The FMTS Group, a corporate group consisting of companies subject to the management and coordination activity of the parent company Formamentis S.p.A. Società Benefit pursuant to and for the purposes of Article 2359 of the Italian Civil Code (hereinafter, the “FMTS Group”), has for years considered the protection of the personal data of its current and/or potential clients and users to be of fundamental importance and intends to ensure that the processing of personal data – carried out by any means, whether automated or manual – takes place in full compliance with the safeguards and rights recognized by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, relating to the protection of natural persons with regard to the processing of personal data, as well as to the free movement of such data (hereinafter, the “Regulation”), and by the other applicable rules on the protection of personal data.
In particular, the FMTS Group, in pursuing all of its purposes, may become aware of or request Your Personal Data, such as, for example, first name and surname, e-mail address, telephone and postal contact details, Tax Code or VAT number, date of birth and other data that could make You identifiable.
This privacy notice, therefore, has been prepared on the basis of the principle of transparency in order to contain all the elements required by Articles 13 and 14 of the Regulation and is divided into individual sections, each of which addresses a specific topic, so as to make reading quicker, easier and more intuitive.

1) DATA CONTROLLERS

The companies of the FMTS Group that will process Your Personal Data independently or jointly, for one or more purposes as set out in this privacy notice, which is provided at the time of collection of the Personal Data, are the following:
• Formamentis S.p.A. Società Benefit, with registered office in Rome (RM), Via Barberini 67, 00187, VAT No. 04009110653;
• FMTS Experience S.r.l., with registered office in Pontecagnano Faiano (SA), Via L. da Vinci 15, 84098, VAT No. 04044560656;
• FMTS Formazione S.r.l., with registered office in Pontecagnano Faiano (SA), Via L. da Vinci 15, 84098, VAT No. 04927890659;
• FMTS Lavoro S.r.l., with registered office in Bari (BA), Via V. Aulisio 59, 70124, VAT No. 05731800651;
• Euformed S.r.l., with registered office in Tito (PZ), Contrada Serra SNC – hamlet of Tito Scalo, 85050, VAT No. 01904740766;
• Copi S.r.l., with registered office in Pontecagnano Faiano (SA), Via L. da Vinci 15, 84098, VAT No. 01306850593;
• Literalia Formazione S.r.l., with registered office in Formia (LT), Via O. Spaventola Snc, 04025, VAT No. 02568220590;
• Jobiz Formazione S.r.l., with registered office in Salerno (SA), Via San Leonardo Trav. Migliaro 120, 84016, VAT No. 03936340656;
• Viaggi Studio Italia S.r.l., with registered office in Pontecagnano Faiano (SA), Via L. da Vinci 15, 84098, VAT No. 04927890659;
• Consulman S.r.l., with registered office in Turin (TO), Corso Orbassano 336 – Torre C, VAT No. 06068820015;
• Consulservice S.r.l., with registered office in Turin (TO), Corso Orbassano 336, VAT No. 08077920018;
• QB Agency S.r.l., with registered office in Rome (RM), Via Degli Ausoni 1, VAT No. 16939111007;
• Eduwork Academy Abruzzo S.r.l., with registered office in Mozzagrogna (CH), Contrada Castel di Sette snc, VAT No. 02843200698;
• Mobility Hub Limited, with registered office at 56 Fitzwilliam Square N-Suite B02, Dublin 2, D02 X224, Ireland, VAT No. IE 3542734CH and National Registration Number 618106;
• T.E.E.P. Limited – Training Education and European Project, with registered office at 19 The Circle, Queen Elizabeth Street, London, UK, SE1 2JE, VAT No. GB 260983778 and National Registration Number 10036734;
• F.E.M. – Formation, Emploi, Mobilité Sàrl, with registered office at 21 RUE HAXO – 13001 Marseille, France, VAT No. FR73881121313 and National Registration Number 881121313;
• Formalta Further Education Institution Ltd, with registered office at NUOV MRO Frank Galea Street – 9019 ZBG, Zebbug, Malta, VAT No. MT24804902 and National Registration Number C79224;
• Motum European Project S.L., with registered office at Calle Salamanca, Num. 62, Bajo – 46005 València, Spain, VAT No. ESB40640807 and National Registration Number 3/18/M58TH70Z5;
• Euroglocal Belgio s.r.l., with registered office at Cours Saint Michel 30, 1040 Etterbeek, Belgium, VAT No. 0749441301 and National Registration Number 0749441301.
• Globtrain GmbH, with registered office at Naumannstraße 4, 10829 Berlin, Germany, VAT No. DE358130735 and National Registration Number HRB 248354 B.
The above-mentioned companies may independently assume the role of data controller according to the relevant definition contained in Article 4, point 7), of the Regulation, or may assume the role of external data processor pursuant to specific agreements under Article 28 of the Regulation.
The Data Controller may be contacted through the following channels:
• by writing to the FMTS Group Privacy Office at the parent company Formamentis S.p.A. Società Benefit, at Via L. Da Vinci 15, Pontecagnano Faiano (SA) – 84098;
• by sending an e-mail to the e-mail address privacy@fmtsgroup.it for the kind attention of the FMTS Group Privacy Office;
• by calling the telephone number +39 0828/370305 and asking for the FMTS Group Privacy Office.

