of course announcement/brochure in response to request by Data Subject and assessment of requisites per course announcement to audition for and/or enroll in and attend the course, workshop, seminar, or event;
b) Participation in educational activities and initiatives associated with the course, workshop, seminar, or event (e.g., internships, apprenticeships), requests for information and/or reservation of interviews, involvement in activities for former students;
c) Administration of contract relations (e.g., enrollment in the Academy); assessment of requisites for scholarships or enrollment fee waivers (see also the specific forms received after passing audition) and associated administrative processes, which may involve the involvement of a bank; administration of travel expenses, meal coupon reimbursements, contracts, payments, and invoices; compliance with accounting and administrative laws;
d) Collection of photos and/or audio/video recordings of the candidate to supplement personal data necessary to complete enrollment in the audition process (if applicable) and/or in the course, workshop, seminar, or event should said collection be indicated in the course announcement (bando di ammissione) or become necessary for other reasons;
e) Resolution of any legal disputes and defense of Academy rights;
f) Educational and training activities, including those relating to internships or apprenticeships, including but not limited to: school office services (including dispatch of information relating to the course); organization and management of the course; management of attendance/absences; issue of diplomas or certificates by the Academy and/or financial sponsors; periodic and final student assessments; participation in events and performances organized by the Academy or collaborating external organizations; courses funded by external institutions or public agencies (such as Regione Lombardia) and drafting of required financial reports in individual or aggregate form; compliance with obligations to relevant public agencies (e.g., INAIL, DPL, INPS, ENPALS) and financial sponsors (e.g., project partners) and/or joint Data Controllers (subject to specific personal data processing policy notice);
g) Establishment of insurance policies;
h) Recordings of students (generally photos, audio recordings, and/or video recordings) during lessons as an integral part of the educational process or during events in which the student may take part, said recordings in no way compromising the dignity of any individual student or group of students; said recordings have the purpose of documenting educational progress and identifying areas of improvement for individual students or groups of students and may also be observed by other Academy students for educational purposes associated with the curriculum; said recordings may also be necessary to monitor and ensure the security and safety of spaces occupied by students. Personal data pertinent to specific events in which the Data Subject may participate as an integral part of the curriculum may be publicized/circulated;
i) Teaching activities employing distance learning or mixed distance/in-person methods, if envisaged in the course announcement or dictated by specific conditions; recordings may be made (generally photos, audio recordings, and/or video recordings) to document said activities and progress towards objectives and to record the presence of the students perhaps by request of financial sponsors or due to other external requirements (e.g., academic credit acknowledgement requests). Other data may be processed, such as student accounts and time spent on the platform. Details of processed data will depend partly on the specific technology of the platform providing the service;
j) With the consent of the adult Data Subject or minor Data Subject’s natural or legal guardian(s), the dispatch via postal service, telephone service (e.g., instant messaging), or IT service of information pertaining to the presentation or promotion of courses, Open Days, artistic or educational events, and related events or activities organized and/or managed by the Academy or its partners or joint Data Controllers (subject to specific personal data processing policy notice) according to the current Academy calendar, and the dispatch of related statistical surveys, and generally information or publicity materials (including the newsletter) and notices regarding events and initiatives proposed by the Academy;
k) With the consent of the adult Data Subject or minor Data Subject’s natural or legal guardian(s), the direct or indirect use by the Academy of images documenting or captured during activities or events in which the Data Subject participates, other than those indicated at point h) above and in which the Data Subject appears and can be recognized, with no limits on purpose (including promotion, publicity, or outreach) and no limits on method or form (including internet postings, publication in print media, or circulation within the class group), provided Data Subject’s dignity is not compromised, the specifics of said use being determined by appropriate means. Furthermore, given said consent and the undersigning of a specific model release form (defined elsewhere) in the case of use for promotion, publicity, or outreach, said images may be circulated; given said consent but without the undersigning of a specific model release form, the images may be circulated within the class group; the Academy declines all responsibility for images captured and/or circulated by personal initiative of third parties (including relatives or acquaintances of the Data Subject) who are present at an event in which the Data Subject participates;
l) With the consent of the adult Data Subject or minor Data Subject’s natural or legal guardian(s), the communication, at Academy discretion, of certain personal data of the student or former student to agencies, institutes (public or private), businesses, individuals, joint Data Controllers (subject to specific personal data processing policy notice), or partners (collectively “third parties”), perhaps in response to a request by said third parties, regardless of where they are located in the world, in order to facilitate the training, employment, or professional placement of the student or former student.
PERSONAL DATA STORAGE PERIOD
For purposes a) – i) the personal data storage period depends on legislation in force specifying Data Subject and Data Controller rights and regarding the keeping of historical archives;
For purposes j) – l) the personal data storage period continues until the withdrawal of consent by the adult Data Subject or minor Data Subject’s natural or legal guardian(s) without prejudice to the legitimacy of processing prior to said withdrawal.
