Privacy Policy

1. Introduction
The ROSE School takes your privacy seriously and is committed to respecting it. This privacy policy (“Privacy Policy”) describes the personal data processing activities carried out by the ROSE School through the website www.roseschool.it (hereinafter, the “Site”) and the commitments made in this respect.

The ROSE School may process your personal data when you visit the Site and use its services and functionalities. In the sections of the Site where the user’s personal data are collected, a specific information notice pursuant to Articles 13 and/or 14 of EU Reg. 2016/679 is usually published.

Where required by EU Reg. 2016/679, the user’s consent will be acquired before processing his or her personal data (e.g. for marketing purposes, for the tracking of email communications or for the use of certain non-technical cookies). If you provide personal data of third parties, you must ensure that the communication of such data to the ROSE School and the subsequent processing for the purposes specified in the applicable privacy policy complies with EU Reg. 2016/679 and applicable law.

2. Identification details of the data controller, data processors and Privacy Officer
The Data Controller is the ROSE School, Via Adolfo Ferrata 1 – 27100 Pavia (PV) – Italy.
E-mail: info@roseschool.it
(Possible Data Processors and the Data Protection Officer, where appointed, are indicated in specific documentation made available by the ROSE School at the request of the data subject.)

3. Type of data processed
Visiting and consulting the Site does not generally entail the collection and processing of the user’s personal data, except for navigation data and cookies, as specified below.

In addition to the so-called “surfing data”, personal data voluntarily provided by the user when interacting with the functionalities of the Site or when requesting services (e.g. filling in contact forms, subscribing to the newsletter, sending applications, requesting information) may be processed.

In compliance with applicable regulations, the ROSE School may also collect the user’s personal data from third parties in the course of its activities (e.g. for administrative, contractual or security checks).

4. Cookies and navigation data
The Site uses “cookies”. Technical cookies are necessary for the proper functioning of the Site. Cookies other than technical cookies (e.g. third-party analytical or profiling cookies) are used only with the user’s consent, expressed through the cookie management banner, in accordance with current legislation.

Cookies are small files stored on the user’s device (computer, tablet, smartphone) while the user visits the Site. There are two macro-categories of cookies: technical cookies and profiling cookies.
Technical cookies are necessary for the proper functioning of a website and to allow the user to navigate; without them, the user may not be able to view pages correctly or use certain services.
Profiling cookies have the task of creating user profiles in order to send advertising messages in line with the preferences expressed by the user while browsing.

Cookies can also be classified as:

session cookies, which are deleted immediately when the browser is closed;
persistent cookies, which remain in the browser for a defined period of time and are used, for example, to recognise the device connecting to a site by facilitating authentication operations for the user;
own (first-party) cookies, generated and managed directly by the operator of the website on which the user is browsing;
third-party cookies, generated and managed by parties other than the operator of the website on which the user is browsing (e.g. analytics service providers, social networks, external content providers).

The analysis tools used by the Site include, where activated, Google Analytics 4 (GA4), which collects aggregate statistical information on how the Site is used.