2) PURPOSES OF THE PROCESSING AND THE RELEVANT LEGAL BASES

The data processed are those provided by the data subject upon signing pre-contractual and contractual documentation, during visits or telephone calls, during direct contacts for participation in events, meetings, conferences, etc., during meetings, or those entered through forms or requests for information sent by e-mail.
Each Data Controller may process Your Personal Data for the processing purposes set out below:
A) request for information:
the Data Controller, in order to follow up on Your request for information received by it through the means available on its website, needs to process certain of Your Personal Data, as requested in the relevant collection form and/or as spontaneously provided by You.
Data processed: name, surname, e-mail address, telephone number.
Legal basis and lawfulness of processing: pre-contractual legal basis pursuant to Article 6(b) of the Regulation – the Processing of Your Personal Data will be carried out by the Data Controller in order to respond to Your request for information and will be legally based on the pre-contractual relationship that will be created between You and the Data Controller.
B) access to company premises:
the Data Controller, in order to allow You to access the company premises of the FMTS Group, needs to collect certain of Your Personal Data, as requested by the staff in charge of identifying visitors and/or by the specific software “Welcome App”.
Data processed: name, surname, e-mail address.
Legal basis and lawfulness of the processing: legitimate interest pursuant to Article 6(c) and (f) of the Regulation – the Processing of Your Personal Data will be carried out by the Data Controller and will be legally based on the legitimate interest of the same in safeguarding and protecting its premises, its company assets and its employees and collaborators.
C) purchase of products and/or services:
the Data Controller, in order to allow you to purchase its products and/or services, needs to collect certain of your Personal Data, as requested in the subscription or purchase form.
Data processed: name, surname, address, telephone number, e-mail, bank details (credit card/PayPal).
Legal basis and lawfulness of processing: contractual legal basis pursuant to Article 6(b) of the Regulation – the Processing of Your Personal Data will be carried out by the Data Controller in order to allow You to receive what has been requested and purchased and will therefore be legally based on the contractual relationship that will be created between You and Data Controller;
D) browsing on website:
the Data Controller, in order to allow the use of its website, needs to collect certain of Your Personal Data.
Data processed: browsing data (IP addresses, the type of browser used, the operating system, the domain name and the addresses of websites from which access or exit was made, information on the pages visited within the site, the access time, the time spent on the individual page, session cookies and analytical cookies, internal path analysis and other parameters relating to the user’s operating system and IT environment);
Legal basis and lawfulness of processing: legitimate interest pursuant to Article 6(f) of the Regulation – the Processing of Your Personal Data will be legally based on the legitimate interest of the Data Controller; in relation to marketing and profiling cookies, the legal basis is the consent of the data subject pursuant to Article 6(a) of the Regulation – the Processing of Your Personal Data will be carried out by the Data Controller and will be legally based on Your free, express and unequivocal consent;
E) participation in events:
the Data Controller, in order to allow you to participate in the events organised by itself, needs to collect some of your Personal Data, as requested in the event registration form.
Data processed: name, surname, address, telephone number, e-mail address.
Legal basis and lawfulness of processing: contractual legal basis pursuant to Article 6(b) of the Regulation – the Processing of Your Personal Data will be carried out by the Data Controller in order to register You for the event and guarantee Your participation and, therefore, will be legally based on the contractual relationship that will be created;
F) participation in prize competitions, prize events or contests:
the Data Controller, in order to allow you to participate in a prize competition, prize event or contest organised by the same, needs to collect some of your Personal Data, as requested in the participation form.
Data processed: name, surname, email address, telephone number.
Legal basis and lawfulness of processing: contractual legal basis pursuant to Article 6(b) of the Regulation – the Processing of Your Personal Data will be carried out by the Data Controller in order to allow Your participation in the competition, prize event or contest and therefore will be legally based on the contractual relationship that will be created between You and the same as a result of Your acceptance of the rules of the initiative;
G) execution of contractual documentation:
