Privacy Policy

PRIVACY POLICY

Your privacy matters. The CBPT Research Center respects your privacy and is committed to protecting your personal information. We wish to inform you about our policy (or privacy notice) regarding the information we will collect and how we will use it, offering you choices about how your information or data is collected and used. By visiting and using our website ( cbpt.org ) and otherwise providing your data to the CBPT Research Center, you accept the terms of this privacy notice. This privacy notice will be updated periodically, so be sure to review it from time to time. If you do not accept the terms of this privacy statement, please do not use the website, do not provide us with any information, and do not act in accordance with what is described in this privacy statement.

Authorized Users. The website is not directed to, nor intended for, access and use by persons under the age of 18. We do not knowingly collect or use personal information from users we believe to be under the age of 18.

Data controller and purposes of processing. The CBPT Research Center is the data controller for the processing of the user’s personal data. The purposes for which the CBPT Research Center collects and processes your information and data include (by way of example and not exhaustively):

– Maintaining your CBPT membership relationship and providing you with the benefits of CBPT membership

– Being able to contact you by e-mail, mail, and telephone

– Keeping you informed about CBPT-related activities

– Inviting you to events organized by the CBPT Research Center

– Sending you newsletters

We will collect and process your personal data only where we have a legal basis for doing so. The legal basis for the processing is the performance of the membership relationship you have established, as well as the consent you have given by providing your information as described in this privacy statement.

Categories of data processed, purpose and nature of the processing, legal basis, and consequences of refusal

Browsing the Website

The computer systems and software procedures used to operate this Website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. It follows that any theoretical refusal to provide such data would make it impossible to browse the Website.

This category of data includes the IP addresses or domain names of the computers and terminals used by users, the URI/URL (Uniform Resource Identifier/Locator) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response provided by the server (successful outcome, error, etc.), and other parameters relating to the user’s operating system and computing environment.

This data, necessary for the use of the web services, is also processed for the purpose of:

1. obtaining statistical information on the use of the services (most visited pages, number of visitors by time slot or day, geographic areas of origin, etc.);
2. verifying the correct functioning of the services offered.

Browsing data is deleted immediately after aggregation (except for any need to investigate offenses on the part of the judicial authority).

The legal basis for the processing of your data for this purpose is the performance of your request, pursuant to Article 6(1)(b) of the GDPR, to be considered implicit by virtue of mere access to the Website; therefore, your consent is not required to authorize the processing.

Identification Data

The website contains various sections through which data subjects can provide their personal data to the CBPT Research Center, or the contact details to be used to communicate with the Organization in order to request information, as well as to submit their application, enroll in courses, register on the platform dedicated to training, register on the platform dedicated to distance learning (FAD), and to access all services offered online by the CBPT Research Center

In this case, the subject matter of the processing is the user’s identifying personal data (e.g., first name, last name, contact details, etc.) communicated through forms and guided fields, as well as – for those who send their Curriculum Vitae – information on the education, experience, and cultural and professional interests of candidates for open positions, as well as any other information sent in free format by the data subject through the various communication channels of the CBPT Research Center.

The legal basis for the processing of the data subject’s data is the performance of their request, pursuant to Article 6(1)(b) of the GDPR, to be considered implicit by virtue of mere access to the forms present on the Website; therefore, your consent is not required to authorize the processing.

The data subject’s data may also be processed for the purpose of sending material related to the Center’s training offerings (Courses, Events, our publications, etc.); the legal basis that legitimizes the resulting processing is the data subject’s consent, which they are free to give or not, and which they may in any case withdraw at any time.

Personal data received through the website will be retained for the time necessary to achieve the purposes of the processing.

With reference to personal data processed for the purpose of informing about and promoting the services of the CBPT Research Center, such data will be retained in compliance with the principle of proportionality and, in any case, until the purposes of the processing have been achieved or until the specific consent is withdrawn by the data subject.

No automated decision-making processes are applied and no profiling of data subjects is carried out; the data controller merely reviews, in an analytical manner, the interests expressed by users in order to generate targeted advertising campaigns and newsletters that meet the needs of those who have given consent to receive promotional material, without involving them in mass mailings that are not relevant to the information requested.

For the processing of identifying personal data required for the use of the services available in connection with this website (e.g., E-Learning platform, registration platform), please refer to the specific notice.

Cookies and other tracking systems

Cookies are not used for user profiling, nor are other tracking methods employed. For more information, please refer to the cookie policy.

How your personal data will be processed

The processing of your personal data will take place, in compliance with the provisions of the GDPR, by means of IT and telematic tools, for the purposes indicated and, in any case, using methods suitable to guarantee its security and confidentiality in accordance with the provisions of Article 32 of the GDPR.

