INFORMATION ON THE PROCESSING OF PERSONAL DATA
PROMOTIONAL ACTIVITIES
Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
Dermacademy Institute srl (hereinafter referred to as the Institute), acting as Data Controller with registered office in Pisa, Via Darsena 2, hereby provides information regarding the methods of processing personal data for activities related to the dissemination and promotion of its Services (marketing).
These activities, carried out in particular through newsletters and digital communications containing promotional information or invitations to events and initiatives, involve the processing of the identifying personal data of individuals who have requested to receive such information via email, including by Dermaveris Institute, which carries out certain processing activities jointly with Dermacademy.
DATA PROTECTION OFFICER
The Institute has appointed a Data Protection Officer, who can be contacted at the following email address: dermacademy.dpo@gmail.com.
PURPOSE OF PROCESSING AND LEGAL BASIS
The purpose of the processing is to advertise and promote, including through the sending of advertising, informational, and promotional materials, the services offered by Dermacademy S.r.l.
The legal basis for the processing of personal data is found, pursuant to Article 9(2)(a) of the GDPR, in the consent provided by the data subjects, and pursuant to Article 6(f) of the GDPR.
SOURCE OF PERSONAL DATA
The personal data processed by the Institute are provided either directly by the data subjects themselves or by their legal representatives.
METHODS OF PROCESSING
The processing of personal data is carried out electronically, in compliance with professional secrecy and confidentiality obligations, by specifically authorized individuals pursuant to Articles 28 and 29 of the GDPR and Article 2-quaterdecies of Legislative Decree no. 196/03, following the adoption of appropriate security measures pursuant to Article 32 of the GDPR and in accordance with the principles of lawfulness, purpose limitation, and data minimization.
RECIPIENTS OR CATEGORIES OF RECIPIENTS TO WHOM PERSONAL DATA MAY BE DISCLOSED
Dermacademy S.r.l. will communicate the data processed for marketing purposes to Dermaveris, which will process them under a joint controllership arrangement. The Data Controller may not disclose the data to other parties unless required by law.
RETENTION PERIOD OF PERSONAL DATA OR CRITERIA USED TO DETERMINE SUCH PERIOD
Dermacademy S.r.l., pursuant to Article 5 of the GDPR, retains personal data for a period of 1 year from the date consent is obtained (or alternatively until December 31 of the year following the acquisition of consent). Before this deadline, the Institute will request renewed consent; if consent is not renewed, the personal data will be deleted.
TRANSFER OF PERSONAL DATA
The personal data processed are not transferred outside the European Union or the European Economic Area. It is understood that, if necessary, the Institute may relocate its servers outside the EU, ensuring from now on that any transfer of data outside the EU will take place in compliance with applicable legal provisions and after entering into the standard contractual clauses provided by the European Commission.
DATA SUBJECT RIGHTS AND HOW TO EXERCISE THEM
Data subjects may exercise the rights set out in Articles 15 to 22 of the GDPR, including the right to obtain access to personal data, rectification of inaccurate data, completion of incomplete data, and, where provided by law, restriction, deletion, or objection to processing, by submitting a specific request to the Data Controller indicated above or by email to dottgiovannimenchini@dermacademy.it or the Data Protection Officer at dermacademy.dpo@gmail.com.
If the data subject believes that their data are being processed in a manner that does not comply with current legislation, they may file a complaint with the Data Protection Authority or seek judicial remedy before the competent authority.
THE DATA CONTROLLER
General Information Notice on Data Processing
Information Notice for Diagnosis and Treatment (Healthcare Services)
Information Notice Regarding Joint Data Processing Activities
Data Subject Rights Request Form
Last updated on 21-May-2025
Effective date: 12-Nov-2024