the Data Controller, in order to carry out the contractual relationship between you and the Data Controller, as well as the related obligations, needs to collect and process some of your Personal Data as requested within the individual contractual document.
Data processed: personal data, telephone number, bank details, e-mail address.
Legal basis and lawfulness of processing: contractual legal basis pursuant to Article 6(b) of the Regulation – the Processing of Your Personal Data will be carried out by the Data Controller in order to proceed with the signing of the individual contractual document and will be legally based on the contractual relationship that will be created between You and the Data Controller;
H) administrative and accounting obligations:
the Data Controller may process your Data for the management of accounting, as well as for invoicing in accordance with the requirements of the applicable legislation, or for the performance of other obligations laid down by laws, regulations and EU legislation;
Data processed: personal and tax data.
Legal basis and lawfulness of processing: the legal basis legitimising the processing of the Data for this purpose is represented by Article 6(c) of the Regulation and, therefore, by a legal obligation to which the Data Controller is subject.
I) exercise and/or defence of a right in judicial proceedings:
the Data Controller may process your Data in order to assert and/or defend its rights in judicial proceedings.
Data processed: contractual data.
Legal basis and lawfulness of processing: the legal basis legitimising the processing of the Data for this purpose is represented by Article 6(f) of the Regulation, therefore by a legitimate interest of the controller.
J) direct marketing activities:
the Data Controller needs to collect certain of Your Personal Data in order to carry out promotional and/or marketing activities of its own towards You. This category includes all activities carried out to promote products and services sold and/or supplied by the Data Controller.
Data processed: name, surname, e-mail address, telephone number.
Legal basis and lawfulness of processing: consent of the data subject pursuant to Article 6(a) of the Regulation – the Processing of Your Personal Data will be carried out by the Data Controller and will be legally based on Your free, express and unequivocal consent;
K) profiling activities:
the Data Controller, in order to carry out profiling activities, namely the assessment of Your tastes, preferences and consumption habits, including those related to market surveys and statistical analyses, needs to process certain of Your Personal Data. This category includes any form of automated processing of Personal Data to evaluate certain personal aspects, such as, by way of example and without limitation, those concerning professional performance, economic situation, personal preferences, interests, reliability, behaviour, location or movements.
Data processed: name, surname, e-mail address, telephone number, interests and preferences.
Legal basis and lawfulness of processing: consent of the data subject pursuant to Article 6(a) of the Regulation – the Processing of Your Personal Data will be carried out by the Data Controller and will be legally based on Your free, express and unequivocal consent;
L) disclosure to third parties for marketing purposes:
the Data Controller is entitled to disclose Your Personal Data to specifically identified third parties indicated in the privacy notice provided, where necessary and required, so that such subjects may process them for their own commercial and marketing purposes;
Data processed: name, surname, e-mail address, telephone number.
Legal basis and lawfulness of processing: consent of the data subject pursuant to Article 6(a) of the Regulation – the Processing of Your Personal Data will be carried out by the Data Controller and will be legally based on Your free, express and unequivocal consent.
The methods of contact aimed at direct marketing, indirect marketing and profiling activities may be either automated (e-mail) or traditional (telephone calls with operator). In any case, and as better specified below, You may object to the processing and/or withdraw Your consent, even partially, for example by consenting only to traditional contact methods.
With regard to contact methods involving the use of Your telephone contacts, we remind You that the companies’ marketing activities will be carried out subject to verification of any registration by You in the Register of Objections, as established pursuant to and for the purposes of Italian Presidential Decree No. 178 of 7 September 2010, as subsequently amended.

3) METHODS OF PROCESSING

Personal data will be processed with IT and/or manual systems, through procedures and tools suitable to guarantee their security, confidentiality, integrity and availability and to prevent any possible tampering.
On some websites, IT techniques may be used for the direct acquisition of the user’s identifying personal data or profiling systems.
Personal data freely provided by the visitor on the Website, for example, to register and/or access a reserved area, request information on a specific product or service through a form, or write to an e-mail address.