To which parties your personal data may be disclosed and who may become aware of it

For the pursuit of the purposes described above, your personal data will be disclosed to employees, external consultants, and collaborators of the data controller who will act as persons authorized to process personal data, specifically designated as data processing agents.

Furthermore, for the pursuit of the aforementioned purposes, your personal data may be processed by the following third parties:

1. providers of services for the management of information systems;
2. providers of technical support services;
3. other service providers.

The parties belonging to the categories listed above will act, in some cases, as autonomous data controllers, and in other cases, as data processing agents specifically designated by the data controller pursuant to Article 28 of the GDPR. In any case, the disclosure of your data to the aforementioned third parties is based on the prevailing legitimate interest of the data controller, since it is necessary for the pursuit of the aforementioned purposes.

At any time, you may request the list of data processors by contacting the data controller.

Your personal data will not be disclosed to the public.

Furthermore, the data controller does not intend to carry out any transfer of your personal data to non-European countries.

How you can exercise your rights

The rights mentioned above may be exercised by contacting the data controller at the addresses indicated above. The exercise of your rights as a data subject is free of charge pursuant to Article 12 of the GDPR. However, in the case of manifestly unfounded or excessive requests, including due to their repetitive nature, the data controller may charge you a reasonable fee, in light of the administrative costs incurred in handling your request, or may refuse to comply with your request.

Finally, we inform you that the data controller may request further information necessary to confirm the identity of the data subject.

Your choice. It is up to you to decide whether to participate in any of the activities from which we obtain your information. If you choose to participate, any personal information we collect about you will be handled in accordance with this privacy notice. Where we rely on your consent to the processing of personal data, you have the right to withdraw or refuse your consent at any time, and where we rely on other legal bases, you have the right to object in accordance with this privacy statement.

Sources of information

Personal information provided by the user. We do not use our website to collect personally identifiable information about you other than that voluntarily provided for various purposes. We receive information about you from our interactions with you, including when you request registration or request to become a Professional trained in CBPT. Depending on the information you provide us, the information we receive may include your name, education and documents and other credentials, billing and/or shipping address, telephone number, date of birth, form of payment, and e-mail address. If you pay by check or use a credit or debit card, the information received will include your account number. If you choose not to provide any personal information about yourself, you may not be able to participate in certain programs or activities and we may not be able to fulfill any request you make. If you provide personal information, you undertake to provide truthful and accurate information in connection with your registration and to promptly inform us of any changes to your registration data.

Security of your transactions

Policies and procedures. We follow generally accepted standards to ensure that the information you share with us is handled securely and responsibly. We maintain and monitor our physical, electronic, and procedural systems to achieve this goal and to comply with all applicable laws and regulations. While we strive to ensure the integrity and security of our network and systems, we cannot guarantee that our security measures will prevent third-party “hackers” from unlawfully obtaining this information. We are not responsible for any breach of your security or for the actions of third parties who may obtain personal information. It is prohibited to breach or attempt to breach security or otherwise interfere with the operation of the website. We expressly make no representations and disclaim any representation or warranty, express or implied, regarding the security or integrity of the website and your personal information.

Information shared with others

Registration information. We make membership information available to CBPT locations, the public, and our members through our paper and online membership directories. If you do not want your membership information to be displayed, log in and change your display preferences, or contact us.

Except as described in this privacy statement, we do not disclose personal information to third parties, except (1) for the purpose of communicating with you when necessary to complete transactions you have authorized, including, by way of example and not exhaustively, providing such information to data processors or postal services, (2) when employees, agents, and contractors need to administer or manage the website or fix a technical problem; (3) when it is necessary to verify the existence or status of your account with a financial institution, a credit institution, or other third parties; (4) with our affiliates; or (5) if we combine or transfer the organization’s assets to another organization.

Notice on the processing of personal data
Information document pursuant to and for the purposes of Article 13, Regulation (EU) 2016/679

With this document (the “Notice”), the data controller, as defined below, wishes to inform you about the purposes and methods of processing your personal data while browsing the website cbpt.org and about the rights that European Regulation 2016/679 (GDPR), on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”), grants them.

