information notice on the processing of personal data

fondazione marionanni ets (hereinafter also referred to as the “foundation”) respects your privacy and undertakes to process personal data with the utmost care and in compliance with the applicable provisions on the matter, including Regulation (EU) 2016/679 (“GDPR”) and italian legislative decree 196/2003, as also updated pursuant to legislative decree 101/2018.

the purpose of this notice is therefore to inform you, with the greatest transparency, about the processing of personal data carried out by the foundation through the websites www.fondazionemarionanni.org / www.fondazionemarionannischole.it and www.marionannischole.com (hereinafter also referred to as the “websites”).

it is important to us to explain how we collect, use and store your personal data in the context of the relationship established between you and the foundation, even simply through your interaction with the websites. for this very reason, we invite you to read this notice carefully before submitting any kind of personal data to the foundation through the websites.

personal data means any information that makes it possible to identify a person, including indirectly (for example by combining it with other information). personal data are, for example, the email address, the first name and surname, the language spoken, etc.

the forms available on the websites may only be filled in by adults. should you be interested in receiving information on behalf of a minor, we therefore invite you to enter your own personal data and not those of the minor.

data controller

the controller of the personal data you may provide us with is fondazione marionanni ets, with registered office in bologna, via santo stefano n. 94, which can be reached at the following contact details:

telephone: +39 3392042568
email address: amministrazione@fondazionemarionanni.org

types of personal data processed

when you browse, interact, fill in the forms available on the websites or contact the foundation, the latter processes the following types of personal data:

1. the data you provide to the foundation by contacting it at the contact details given in the “contacts” section of the websites www.fondazionemarionanni.org / www.fondazionemarionannischole.it, such as, for example, first name, surname, email address and possibly your telephone number;
2. the data you provide to the foundation when you fill in the forms available on the website www.marionannischole.com concerning requests for information about the educational programmes offered by the foundation, including in the context of registration for “open days” organised by the foundation to present its study paths, such as, depending on the case, first name, surname, email address, telephone number, programme of interest and language spoken;
3. the data required to register for events, online and/or in person, promoted by the foundation, as well as, in the case of events accredited by professional associations, the data necessary to obtain the related credits, should you wish to receive them;
4. subject to your consent, your postal address (street/square, street number, postcode, town/city and country) in order to receive fattidiluce, the foundation’s journal, which is available in printed format only;
5. subject to your consent, your email address for subscription to the foundation’s newsletter service and, more generally, for carrying out marketing activities;
6. browsing data which, although constituting information that is not collected in order to be associated with identified data subjects, by its very nature could, through processing and association with personal data held by third parties, make it possible to identify users and reveal information about their interactions with the websites. these are, in particular, the data collected automatically while browsing the websites and necessary for their operation. in this regard, we point out that, in order to speed up the loading of the relevant pages, the websites use the content delivery network (CDN) “jsDelivr”, a tool that entails the transfer of the user’s IP address to the servers of the provider of that tool. here you can find the information notice on the processing of personal data of the provider of the “jsDelivr” tool Volentio JSD Limited, which processes your personal data as an independent controller.

purposes and optional or mandatory nature of the processing

the foundation processes your personal data for the following purposes:

1. to respond to expressions of interest submitted by contacting the foundation at the contact details given in the “contacts” section and/or through the forms available on the websites concerning requests for information about the educational programmes offered by the foundation and/or registration for “open days” organised by the foundation;
2. to organise and ensure the proper running of the events promoted by the foundation, as well as to handle the formalities needed to allow professional associations to recognise any training credits provided for participation in such events;
3. to comply with legal obligations and to protect its own rights;
4. to allow you to browse the websites and for IT security purposes.

providing your data for all the above purposes is not mandatory, but refusing to provide it makes it impossible for the foundation to act on your requests;

5. subject to your consent, to send you fattidiluce, the foundation’s journal;
6. subject to your consent, to promote its own activity and increase its visibility, for example to keep you informed about new initiatives and about the projects started by the foundation, to invite you to events and to share content concerning the foundation with you;

providing the personal data that the foundation may process for the above purposes is optional and, in the absence of your explicit consent to such processing, the foundation will not be able to send you promotional communications and/or fattidiluce, the foundation’s journal.

legal basis of the processing

the foundation processes your personal data on the basis of the following conditions of lawfulness:

1. the performance of pre-contractual measures in relation to what is necessary to provide you, following your expressions of interest, with information about the foundation’s educational activity, and the performance of a contract to which the data subject is party in relation to the organisation and running of the events promoted by the foundation, pursuant to art. 6, letter b), of the GDPR;
2. compliance with legal obligations by the foundation pursuant to art. 6, letter c), of the GDPR;
3. the pursuit of legitimate interests of the foundation, pursuant to art. 6, letter f), of the GDPR, consisting in the defence of its own rights and in the use of the websites and, more generally, of IT tools to promote its own activity;
4. the consent you may have given to the processing of your personal data by the foundation for sending fattidiluce, the foundation’s journal, and for marketing purposes pursuant to art. 6, letter a), of the GDPR.

the foundation processes your personal data for sending fattidiluce and for marketing purposes solely upon your release of specific consent to carrying out such processing activity. the consent you give is optional and may be withdrawn at any time (in the manner set out in the “withdrawal of consent” section of this notice). in the absence of your consent, the foundation will not carry out any processing of your personal data for the above purposes.

parties who have access to personal data

the foundation limits access to personal data as far as possible, making it available to its own duly authorised staff who have reason to access it in order to carry out their professional duties.

your personal data may also be made available to the service providers used by the foundation in carrying out its activity.