4) REDIRECT TO EXTERNAL WEBSITES

The Websites may use so-called social plug-ins, which are special tools that make it possible to incorporate the features of the social network directly within the Website (for example, Facebook’s “like” function).
All the social plug-ins present on the Websites are marked with the respective logo owned by the social network platform.
When You visit a page of the Websites and interact with the plug-in (for example by clicking the “like” button) or decide to leave a comment, the corresponding information is transmitted by the browser directly to the social network platform (in this case Facebook) and stored by it.
For information on the purposes, type and methods of collection, processing, use and storage of personal data by the social network platform, as well as on the methods by which You may exercise Your rights, please consult the privacy policy of the individual social network.

5) SECURITY MEASURES

The FMTS Group and the third parties working for us adopt appropriate and adequate security measures to prevent unauthorised access, disclosure, alteration or unauthorised destruction of Your data, pursuant to the provisions of the applicable national legislation and the GDPR.
In particular, network, server and software access control systems are used to prevent disclosure of data to unauthorised third parties; firewall and antivirus systems are adopted to protect against viruses and malware that could erase, disclose or render data unusable; data encryption and pseudonymisation techniques are implemented; physical and logistical protection measures for the IT infrastructures are implemented; business continuity and disaster recovery procedures are implemented, as well as data breach procedures in the event of violations.
The websites and any associated data that pass through cloud servers are managed by  ARUBA S.p.A. (www.aruba.it), FlameNetworks (www.flamenetworks.com), Hosting Solutions (www.hostingsolutions.it/) and Salesforce (www.salesforce.com).

6) EXTERNAL DATA PROCESSOR

With a view to making specific processing activities more functional to its own interests and those of its clients/users, as regards the management of the common database present on the CRM (Customer Relationship Management) platform of the FMTS Group, each company thereof has appointed as data processor, by means of a specific written agreement in compliance with the provisions of Article 28 of the Regulation, the parent company Formamentis S.p.A. Società Benefit, which is entrusted with the management of the registration, organisation, storage, processing, selection and extraction phases of the personal data of clients/prospects.
Your Personal Data may be disclosed to specific subjects considered recipients of such Personal Data, where “recipient” means a natural or legal person, public authority, agency or another body to whom personal data are disclosed, whether a third party or not.

7) SUBJECTS TO WHOM YOUR DATA MAY BE DISCLOSED

In this regard, in order to correctly carry out all the Processing activities necessary to pursue the purposes referred to in this Privacy Notice, the Recipients who may find themselves in the position of processing Your Personal Data are the following:

• third parties that perform part of the Processing activities and/or activities connected and instrumental thereto on behalf of the Data Controller. Such subjects have been appointed as data processors, meaning the natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Data Controller;
• individual persons, employees and/or collaborators of the Data Controller, to whom specific Processing activities relating to Your Personal Data have been entrusted. Such individuals have been given specific instructions regarding security and the proper use of Personal Data and are defined as persons authorised to process Personal Data under the direct authority of the Controller or the Processor;
• third parties that carry out Processing activities and/or activities connected and instrumental thereto as independent data controllers, including – by way of example and without limitation – consulting firms, freelancers, credit institutions, insurance companies, third-party companies and/or companies belonging to the Group;
• companies with which the Controller has established collaborations by virtue of a contractual relationship.

Where required by law in order to prevent or suppress the commission of a crime, Your Personal Data may be disclosed to public bodies or judicial authorities, without such bodies being defined as Recipients. The Regulation establishes, in fact, that public authorities which receive disclosure of Personal Data in the framework of a specific investigation carried out in accordance with the law of the European Union or of the Member States are not considered Recipients.
The updated list of our data processors is available at the office in Pontecagnano Faiano (SA), Via Leonardo Da Vinci 15.

8) RETENTION

The processing and retention of Your personal data will take place, in accordance with the provisions of the applicable legislation on the matter, for a period of time not exceeding that necessary for the achievement of the purposes for which they are processed, without prejudice to the ten-year term for the retention of civil-law data only and the fulfilment of any other legal obligation.
The data provided by You for marketing and profiling purposes, on the other hand, will be retained for no longer than 2 years.
Thereafter, Your data will be deleted or anonymised and processed for aggregate and anonymous statistical analyses.