This Notice concerns exclusively the processing of personal data carried out through the website cbpt.org

1. Data Controller
   CBPT Research Center
   Registered office: Piazza Antonio Mancini, 4- 00196 Roma
   Operating office: Piazza Antonio Mancini, 4- 00196 Roma

2. Subject Matter of the Processing

The subject matter of the processing is:

• Identifying personal data such as personal details, tax code, identity documents, contact details, CV, certificates of training completed if requested, etc.;
• Tax and banking personal data necessary for accounting records and for the execution of payments

3. Purpose and Legal Basis of the Processing

The collection and processing of personal data are carried out:

• For purposes connected and instrumental to the service provided. This necessity constitutes the legal basis that legitimizes the resulting processing. The provision of the data necessary for these purposes is a necessary requirement for the provision of the service in question.
• For administrative or accounting purposes. This necessity constitutes the legal basis that legitimizes the resulting processing. The provision of data is necessary for the economic and administrative performance of the service relationship (where applicable).
• To comply with legal obligations and the provisions of Authorities and Supervisory Bodies or administrative practices. This necessity constitutes the legal basis that legitimizes the resulting processing. The provision of the data necessary for these purposes constitutes a legal obligation.
• To exercise the rights of the data controller, for example the right of defense in legal proceedings. This necessity constitutes the legal basis that legitimizes the resulting processing. The provision of the data necessary for these purposes constitutes a legal obligation.
• In order to send material related to the training offerings (Courses, Events, our publications, etc.). The legal basis that legitimizes the resulting processing is the consent of the data subject, who is free to give it or not, and who may, however, withdraw it at any time.

The data processed will be processed in accordance with the principles of fairness, lawfulness, transparency, and protection of the confidentiality and rights of participants. The personal data provided will be processed for the entire duration of the event, from the organization of the event to the verification of participation with any related feedback, and also subsequently, for the fulfillment of all legal obligations.

4. Method of Processing
   The processing of personal data consists of the collection, recording, organization, storage, consultation, elaboration, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure, and destruction of data. The processing of data for the purposes set out above takes place both by automated, electronic, or magnetic means and by non-automated, paper-based means, in compliance with the confidentiality and security rules provided for by law, the consequent regulations, and internal provisions.

5. Place of Processing
   The data are currently processed and stored at the data controller’s operating office. They are also processed, on behalf of the data controller, by professionals and/or companies engaged to carry out technical, consulting, development, management, and administrative-accounting activities.
6. Recipients or Categories of Recipients of the Data
   For the pursuit of the purposes indicated, the data subject’s data may be accessed by natural and legal persons designated as data processors and by natural persons authorized to process the data necessary for carrying out the tasks assigned to them: – employees and collaborators of the data controller, in their capacity as authorized persons and/or internal data processing agents, with particular reference to the managers and staff responsible for personnel management and administration functions, and/or technical collaborators and network/systems administrators; – third-party companies or other parties (for example, companies providing professional services, consultants, insurance companies providing insurance services, accountants, etc.) that carry out outsourcing activities on behalf of the data controller, in their capacity as external data processors.

The data controller may disclose participants’ data to third parties, such as, for example, those belonging to the following parties or categories of parties: Supervisory Bodies, Judicial Authorities, as well as those parties to whom disclosure is mandatory by law for the performance of the purposes indicated above.
Such parties will process the data in their capacity as autonomous data controllers.
Participants’ data will not be disclosed by the data controller.

7. Data Retention Period

The data provided for accounting and administrative activities (where applicable) will be kept in the controller’s archives for a period of 10 years, as established by law under the provisions of Article 2220 of the Italian Civil Code, without prejudice to any deferred payment of fees that may justify an extension. With reference to personal data processed for the purpose of informing about and promoting the services of the CBPT Research Center, such data will be retained in compliance with the principle of proportionality and, in any case, until the purposes of the processing have been achieved or until the specific consent is withdrawn by the data subject.

8. Transfer of Data Abroad

The data controller hereby declares that it does not transfer data to third countries or international organizations unrelated to the agreed activities.

9. Automated Decision-Making Processes

No automated decision-making processes are applied.

10. Rights of the Data Subject

Pursuant to Articles 15 to 22 of European Regulation 2016/679 (GDPR), the data subject is informed that:

1. they have the right to ask the CBPT Research Center, as data controller, for access to their personal data, its rectification or erasure, or the restriction of its processing, or to object to its processing, in the cases provided for;
2. they have the right to receive their personal data provided to the CBPT Research Center and processed by it on the basis of consent or another legal basis, in a structured, commonly used, and machine-readable format, as well as the right to transmit such data to another data controller without hindrance;
3. they have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them;
4. they have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), following the procedures and instructions published on the Authority’s official website at garanteprivacy.it;
5. any rectifications, erasures, or restrictions of processing carried out at the request of the data subject – unless this proves impossible or involves disproportionate effort – will be communicated by the CBPT Research Center to each of the recipients to whom the personal data have been transmitted. The CBPT Research Center may inform the data subject of such recipients if the data subject so requests.

The exercise of these rights is not subject to any formal requirement and is free of charge.

11. How to Exercise the Data Subject’s Rights

To exercise the rights provided for by European Regulation 2016/679 (GDPR), listed above, the data subject may send a written request by registered letter with return receipt to:

CBPT RESEARCH CENTER

Piazza Antonio Mancini 4 – 00196 Roma