Personal data storage times and criteria are documented in detail in the Academy’s records of processing activities; the Academy will provide specific personal data storage times by request from adult Data Subject or minor Data Subject’s natural or legal guardian(s). The request must be sent to privacy@accademialascala.it. The Academy reserves the right to judge the validity of and to accept or deny said request.
PERSONAL DATA SUBJECT TO PROCESSING AND METHOD OF PROCESSING
In processing personal data that may directly or indirectly allow identification of the Data Subject, the Academy shall make all efforts to adhere to the principle of strict necessity and to ensure the confidentiality of processed data. Hence, the Academy collects and provides to the adult Data Subject or minor Data Subject’s legal representative and to parties authorized to process Data Subject’s personal data, including the host organizations of internships or apprenticeships and other third parties where envisaged (see Data Recipients and Subjects Authorized to Process Personal Data, below), only those data that are necessary for fulfilling purposes a) – l). Personal data will be processed via printed and computerized means by the Academy departments and offices using methods and within limits consonant with the accomplishment of said purposes. No special-category data will be requested at any point during the online registration phase regarding courses, workshops, seminars, events, and/or associated activities organized and/or managed by the Academy and/or its partners. In cases where special-category data are subsequently requested, said data will be exclusively of a medical nature, acquired in compliance with laws relating to injuries and their communication to relevant authorities, and will not be transmitted online. The Data Subject may be required to produce original documents signed either by the adult Data Subject or by the natural or legal guardian(s) of a minor Data Subject as specified in the announcement for the course in question. The names (or codes) and other data (such as photographs or nationality) of those who pass the audition process and are admitted or judged fit for admission to the Academy may be posted on the dedicated bulletin boards on Academy premises or posted online on the Academy website (accademialascala.it) and/or linked social media pages. The names or other data of persons who do not pass the audition will not be disclosed. Further information on this specific point that cannot be found in the pertinent course announcement may be requested from relazioni.esterne@accademialascala.it.
DATA PROVISION REQUIREMENT
The provision of personal data is necessary for accomplishing the purposes set forth above; specifically:
• The provision of personal data for purposes a) – i) is necessary for access to the course announcement, candidate assessment process, participation in an audition as specified in the relevant course announcement, the possible acceptance and administration of financial aid if provided and, if necessary, requested (per course announcement and student loan or scholarship forms), subsequent enrollment in and attendance of the course, workshop, or seminar, including requests for information or interviews, and/or participation in associated events and/or activities organized and/or managed by the Academy and/or its partners, recordings of students, and teaching activities which may be conducted remotely or in a mixed remote/in-person format. Enrollment, as well as requests for scholarships or student loans, involves the provision on forms of personal data already provided in other contexts and the Data Subject’s IBAN, for which consent is implicit herein. Non-provision of personal data for the above purposes will make it impossible to conclude or perform a contract, it being understood that consent for transfer of personal data to countries outside of the European Union for the purposes of internships or apprenticeships or the participation in events is not binding (Reg. EU 2016/679 Art. 49.1b);
• The provision of personal data for the purposes j) – l) is optional and subject to consent. The refusal to provide personal data for said purposes will not in any way preclude the right of the Data Subject to take part in auditions for the course, workshop, or seminar, and/or in associated events and/or activities organized and/or managed by the Academy and/or its partners and to enroll in and attend the same.
Furthermore, certain data (e.g., birthdate, residence, gender) may be collected and processed to produce aggregate statistics without any possibility of identifying the Data Subject; these statistics are produced to monitor the quality of services offered, also by sponsors or sources of funding.
LEGAL BASIS FOR PERSONAL DATA PROCESSING
The legal basis for personal data processing for purposes a) and b) is fulfillment of Data Subject requests.
The legal basis for personal data processing for purposes c) – i) is the legitimate interest of the Academy to provide services consistent with its business purposes and to comply with regional and national legislation regarding administrative and bureaucratic management of its curricula (including internships and apprenticeships) and contracts in compliance with relevant laws and regulations.
The legal basis for personal data processing for purposes j) – l) is Data Subject consent.
DATA RECIPIENTS AND SUBJECTS AUTHORIZED TO PROCESS PERSONAL DATA
Personal data may be accessed by Academy personnel (employees, consultants, interns, apprentices, authorized professionals) for administrative, organizational, and promotional activities, and by members of selection, mid-term exam (if applicable), and final exam committees.
If provided in the course announcement, and limited exclusively to educational purposes, students in other courses may have access to some personal data.
Personal data and (when necessary) special-category data provided for the purpose of admission to an audition process, to a course according to the course announcement, or for participation in an activity, may be processed by specialized medical personnel authorized by the Academy for medical assessments. If necessary, the personal data and/or special-category data of those admitted to a course, workshop, or seminar may also be processed by the Academy-designated physician in order to assess risks and for any necessary medical services during the academic year.
