PRIVACY POLICY ON THE PROCESSING OF PERSONAL DATA (EU Regulation 679/2016)

Dear User,

Pursuant to Art. 13 of EU Regulation 2016/679 (hereinafter "GDPR"), Alessandro Giuliani informs you that your data will be processed in compliance with the principles of meed, fairness, lawfulness, and transparency, and in accordance with current national legislation.

In this document, you will find all the information regarding how the data collected through this Website is processed.

Data Controller

Name: Alessandro Giuliani
Italian VAT (P.IVA): 14459690963
Registered address: Via Ugo Foscolo 5D, Pozzuolo Martesana (MI), Italy
Email: info@altairfellowship.com

Nature of Processed Data

The Personal Data processed is voluntarily provided by the User or legitimately collected by the Data Controller, in compliance with current regulations. The Personal Data collected through this Website includes:

  • Website navigation/operating data. The computer systems, telecommunications systems, and software procedures involved in operating this Website acquire, during their normal operation, certain data whose transmission is implicit in the use of web communication protocols and necessary for the functioning of the Site. This category of data includes, for example, IP addresses, date and time of access, visited pages (URI/URL), the numerical code indicating the status of the server response, and other parameters related to the user's operating system and IT environment.

  • Voluntarily provided data. In certain sections of the websites, specific Personal Data is requested: upon registration, the User is asked for an email address and registration password; to proceed with a purchase, the User is requested to provide the Personal Data necessary for shipping, billing, and the provision of requested services (full name, address, email address, telephone number, tax code, date and place of birth). Failure to provide certain data (e.g., contact details or address) may make it impossible to provide certain services. Users are responsible for third-party Personal Data entered into the system and confirm that they have obtained consent from the data subjects to provide said Personal Data to the Data Controller.

During training courses, additional Personal Data may be collected (such as educational qualifications, years of work experience, and other resume information) for the purpose of personalizing the services provided. Such data is freely provided by the User and is not necessary for the provision of services.

  • Data collected via tracking (cookies). A cookie is a piece of data stored on a computer or mobile device while browsing the internet so that the device can be recognized later. Cookies used by TopSquad do not identify the User personally; they merely recognize the device used. Cookies do not harm the device in any way, nor do they allow the Data Controller access to the device, but they enable multiple important Website features. For example, they allow returning to previously viewed pages, remember User preferences, personalize Website content, ensure an overall improved navigation experience, and protect TopSquad. Furthermore, cookies measure traffic and analyze User behavior to improve service quality. Collection is anonymous and covers information such as the number of visitors and pages visited. The User can choose whether to accept cookies. Most browsers accept cookies automatically, but settings can be modified to refuse them. Disabling cookies may limit the experience on topsquad.it. For more information regarding cookies, external services used, purposes, and consent management, please refer to the cookie policy.

Data Processing Methods

Personal Data provided is processed by authorized personnel through electronic and/or paper means, according to principles of fairness, lawfulness, transparency, and protection of privacy and rights. Personal Data is protected using technical and organizational measures to ensure adequate levels of security and confidentiality pursuant to Arts. 25 and 32 of the GDPR.

Data is processed at the Data Controller’s operational offices and, if applicable, at the locations of external Data Processors handling data on behalf of the Controller. Data will be processed within the territory of the European Union. Should it prove necessary for technical or operational reasons to transfer Data to an external Data Processor outside the EU, processing will occur in compliance with Chapter V of the GDPR, adopting all necessary precautions to guarantee Data protection.

Data Communication and Recipients

Personal Data is not subject to general dissemination to third parties. However, to carry out processing activities necessary to pursue the purposes outlined in this Policy, the following Recipients may process Personal Data:

  • Third parties providing services to the Data Controller (e.g., hosting, IT, marketing, web analytics, market research, opinion polls), who perform part of the processing or connected instrumental activities on behalf of the Controller as Data Processors. The Controller provides these third parties only with the information strictly necessary to perform the requested services.

  • Individuals, employees, or collaborators of the Data Controller assigned specific Personal Data processing tasks, who receive specific instructions regarding security and proper Data use.

  • Where required by law or to prevent/repress a crime, Personal Data may be communicated to competent public entities or judicial authorities without being formally classified as Recipients.

A full list of these entities can be requested from the Controller at any time.