5. Cookies used on the Site
The Site uses the following types of cookies and similar technologies:

own, session and persistent cookies, necessary to enable navigation on the Site, for internal security and system administration purposes;
third-party, session and persistent cookies, necessary to enable the user to use multimedia elements or embedded content on the Site (e.g. images, videos or content embedded from external platforms such as YouTube);
third-party cookies used for statistical purposes (Google Analytics 4 – GA4): the Site uses Google Analytics 4, a web analysis service provided by Google LLC (“Google”), which allows the ROSE School to carry out aggregate statistical analysis of access to and visits to the Site and to understand how users interact with its pages and content. GA4 may operate through cookies and/or similar technologies. The data collected may include, but is not limited to: IP address (usually in an anonymised form through the specific functionality offered by Google, where activated), information on the device and browser used, navigation events (pages visited, clicks, scrolls, session duration) and general information on geographical origin (area/country). The information generated about your use of the Site is transmitted to and stored by Google on servers that may be located in non-EU countries (e.g. the United States). GA4 is used with the user’s consent, expressed through the cookie banner. The user may revoke or modify their consent at any time through the cookie banner functionality. Further information on how Google processes data is available at: https://policies.google.com/technologies/partner-sites;
Google Fonts: the Site uses the “Google Fonts” service to display specific typefaces. The fonts may be loaded through calls to Google LLC servers, which may be located in non-EU countries (e.g. the United States). On this occasion, technical data relating to the user’s device may be transmitted to Google (e.g. IP address, browser information, date and time of the request). Any processing of personal data resulting from the use of Google Fonts is governed by Google’s terms of use and privacy policy: https://policies.google.com/privacy;
Google reCAPTCHA: the forms of the Site may be protected by the Google reCAPTCHA service, which is used to prevent spam and abuse. The service may collect technical data relating to the user’s device and interaction with the form (e.g. IP address, browser information) and transmit them to Google, also to non-EU countries, in accordance with Google’s privacy policy;
third-party, persistent cookies relating to social networks (Facebook, X and LinkedIn): the Site uses these cookies to enable the inclusion of buttons of specific social networks on its pages. By selecting one of these buttons, the user can publish the contents of the web page of the Site they are visiting on their personal page on the relevant social network. The installation and use of these cookies may result in social networks collecting information about the user’s navigation on the Site, even in the absence of actual use of the buttons, in accordance with the policies of the respective providers.

The Site may contain links to other sites (so-called “third-party sites”). The ROSE School has no access to or control over cookies, web beacons and other tracking technologies that may be used by third-party sites that the user may access through the Site; the ROSE School also has no control over the content and materials published by or obtained through third-party sites, nor over the manner in which the user’s personal data are processed, and expressly disclaims any responsibility in this regard.

The user is required to review the privacy and cookie policies of third-party sites accessed through the Site and to inform themselves of the conditions applicable to the processing of their personal data by these parties. This Privacy Policy applies exclusively to the Site as defined above.

5-bis. Tracking Technologies in Email Communications (Tracking Pixel)

The ROSE School uses an email marketing system (MailUp, provided by TeamSystem S.p.A.) for the distribution of its newsletters and institutional communications. These communications may contain a so-called tracking pixel (or web beacon): a transparent image measuring 1×1 pixel, invisible to the recipient, which enables the detection of certain information relating to the interaction with the email message.

Data collected through the tracking pixel
Once loaded by the recipient’s email client, the tracking pixel may collect the following data: confirmation that the email message has been opened and the corresponding date and time; the IP address of the device used to view the message; information about the email client and operating system employed; data relating to clicks on links contained in the message.

Purpose of processing
Data collected through tracking pixels are processed exclusively for the following purposes: aggregate statistical analysis of the effectiveness of communication campaigns (open rates, click-through rates); optimisation of the content and frequency of communications; verification of the correct technical functioning of the messages sent.

Legal basis
The processing of personal data through tracking pixels is based on the explicit, freely given, specific and informed consent of the data subject, pursuant to Article 6(1)(a) of Regulation (EU) 2016/679 (GDPR) and Article 122 of Legislative Decree No. 196/2003 (Personal Data Protection Code), as amended by Legislative Decree No. 101/2018, in accordance with the provisions of the Italian Data Protection Authority (Garante per la protezione dei dati personali). Consent to tracking is collected on a granular basis and separately from consent to receive the newsletter. The data subject may therefore subscribe to the newsletter without consenting to the tracking of their interactions with the messages received.

Data processor
The email marketing service is provided by TeamSystem S.p.A. (MailUp platform), appointed as Data Processor pursuant to Article 28 of the GDPR, on the basis of an agreement governing the nature, purposes, duration of processing, types of data and categories of data subjects, as well as the obligations and rights of the Data Controller.

Retention period
Data collected through tracking pixels are retained for a maximum period of 24 months from the date of collection, after which they are deleted or rendered anonymous in aggregate form. This period is determined on the basis of the statistical analysis purposes indicated above and may be updated upon prior notification to data subjects.

Right of withdrawal and management of tracking preferences
The data subject has the right to withdraw consent to tracking at any time, without this affecting the lawfulness of processing carried out prior to the withdrawal and without any consequences on the receipt of the newsletter, which shall continue to be delivered regularly. Withdrawal of consent to tracking may be exercised through the link “Manage your tracking preferences” in the footer of each email communication, or by sending a written request to info@roseschool.it.

