BOOK AN APPOINTMENT

World International School S.p.a. a socio unico (hereinafter WINS or the Data Controller) provides the following information pursuant to Article 13 of EU Regulation no. 2016/679 of April 27, 2016 (hereinafter GDPR), to describe the characteristics of the processing carried out in relation to your personal data and those of your family members and the measures adopted to protect their rights.

Data Controller

The Data Controller is World International School S.p.a. a socio unico (VAT number 09284580967) with registered office at Via Michelangelo Buonarroti no. 39, 20145 Milan – Contacts: Tel. +39 011 1972111 | Fax +39 011 1972150 | E-mail: info@worldinternationalschool.com

Data Protection Officer

WINS has appointed a Data Protection Officer who you can contact if you have any questions or doubts about the characteristics and methods of processing. The DPO can be reached at the following addresses: dpowins@worldinternationalschool.com; dpo_wins@pec.it.

Data subject to processing

WINS essentially collects the following personal data:

• Applicant’s personal data
• Applicant’s contact details
• Data relating to the student and their education

Purpose of processing

Personal data will be processed for the following purposes:

• Organize the meeting at the school

Retention period

The personal data collected for the purpose (a) will be retained for a period not exceeding five years.

Why the processing we carry out is lawful

The processing is lawful because it is based on the following legal grounds:

• Respond to a request from the Data Subject (pre-contractual measure)

Methods of processing personal data and storage location

Personal data is processed both in paper and electronic form (e.g., servers, cloud databases, application software).

Personal data may be processed by external Data Processors who may transfer the data to non-EU countries (USA) and who provide adequate data protection guarantees pursuant to Article 46 of the GDPR. These guarantees are represented by the use of standard contractual clauses approved by the European Commission. In any case, it should be noted that the European Commission, in July 2023, issued a new declaration recognizing the adequacy of the protections guaranteed by US legislation and corresponding to the level of protection offered by the GDPR.

Optional or mandatory nature of the data provided

The provision of data is mandatory and failure to provide it will prevent WINS from managing the meeting request.

Categories of subjects to whom personal data may be communicated

The processing of the personal data provided to us may be carried out, in compliance with the principle of strict necessity of processing:

• By WINS employees, who act and process the data under the authority and instructions of the Data Controller, pursuant to Article 29 of the GDPR or by employees designated by the Data Controller, pursuant to Article 2 quaterdecies of Legislative Decree no. 101/2018.
• By natural or legal persons whose ability to access personal data is recognized by legal provisions provided by European Union law or Italian law, such as, by way of example, competent authorities and/or supervisory bodies for the fulfillment of legal obligations, and public administrations for their institutional purposes.
• By natural or legal persons used by the Data Controller for the performance of activities instrumental to the achievement of the purposes mentioned above (by way of example: IT and application service providers, security services) or to whom WINS is required to communicate the data, by virtue of legal or contractual obligations. External data processors will be subject to contractual and regulatory obligations to maintain data confidentiality and will only have access to the information necessary to perform their functions.

Data dissemination

The processed data will not be disseminated under any circumstances.

Rights of the Data Subject

In relation to the processing of personal data, pursuant to the GDPR, the Data Subject has the following rights:

• Right of access: has the right to obtain a copy of their personal data held by WINS and that are subject to processing.
• Right to rectification: has the right to rectify personal data held by WINS if they are not updated or correct.
• Right to withdraw consent: can also withdraw the consent given for a specific processing at any time.
• Right to contact the Data Protection Authority if they have doubts about the processing of personal data carried out by WINS.

The Data Subject can also exercise the following rights under certain circumstances:

• Right to erasure: can request that WINS delete personal data if the purposes of the processing have ceased and there are no legitimate interests or legal rules requiring its continuation.
• Right to object to processing: can request that WINS stop performing a specific processing of personal data. The right to object does not apply when the processing of data is carried out on a contractual basis.
• Right to data portability: has the right to obtain a copy of personal data in a commonly used structured format readable by an automatic device and has the right to obtain the direct transmission of personal data from one controller to another without hindrance.
• Right to restrict processing: has the right to request that WINS limit the processing operations on their personal data.

To exercise each of the afore mentioned rights, the Data Subject can send an email or write to the following address specifying the request and providing WINS with the information necessary for the correct identification of the sender (also attaching a copy of their identity document):

• via e-mail: info@worldinternationalschool.com
• via e-mail: World International School S.p.a. a socio unico, Via Michelangelo Buonarroti no. 39, 20145 Milan.

WINS will respond within one month. If for some reason WINS is unable to respond, they will provide a detailed explanation of why they cannot fulfill the request.

This information may be subject to changes or additions over time, so we invite you to periodically consult the Data Controller’s website –https://worldinternationalschool.com – to stay constantly updated.

Latest version: March 2025