such parties process personal data as data processors, in accordance with the instructions given to them by the foundation.

the foundation provides such parties only with the data necessary to perform the services agreed with each of them.

the service providers in question belong to the following categories:

• companies, consultants and IT service providers;
• communication agencies.

should you wish to receive the credits arising from participation in events promoted by the foundation and accredited by professional associations, the data necessary to obtain them will be transmitted to your professional association of reference, which will process such data as an independent controller.

the foundation may also disclose personal data in order to comply with any requests from the Authorities and/or to protect its own rights in litigation.

processing methods and scope of circulation of personal data

the foundation processes personal data in paper form and with the aid of electronic tools, within the limits of the purposes set out in this notice and adopting measures aimed at maintaining the confidentiality and secrecy of personal data.

the foundation pays great attention to the protection and confidentiality of personal data and, also for this reason, does not carry out any dissemination and/or commercialisation of personal data.

in some cases your personal data may be transferred outside the territory of the European Union. such transfer takes place ensuring adequate levels of protection of your personal data, also in accordance with the provisions of articles 45 and 46 of the GDPR.

in particular, transfers of data outside the European Union take place to countries that offer an adequate level of protection of personal data, as established by specific decisions of the European Commission.

the lawfulness of the transfer of personal data to the United States is also guaranteed by the adherence to the EU-US Data Privacy Framework by the service providers used by the foundation. you can find further information on the Data Privacy Framework (the agreement governing the transfer of personal data between the European Union and the USA) by consulting the following links:

• www.garanteprivacy.it/temi/trasferimento-di-dati-all-estero
• www.dataprivacyframework.gov/Program-Overview

in the other cases, transfers of personal data outside the European Union take place against the provision of adequate safeguards for the protection of your personal data by the foundation’s suppliers or sub-suppliers that receive them. such parties have in fact signed the standard contractual clauses for the protection of personal data adopted by the European Commission.

retention period of personal data

your personal data are retained by the foundation for a limited period of time, necessary to pursue the purposes of each processing operation indicated above. at the end of such period your data will be deleted or anonymised.

the personal data processed in relation to the organisation and running of the events promoted by the foundation will be processed for the time strictly necessary to fulfil that purpose and for the recognition, by professional associations, of any training credits provided for participation in such events, and in any case for a period not exceeding 12 months from the end of each event.

the personal data processed for the performance of pre-contractual measures will be retained for the time strictly necessary to respond to your expressions of interest and then deleted. the personal data processed on that legal basis will in any case be deleted once 2 years have elapsed from the last contact.

the foundation’s journal fattidiluce will be sent until you possibly withdraw your consent to receiving it, or following the possible discontinuation of its publication by the foundation.

within 24 months from the collection of the personal data processed for sending the foundation’s newsletter and, more generally, for carrying out marketing activities, the foundation will endeavour to obtain a new consent in order to continue such activities, failing which such personal data will be deleted.

withdrawal of consent

at any time you may object to the processing of your personal data by the foundation for sending fattidiluce, the foundation’s journal, newsletters and/or, more generally, for carrying out marketing activities by sending an email to the address amministrazione@fondazionemarionanni.org.

you may also withdraw your consent to the sending of newsletters and, more generally, to the carrying out of marketing activities by following the instructions given at the bottom of the newsletters or promotional communications you receive from the foundation.

once we have received your request, we will make sure to promptly cease the processing of your personal data based on the consent you have withdrawn. processing operations that are different or based on conditions of lawfulness other than consent will continue to be carried out as provided for in this notice and in full compliance with the provisions in force.

the withdrawal of consent to the processing of your personal data for sending fattidiluce and for marketing purposes does not affect the lawfulness of the processing carried out by the foundation based on the consent given before the withdrawal.

your rights

at any time you may contact the foundation, writing an email to the address amministrazione@fondazionemarionanni.org, to receive the list of the data processors (that is, of the foundation’s service providers that carry out processing operations on personal data on the basis of the instructions given to them by the foundation).

also by writing an email to the address amministrazione@fondazionemarionanni.org you may ask to exercise the rights provided for by the legislation on the protection of the confidentiality of personal data (as set out in articles 15 to 22 of the GDPR), including those to:

1. obtain confirmation as to whether or not processing of your personal data is taking place, to have access to your data processed by the foundation, to know the purpose of the processing, the categories of personal data processed and the recipients or categories of recipients to whom your personal data have been or will be disclosed. you also have the right to know the retention period of your personal data or, if that is not possible, the criteria used to determine such period;
2. verify the accuracy of your personal data and their origin, request the integration, updating, rectification, erasure or anonymisation of your personal data, as well as the restriction of their processing, or object to their processing (in the cases provided for by articles 17 and 18 of the GDPR);
3. lodge a complaint with the Supervisory Authority (the authority with jurisdiction for italy is the Garante per la protezione dei dati personali, the italian data protection authority);
4. in the event of transfer of your data to a third country, be informed of the existence of adequate safeguards pursuant to article 46 of the GDPR relating to the transfer;
5. object, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of a legitimate interest of the foundation, provided that there are no overriding grounds for the foundation to proceed with the processing in any case (for example, the need to protect its own rights in litigation);
6. exercise the right to the portability of your personal data.

once your request has been received, the foundation will handle it with the utmost promptness and seriousness in order to facilitate the exercise of your rights, providing you with a reply without delay and in any case within one month of receipt of the request. only in cases of particular complexity may the deadline for replying to your request be extended up to two months from its receipt; in that case the foundation will keep you informed about the status of the process of handling your request.

(last updated 05.08.2026)