Privacy policy

REGARDING THE PROCESSING OF PERSONAL DATA CARRIED OUT THROUGH THE BROCHURE DOWNLOAD, INFORMATION REQUEST, AND COURSE APPLICATION FORMS

(pursuant to Art. 13 of Regulation (EU) 2016/679 – “GDPR”)

This privacy policy describes the methods for processing the personal data of users (the “Users”) of the H-FARM College website (www.college.h-farm.com, the “Site”) who interact with the brochure download, information request, and course application forms (the “Forms”).

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

1.1 Data Controller The Data Controller is H-FARM College S.r.l., with registered office in Roncade (TV), Via Sile 41, Tax Code/VAT No. 04594110266 (hereinafter “H-FARM” or the “Controller”).

1.2 Data Protection Officer (DPO) The Controller has appointed a Data Protection Officer (DPO) pursuant to Art. 37 of the GDPR, identified as LCA Servizi S.r.l., who can be contacted at the following addresses:

Via della Moscova, 18, 20121, Milan;
Email: dpo@lcalex.it;
Certified Email (PEC): lcaservizi@pec.lcaservizi.it

2. CATEGORIES OF PERSONAL DATA PROCESSED

2.1 Data provided voluntarily by the User The Controller processes personal data provided directly by Users through the Forms, managed via the Zoho Forms and Zoho CRM platforms. Such data includes, by way of example: first and last name, email address, telephone number, information regarding educational interests, as well as any additional data entered in the open fields of the Forms or communicated during orientation activities, including via WhatsApp or chatbots.

2.2 Data of minors In the event of a course application by minor students, the Controller also processes the personal data of parents or those exercising parental responsibility, as requested during the application phase. The processing of such data is carried out exclusively for application management and in compliance with Art. 8 of the GDPR and applicable national legislation.

2.3 Navigation data and tracking tools The Site’s IT systems automatically acquire certain personal data, such as IP addresses, browser information, and device details. The Site also uses cookies and tracking tools, including Meta Pixel, TikTok Pixel, Google Ads Tag, and Amazon advertising tools, for statistical purposes, performance analysis, and marketing. Such processing occurs exclusively upon the User’s express consent provided via the cookie banner, as specified in the Cookie Policy available on the Site.

3. PURPOSES OF PROCESSING, LEGAL BASES, AND RETENTION

3.1 Response to requests and orientation activities Personal data is processed to respond to User requests, send requested brochures, provide information about courses, and perform orientation activities, including telephone follow-ups (recalls).

Legal Basis: Execution of pre-contractual measures taken at the request of the Data Subject pursuant to Art. 6(1)(b) of the GDPR.
Retention: Data is stored for a maximum period of 24 months from collection.

3.2 Management of course applications Data is processed for the management of course applications, including preliminary evaluation and selection activities.

Legal Basis: Execution of pre-contractual measures pursuant to Art. 6(1)(b) of the GDPR.
Retention: In the event of non-enrollment or failure to register for other courses, data is stored for a maximum period of 12 months.

3.3 Direct Marketing Subject to the User’s explicit consent, the Controller processes personal data to send informational and promotional communications regarding H-FARM College courses, events, and initiatives via email, telephone, or WhatsApp.

Legal Basis: Consent of the Data Subject pursuant to Art. 6(1)(a) of the GDPR.
Retention: Data is stored until consent is withdrawn and, in any case, for a period not exceeding 24 months.

3.4 Profiling and personalization of communications Subject to the User’s consent, data may be processed for segmentation activities and preference analysis aimed at sending personalized communications.

Legal Basis: Consent pursuant to Art. 6(1)(a) of the GDPR.
Retention: Data is stored until consent is withdrawn and, in any case, for a period not exceeding 12 months.

3.5 Soft Spam The Controller may send email communications regarding courses or services similar to those already purchased by users who have established a contractual relationship with H-FARM College, pursuant to Art. 130, paragraph 4, of the Privacy Code.

Legal Basis: Legitimate interest of the Controller pursuant to Art. 6(1)(f) of the GDPR.
Opt-out: The User may object at any time.

3.6 Security and Site operation Navigation data is processed to ensure the security, proper functioning, and maintenance of the Site.

Legal Basis: Legitimate interest of the Controller.
Retention: Data is stored for the duration of the session or for the necessary technical time.

3.7 Legal obligations and protection of rights Data may be processed to comply with legal obligations or for the protection of the Controller’s rights in judicial and extrajudicial settings.

Legal Basis: Legal obligation or legitimate interest of the Controller.
Retention: Data is stored for the prescriptive periods provided by applicable law.

The provision of data for pre-contractual purposes is necessary; failure to provide it will make it impossible to follow up on the User’s requests.

4. PROCESSING METHODS AND RECIPIENTS

4.1 Processing Methods The processing of personal data is carried out using manual and IT tools, in compliance with the principles of lawfulness, fairness, transparency, and security.

4.2 Data Recipients Data may be processed by authorized H-FARM College personnel and by third parties providing services instrumental to the Controller’s activities, appointed as Data Processors pursuant to Art. 28 of the GDPR, including but not limited to: Zoho (Form and CRM management), Woztell (WhatsApp integration), and Newline S.r.l. (orientation and telephone recall services).

4.3 Automated Decision-Making The Controller does not adopt fully automated decision-making processes that produce legal effects on the Data Subject without human intervention.

5. DATA TRANSFER TO NON-EU COUNTRIES

Certain processing operations carried out through technology providers may involve the transfer of personal data outside the European Economic Area (EEA). Such transfers take place in compliance with Articles 44 et seq. of the GDPR, based on adequacy decisions by the European Commission, by signing Standard Contractual Clauses or, where applicable, in accordance with the EU-U.S. Data Privacy Framework.

6. RIGHTS OF THE DATA SUBJECTS

6.1 Exercisable Rights Users may exercise the rights provided by Articles 15-22 of the GDPR at any time, including the right of access, rectification, erasure, restriction of processing, objection to processing (particularly for marketing or profiling purposes), as well as the right to data portability.

6.2 How to exercise rights Requests can be sent to the email address: legal@h-farm.com. The right to lodge a complaint with the Data Protection Authority (Garante per la Protezione dei Dati Personali) remains unaffected.

7. SPECIFIC PROVISIONS

7.1 Communications via WhatsApp For communications sent via WhatsApp, the Data Subject may revoke consent at any time by sending the message “STOP”.

7.2 Links to third-party sites This policy does not apply to third-party sites or services that may be reachable through links on the Site, which operate as independent data controllers.