Some IT system operation and maintenance and other services may be outsourced to third parties to whom professional services are entrusted to support Academy activities and thus personal data may be processed by the personnel of these third parties operating in the capacity of Academy Data Processors and/or system administrators, where so named, and implementing appropriate measures to ensure data confidentiality and security.
For the purposes indicated in points a) – i), personal data may be communicated to relevant public agencies and bodies, such as: the Labor Oversight Authority (Ispettorato del Lavoro) as regards internships, apprenticeships, or participation in events or performances; the National Institute for Insurance against Workplace Accidents and Occupational Disease (INAIL) and insurance companies in the event of injuries (in which case the Academy may gain knowledge of special-category data relating to the Data Subject’s injury) or for the administration of insurance coverage provided by the Academy; partners in projects or joint Data Controllers (subject to specific personal data processing policy notice), public or private agencies or institutes in relation to projects they are funding (to whom, in which case, data on course attendance and participation in events or performances may be provided); banks (for the provision of student loans, scholarships, or other types of funding); businesses hosting internships; legal and tax consultants for the purposes of managing the Academy’s legal and fiscal affairs, and other professionals appointed to conduct specific activities; third party auditors (e.g., ISO 9001 certification agencies, oversight bodies, the Data Protection Officer, and financial sponsors); and other parties to whom personal data must be communicated by law or regulation. Additionally, for purpose h), the personal data may be circulated within the limits provided in said purpose.
For purposes j) – l), in addition to the information in the preceding paragraph, personal data may be communicated to parties providing consulting and/or support services for the management of promotional and marketing activities. For purpose k), personal data may be circulated following a request for consent and the undersigning, if necessary, of a model release form.
For purposes h) and k), regarding recordings documenting the activities listed therein, photographs or video recordings of the adult or minor Data Subject captured during the course, workshop, seminar, or event may be circulated on websites, social media channels, magazines and any digital or print media belonging to the Academy, its media partners, and/or third-party partners of the Academy.
In certain cases, personal data may also be processed by the employees, consultants, and possible external Data Processors of the organization hosting an internship, apprenticeship, or event. For activities associated with funding, personal data may also be transmitted to the financial sponsor.
Some data communicated to authorized external Data Processors may be transmitted via platforms made available by said Processors.
A detailed list of external Data Processors acting on behalf of the Data Controller is available on request from privacy@accademialascala.it. Access to this list is subject to an assessment of the legitimacy of the request.
SECURITY OF DATA
Data Subject personal data will be processed in keeping with the principle of necessity and proportionality, avoiding processing of personal data when the operations can be carried out using anonymous data or in other ways. The Academy has implemented specific technical and organizational security measures to prevent loss of personal data, illicit or improper use of personal data, and unauthorized access to personal data.
DATA TRANSFER
At the moment all external Data Processors operating on behalf of the Academy are located in the European Union. However, in the future it may be necessary to transfer personal data to subjects outside of the European Union in countries that do not ensure an adequate level of protection per the Italian Privacy Law and the European General Data Protection Regulation (EU) 2016/679. The Academy will transfer data outside of the European Union only after the precautions set forth in the Italian Privacy Law and REG EU 2016/679 have been put in place, after the external Data Processors have provided suitable guarantees, and after the Data Subject has provided his/her consent.
NB Some host subjects may have facilities in extra-EU countries. Specific consent by the Data Subject will be requested in such cases.
DATA SUBJECT’S RIGHTS
By contacting the Data Controller at privacy@accademialascala.it, the Data Subject may exercise applicable rights as regards his or her personal data, including deletion of personal data, correction of inexact data, addition of missing data, limitations to processing, data portability, or objection to data processing without adversely affecting the rights and freedoms of the Data Controller.
The Data Subject’s consent to processing his or her personal data for any of the purposes indicated herein may be withdrawn at any time, subject to an assessment of the legitimacy of the request.
The Data Subject has the right to lodge a complaint with a supervisory authority in the EU member state where the Data Subject maintains his or her principal residence or in the state in which the presumed violation occurred. For more information regarding said right, please visit: https://goo.gl/GLbTN9.
The Academy does not make use of automated decision-making processes.
ACADEMY PRIVACY POLICY CONTACT
For any doubts, requests for clarification, information on the exercise of Data Subject rights, or anything else that may regard the processing of personal data, the adult Data Subject or minor Data Subject’s natural or legal guardian(s) may contact the Academy Privacy Policy Contact by phone (+39) 02-85451192/85451171 or email: privacy@accademialascala.it.
In order to ensure the security of Data Subject’s personal data and observance of Data Subject’s rights, the Academy has appointed a Data Protection Officer having support, oversight, consultancy, instructional, and informational functions, cooperating and acting as liaison with the Italian Data Protection Authority for issues relating to personal data processing. The Academy Data Protection Officer may be contacted at: dpo@accademialascala.it or tel. (+39) 02-85451192/85451171
AMENDMENTS
The Data Controller reserves the right to make changes to this personal data processing policy document, making due effort to call said changes to the attention of Data Subjects.
Updated on August 2, 2021
|