6. How to disable cookies in browsers
You can manage cookies directly through your browser settings. However, if you delete cookies from your browser, the preferences you set for the ROSE School Site may be removed, so you should periodically review your settings.

For further information and support, you can visit the specific help pages of the browser you are using, for example:

Edge
Firefox
Safari
Chrome
Opera
Comet
Atlas

7. Storage and retention of personal data
Personal data are stored and processed through IT systems owned by the ROSE School and/or managed by third-party technical service providers, which may be appointed as Data Processors pursuant to Article 28 of EU Reg. 2016/679. For further details, please refer to section 10 (“Scope of data communication and access”).

Data are processed exclusively by specifically authorised personnel, including those responsible for carrying out extraordinary maintenance operations. Personal data will be retained for the duration of the contractual relationship or of the service requested and, subsequently, for the time necessary to fulfil the legal obligations of the ROSE School, including any legal defence requirements, and will then be deleted or anonymised.

Where you have given your consent to the processing of your data for direct marketing purposes, such data will be processed until you withdraw your consent, without prejudice to the lawfulness of the processing based on consent before its withdrawal.

8. Purposes and methods of data processing
The ROSE School may process personal data (as well as, where applicable, special categories of data pursuant to Article 9 of EU Reg. 2016/679, within the limits permitted by law) for the following purposes:

to enable the user to use the services and functionalities present on the Site;
to manage requests and reports received from users (e.g. requests for information, assistance, contacts);
to manage the subscription to, and the sending of, newsletters and informative communications on the activities, events, courses and initiatives of the ROSE School;
to manage applications received through the Site;
to fulfil legal, regulatory and normative obligations related to the activities of the ROSE School.

With the further and specific optional consent of the user, the ROSE School may also process personal data for marketing purposes, i.e. to send the user promotional material and/or commercial communications relating to the services and activities of the ROSE School, at the addresses indicated, both through traditional methods and/or means of contact (such as paper mail or telephone calls with an operator) and through automated means (such as internet communications, e-mail, SMS, applications for mobile devices, social network accounts – e.g. Facebook, X or LinkedIn – or automated telephone calls).

Personal data are processed both in paper form and with electronic tools, and entered into the information systems of the ROSE School in full compliance with EU Reg. 2016/679, including security and confidentiality profiles, and in accordance with the principles of fairness, lawfulness, transparency, minimisation and storage limitation. The data are kept for the time necessary to achieve the purposes for which they are collected and processed and, in any case, for as long as the user decides to remain subscribed to the services of the Site, without prejudice to any further retention periods required by law or for legal protection.

9. Security and quality of personal data
The ROSE School is committed to protecting the security of the user’s personal data and complies with the security provisions set out in the applicable legislation to avoid loss of data, illegitimate or unlawful use of data and unauthorised access, with particular reference to the appropriate technical and organisational measures required by EU Reg. 2016/679.

The information systems and computer programmes used by the ROSE School are configured to minimise the use of personal and identification data; such data are processed only to the extent necessary to achieve the specific purposes pursued from time to time. The ROSE School uses appropriate security technologies and procedures to protect your personal data; for example, data are stored on secure servers located in access-controlled locations. Users can help keep their personal data up to date and correct by promptly notifying any changes (address, job title, contact details, etc.).

10. Scope of data communication and access
The user’s personal data may be communicated to:

all persons to whom the right of access to such data is recognised by virtue of provisions of law, regulations or EU legislation;
collaborators and employees of the ROSE School, within the scope of their respective duties and in their capacity as persons authorised to process data pursuant to Article 29 of EU Reg. 2016/679;
third parties, natural or legal persons, public or private (e.g. IT service providers, cloud service providers, system maintenance companies, consultants, supervisory and control authorities and bodies), when the communication is necessary or functional to the performance of the activities of the ROSE School, in the manner and for the purposes described above.

These parties, if they process data on behalf of the ROSE School, are appointed, where required, as Data Processors pursuant to Article 28 of EU Reg. 2016/679.

