1. PROCESSING AND CONTACTS

The controller of the processing of personal data (hereinafter the Data Controller) is:
Studio Congressi s.r.l., with registered office in Viale della Libertà 17, 27100 Pavia (IT)
email: info@studio-congressi.com
PEC: studio-congressi@legalmail.it
Tel. +39 0382 21424

Any requests relating to the processing of personal data (including the exercise of the rights referred to in paragraph 9) may be sent to the above addresses.

2. PROTECTION OF DATA PROTECTION (DPO)

Studio Congressi s.r.l.: appointed a Data Protection Officer (DPO), contactable at email info@studio-congressi.com;

3. TYPE OF DATA PROCESSED

In relation to your participation in continuing training courses in medicine (ECM), the Data Controller processes the following categories of personal data:

• Identification and contact data: first name, last name, tax code, email address, phone number, home or home address, institution/home building.
• Occupational data: health profession, Order/Albo membership, registration number, role/qualification, health structure or body of belonging, any information relating to the professional position or the specialization area.
• Data relating to participation in the ECM courses: courses in which you enrolled and participated, date and duration of events, recorded attendance, learning test results, issued certificates, matured ECM credits.
• Navigation and use data of platforms (if applicable): access logs to online platforms, session identifiers, IP address, data relating to the use of online services necessary for the provision of distance courses.

4. FINALITY OF TREATMENT AND LEGAL BASIS

I Your personal data will be processed for the following purposes and on the basis of the corresponding legal basis:

Management of registration and participation in ECM courses

• management of information requests;
• registration and confirmation of registration;
• attendance management (also through signature logs or electronic systems);
• issue of the certificates of participation.
• Legal basis: execution of a contract of which you are a party or pre-contractual measures adopted on your request (art. 6, par. 1, letter b) GDPR).

ECM system related requirements

• communication of the data necessary to Ministry of Health, Lombardy Region and other competent bodies for the accreditation ECM;
• management and registration of accrued ECM credits; compliance required by ECM law and the provisions of the competent authorities.
• Legal basis: fulfillment of legal obligations to which the Data Controller is subject (art. 6, par. 1, lit. c) GDPR) and carrying out tasks of public interest by the Health Authorities (art. 6, par. 1, lit. e) GDPR, in conjunction with national law of industry).

Administrative, accounting and tax requirements

• Invoicing, accounting records, tax and civilian requirements related to the organization and participation in ECM courses.
• Legal basis: fulfilment of legal obligations to which the Data Controller is subject (art. 6, par. 1, lit. c) GDPR).

Management of any disputes and protection of the rights of the Owner

• management of complaints, disputes, judicial or extrajudicial litigation; prevention and contrast of any unlawful conduct.
• Legal basis: legitimate interest of the Data Controller to protect its rights (art. 6, par. 1, letter f) GDPR).

Sending communications related to ECM courses similar to those already attended ("soft marketing")

• by email of information about ECM courses organized by the Owner and considered of possible interest according to those already attended, except your opposition.
• Legal basis: legitimate interest of the Data Controller (art. 6, par. 1, lit. f) GDPR), in compliance with the legislation on electronic communications, without prejudice to your right to object at any time.

Sending promotional communications on courses and initiatives other than those already attended (if required)

• sending newsletters and promotional communications on further training courses and initiatives.
• Legal basis: Your explicit consent (art. 6, par. 1, lit. a) GDPR), provided, for example, through a specific checkbox.

Failure to provide the data necessary for the purposes referred to in points 1, 2 and 3 implies the impossibility to manage your registration to the ECM courses and to attribute the relative credits. Failure to provide data or consent for the marketing purposes referred to in points 5 and 6 shall in no way prejudice your participation in the courses.

5. PROCESSING MODE

Data processing takes place:

• with paper and computer/thematic tools;
• in compliance with the principles of lawfulness, fairness, transparency, minimization, accuracy, limitation of preservation, integrity and confidentiality;
• through technical and organizational measures to ensure data security and prevent loss, unlawful use or unauthorized access.

Data is recorded and stored on computer systems and, if necessary, on cloud servers managed by appointed providers responsible for processing.