Legal Basis

The User's Personal Data will be processed by the Controller only if one of the following conditions applies:

  • Processing is necessary for the performance of a contract to which the User is party or pre-contractual measures (Art. 6(1)(b) GDPR);

  • Processing is necessary for compliance with a legal obligation to which the Controller is subject (Art. 6(1)(c) GDPR);

  • Processing is necessary for the legitimate interests pursued by the Controller or a third party (Art. 6(1)(f) GDPR);

  • The Data Subject has given consent to the processing of their personal data for one or more specific purposes (Art. 6(1)(a) GDPR).

It is always possible to ask the Data Controller to clarify the specific legal basis for any processing activity.

Purposes of Processing

User or Data Subject Data is collected to enable:

  • Website navigation, registration, and use of services made available on the Site (Contractual legal basis ex Art. 6(1)(b) GDPR);

  • Completion of purchase orders for offered products/services, payment management, shipping, and exercise of withdrawal rights for distance purchases (Contractual legal basis ex Art. 6(1)(b) GDPR);

  • Delivery of purchased services and sending notifications necessary for service provision (Contractual legal basis ex Art. 6(1)(b) GDPR);

  • Management of User information requests, pre/post-sale support, and notifying Users of maintenance operations or service disruptions (Pre-contractual/Contractual legal basis ex Art. 6(1)(b) GDPR);

  • Statistical research and analysis on aggregated or anonymous data (Legitimate interest legal basis ex Art. 6(1)(f) GDPR);

  • Compliance with European and national legal obligations (Legal obligation legal basis ex Art. 6(1)(c) GDPR);

  • Carrying out administrative-accounting activities (Legitimate interest legal basis ex Art. 6(1)(f) GDPR);

  • Management of potential complaints, legal disputes, defense of the Data Controller in court, and detection of illegal or fraudulent activity (Legitimate interest legal basis ex Art. 6(1)(f) GDPR).

User Data may be processed for the following purposes only with explicit consent, which can be withdrawn at any time:

  • Sending promotional information and commercial offers (Consent legal basis ex Art. 6(1)(a) GDPR);

  • Conducting surveys and market research (Consent legal basis ex Art. 6(1)(a) GDPR).

Data Retention

User Personal Data is processed until any deletion request is made and stored for no longer than necessary to achieve the purposes for which it was collected, respecting the principle of data minimization (Art. 5(1)(c) GDPR) and legal obligations.

Specifically, Data used for purchasing goods and services will be retained for service delivery and administrative-accounting obligations for no more than 10 years from the last recorded transaction, subject to additional retention required by law.

Data processed for marketing purposes may be lawfully retained for 8 years from the date consent was granted, unless consent is revoked earlier. Retention duration is determined based on the nature of services offered and average customer purchasing frequency (specifically the average time between preparing for medical school entry tests and medical specialization exam preparations).

Rights of the Data Subject

The Data Subject has the right to request and obtain from the Controller without delay:

  • Confirmation of whether Personal Data concerning them is being processed, access to that data, processing purposes, categories of data, recipients, retention period, and exercisable rights (Right of access, Art. 15 GDPR);

  • Rectification of inaccurate Personal Data or integration of incomplete data (Right to rectification, Art. 16 GDPR);

  • Deletion of Personal Data if processed unlawfully or if no longer necessary for the original purpose (Right to erasure / "Right to be forgotten", Art. 17 GDPR);

  • Restriction of processing if data is unlawful, unnecessary, or contested (Right to restriction of processing, Art. 18 GDPR);

  • Transmission of Personal Data to another Data Controller without hindrance where processing is based on consent/contract and automated (Right to data portability, Art. 20 GDPR).

Furthermore, the Data Subject may exercise at any time:

  • The right to object to the processing of Personal Data based on legitimate interest or public interest grounds (Art. 21 GDPR);

  • The right to withdraw consent at any time without affecting prior lawful processing (Art. 7 GDPR);

  • The right to lodge a complaint with the Data Protection Authority (Garante per la protezione dei dati personali) or seek judicial remedy.

To exercise these rights, requests may be sent to testbusters@pec.it, by mail to Via Marco Ulpio Traiano 17, 20149, Milan (MI), or via the Website's "Contact Us" section. Requests are handled free of charge and as soon as possible.

Marketing consent can also be withdrawn via the "unsubscribe" link in promotional emails or under User profile settings. Cookie settings can be managed directly via browser preferences.

Changes to Privacy Policy

The Data Controller reserves the right to modify or update parts of this privacy policy at any time. Users are encouraged to review it periodically. Continued use of the Site following posted changes constitutes acceptance of those changes.