The use of services provided by Google LLC (e.g. Google Analytics 4, Google Fonts, Google reCAPTCHA, YouTube) and other third-party service providers may result in the transfer of technical data (such as IP address and other browsing information) to countries outside the EU (such as the United States). Such transfers take place in compliance with Articles 44 et seq. of EU Reg. 2016/679 and, where required, on the basis of the consent expressed by the user through the cookie banner or other suitable mechanisms, without prejudice to the use of appropriate legal instruments (such as adequacy decisions, standard contractual clauses and additional security measures).

11. Nature of provision of personal data
The provision of certain personal data by the user is compulsory to allow the ROSE School to manage communications and requests received, or to contact the user in order to follow up on his or her request. This type of data is marked with an asterisk [*]; if it is not provided, the request cannot be processed.

The provision of other personal data not marked with an asterisk is optional; failure to provide such data will not usually have any detrimental consequences for the user, although it may limit the completeness of the information provided or of the services delivered.

The provision of personal data for marketing purposes (as specified in section 8) is optional and failure to provide consent will not affect the ability to use the primary services offered by the Site. Any consent given for marketing purposes shall be deemed extended to the sending of communications by both automated and traditional methods and/or means of contact, as exemplified above, without prejudice to the user’s right to object at any time, even selectively.

12. Rights of the data subject

12.1 Articles 15 (right of access) and 16 (right of rectification) of EU Reg. 2016/679
The data subject has the right to obtain from the controller confirmation as to whether or not personal data relating to him or her are being processed and, if so, to obtain access to the personal data and the following information:

the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients in third countries or international organisations;
the period for which the personal data will be retained or, if this is not possible, the criteria used to determine that period;
the existence of the right of the data subject to request from the controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning him or her, or to object to their processing;
the right to lodge a complaint with a supervisory authority;
the existence of an automated decision-making process, including profiling, and, at least in such cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

12.2 Article 17 of EU Reg. 2016/679 – right to erasure (“right to be forgotten”)
The data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller is obliged to erase the personal data without undue delay where one of the following grounds applies:

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
the data subject withdraws the consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2)(a), and there is no other legal basis for the processing;
the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or objects to the processing pursuant to Article 21(2);
the personal data have been unlawfully processed;
the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject;
the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of EU Reg. 2016/679.

12.3 Article 18 – right to restriction of processing
The data subject has the right to obtain from the controller the restriction of processing where one of the following applies:

the data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of such data;
the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
the data subject has objected to the processing pursuant to Article 21(1) of EU Reg. 2016/679, pending the verification whether the legitimate grounds of the controller override those of the data subject.

12.4 Article 20 – right to data portability
The data subject has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller without hindrance from the controller to which the data have been provided, within the limits and under the conditions laid down in Article 20 of EU Reg. 2016/679.

12.5 Article 21 – right to object
The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her based on Article 6(1)(e) or (f), and to object at any time to processing for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.

12.6 Article 77 – right to lodge a complaint
The data subject has the right to lodge a complaint with a supervisory authority. In Italy, the competent authority is the Garante per la protezione dei dati personali (www.garanteprivacy.it).

13. Withdrawal of consent to processing
The data subject has the right to withdraw consent to the processing of his or her personal data at any time, without prejudice to the lawfulness of the processing based on consent before its withdrawal.

To exercise this right, the data subject may send a registered letter with acknowledgement of receipt to the following address: ROSE School, Via Adolfo Ferrata 1 – 27100 Pavia (PV) – Italy, accompanied by a copy of a valid identity document and bearing the text “revocation of consent to the processing of all my personal data”; or send an e-mail to info@roseschool.it with the subject “revocation of consent to the processing of all my personal data”, attaching a copy of a valid identity document where necessary.

For further information on the processing of personal data or to exercise the other rights listed in section 12 above, the data subject may use the same contact details, clearly indicating the nature of the request (access, rectification, erasure, restriction, objection, portability, etc.).

Before providing or modifying any information relating to the data subject, the ROSE School reserves the right to verify the identity of the applicant. A reply will be provided as soon as possible and, in any case, within the time limits set by law.

14. Privacy Policy – Nigel Priestley Seminar 2026 (Pdf)

Last updated: 2 November 2026.