6. DESTINATARIES OF DESTINATARIES OF DATA

For the purposes listed above, your data may be communicated to:

• Ministry of Health, Lombardy Region and other relevant ECM entities for the accreditation of events and the management/attribution of ECM credits.
• Accrediting entities, supervisory bodies and competent authorities for checks and checks related to the ECM system or other regulatory obligations.
• Companies that provide IT services and platform management providers for registration, attendance management, online course delivery (FAD, webinar), hosting and cloud services, system maintenance, appointed processors pursuant to Article 28 GDPR.
• Consultants and professionals, administrative, tax, legal advisers, within the limits necessary for the execution of the relevant assignments, also appointed, where required, processors.
• Authorities and public entities subject to which the communication is due by law, regulation or Community legislation, or on a reasoned request by the Authorities.

The above subjects process the data, depending on the case, as independent owners or processors duly appointed by the Data Controller.

7. TRANSFER OF DATA REAL THIRD COUNTRIES

Generally speaking, your data is not transferred to countries located outside the European Union or the European Economic Area.

If, for technical requirements (for example, use of cloud service providers or platforms with extra EU servers), a transfer to third countries would be required, this transfer will be in compliance with Articles 44 and below GDPR, based on:

• decisions of adequacy of the European Commission;
• or standard contractual clauses adopted by the European Commission;
• or other adequate guarantees provided for by law.

In such cases, the Data Controller will take all appropriate measures to ensure an adequate level of data protection.

8. PERIOD OF CONSERVATION OF DATA

Personal data will be kept for the time strictly necessary to achieve the purposes for which they were collected and, in particular:

• Registration and participation in ECM courses: for the duration of the course and, subsequently, for the time necessary to demonstrate the correct performance of the performance and the fulfillment of the related obligations (indicatively up to 10 years from the conclusion of the course, unless different terms provided by the ECM norms or by provisions of the Authorities).
• ECM and communications to Ministry/Region: for the period required by the applicable legislation and/or the provisions of the competent Authorities, in compliance with the terms of law and the rules of accreditation.
• Administrative, accounting and tax requirements: for the terms provided for by civil and tax law (currently up to 10 years).
• Management of any disputes: for the time necessary to protect the rights of the Data Controller, in accordance with the applicable prescription terms.
• Marketing and sending of communications on ECM courses: until the withdrawal of consent or exercise of the right of opposition and, in any case, no later than 24 months from the last useful interaction.

For purposes of sending notices on other ECM courses, up to your opposition or revocation of consent and not more than 24 months from the last useful interaction. Expired of the above retention terms, the data will be deleted, anonymized or preserved only if and to the extent strictly necessary for further legitimate purposes (e.g. legal obligations, ongoing litigation).

9. NATURE OF THE CONFERENCE OF DATA

The provision of data marked as mandatory in the registration forms is necessary for:

• manage your request for participation in ECM courses;
• comply with ECM obligations and related legal obligations;
• attribute and record the accrued ECM credits.

In the absence of the provision of such data, it will not be possible to proceed with the registration and participation in the courses, nor to attribute the relative ECM credits.

• The provision of data and/or consent for marketing purposes (submission of newsletters and promotional communications on other ECM courses) is optional: failure to provide does not affect your participation in courses.

10. INTERESTED RIGHTS

As an interested party, you have the right to:

• Access: obtain confirmation that a processing of personal data concerning you or not is in progress and, in this case, access the data and receive copies thereof.
• Correction: obtain correction of inaccurate data and integration of incomplete data.
• Cancellation: obtain the deletion of personal data concerning you in the cases provided by the legislation.
• Limitation of treatment: obtain the restriction of processing in cases provided for in art. 18 GDPR.
• Data portability: receive data in structured format.
  Opposition: object to processing based on legitimate interest.
• Revocation of consent: revoke the consent provided at any time without prejudice to the lawfulness of the processing based on the consent before revocation.

  To exercise your rights you may send a written request to: privacy@studio-congressi.com or to the other addresses indicated in paragraph 1.

  11. RIGHT OF RECLAMO TO CONTROL AUTHORITY

  If you feel that the processing of your personal data infringes the legislation, you have the right to lodge a complaint with the Guarantee for the protection of personal data (www.garanteprivacy.it).

  12. AUTOMATIC AND PROFILATION DECISIONS

  I Your data is not subject to automated decision-making or profiling in a strict sense.
  Any analysis of training preferences are carried out in compliance with your rights.

  13.

  For all that is not provided for in this form, please refer to the relevant rules.

  Studio Congressi Srl