9) RIGHTS OF THE DATA SUBJECT

As provided for by the Regulation, You may exercise, at any time, towards the Data Controller the following rights:
Right of Access: You may obtain confirmation as to whether or not Your personal data exist, even if not yet recorded, and request that such data be made available to You in a clear and comprehensible manner. It is Your right to request information and, where applicable, a copy of:
a) the origin and category of Your personal data;
b) the logic of use, where Your information is processed by electronic means;
c) the purposes and methods of the processing;
d) the identification details of the Controller and the processors;
e) the subjects or categories of subjects to whom Your personal data may be disclosed or who may become aware of them;
f) the period during which Your data are retained or the criteria used to determine such period, where possible;
g) the existence of an automated decision-making process, including profiling. In such case You may request the logic used, the significance and the envisaged consequences for You;
h) the existence of appropriate safeguards in the event of transfer of Your data to a non-EU country or to an international organisation;
Right to Rectification: You may obtain, without unjustified delay, the updating, amendment, rectification of Your inaccurate data or the completion of Your incomplete data, if You have an interest in doing so;
Right to Erasure: It is Your right to obtain the deletion, blocking or, where possible, transformation into anonymous form of Your data:
a) if processed unlawfully;
b) if no longer necessary in relation to the purposes for which they were collected or subsequently processed;
c) where the consent on which the processing is based is withdrawn and no other legal ground exists;
d) where You have objected to the processing and there are no overriding legitimate grounds for continuing to use Your data;
e) where this is required by law;
f) where they relate to minors.
The Controller may refuse to erase Your data in the event of:
a) exercise of the right to freedom of expression and information;
b) compliance with a legal obligation, performance of a task carried out in the public interest or exercise of official authority;
c) reasons of public health interest;
d) archiving in the public interest, scientific or historical research purposes or statistical purposes;
e) establishment, exercise or defence of a right in judicial proceedings;
Right to Restriction: You may obtain restriction of processing in the event of:
a) contesting the accuracy of the personal data, if You have not preferred to request their amendment, updating or rectification;
b) unlawful processing by the Controller in order to prevent their erasure;
c) exercise of a right by You in judicial proceedings;
d) verification of the possible overriding legitimate grounds of the Controller over those of the data subject;
Right to Portability: You have the right to receive, where processing is carried out by automated means, without hindrance and in a structured, commonly used and machine-readable format, the personal data concerning You that You have provided to us on the basis of consent or contract, in order to transmit them to another Controller or – where technically feasible – to obtain direct transmission by the Controller to another Controller;
Right to Object: You have the right to object at any time, in whole or in part:
a) to the processing of personal data concerning You, for legitimate and overriding reasons connected with Your particular situation;
b) to processing for marketing and/or profiling purposes, where carried out, of personal data concerning You (e.g. You may object to the sending of advertising material, direct selling, market research or commercial communications by means of automated calling systems without the intervention of an operator, by e-mail, and by traditional marketing methods, by telephone and paper mail).
For all the cases mentioned above, where necessary, the data controller will inform the third parties to whom Your personal data are disclosed of any exercise of rights by You, except in specific cases (e.g. where such fulfilment proves impossible or would involve a manifestly disproportionate effort compared to the right protected).
The data subject has the right to lodge a complaint with the Supervisory Authority of the State of residence.

10) DATA TRANSFER

As a general rule, the personal data collected will not be transferred outside the European Union.
By way of exception, certain processing activities may involve the transfer of personal data to the United Kingdom, where one of the companies of the FMTS Group listed in Section 1 has its registered office. Such transfer is carried out on the basis of the adequacy decision adopted by the European Commission pursuant to Article 45 of the Regulation, which recognises that the United Kingdom ensures an adequate level of protection of personal data.
Should any further need arise to transfer personal data to countries outside the European Union, such transfer will in any case take place in full compliance with the principles set out in Articles 44 et seq. of the Regulation and on the basis of appropriate safeguards provided therein.

11) DPO

In order to facilitate relations between You and each Data Controller, the FMTS Group has decided to adopt and appoint the figure of the Data Protection Officer (DPO), as provided for by Articles 37-39 of the Regulation. The FMTS Group has therefore identified such figure in the person of Attorney Pietro Montella, who may be contacted at the address dpo@fmtsgroup.it.