Personal data protection notice

We process your account data and the data generated by your studying in order to deliver the learning paths, verify what you have learnt and issue certificates. Learning evidence (test results, exercises, certificates) is kept for ten years, because it is what proves the training was carried out for the purposes of cybersecurity obligations; your account is deleted three years after your last activity. We do not sell or pass your data to third parties.

In short
  • We use your data to let you study, to check what you have learnt and to issue your certificate. Nothing else.
  • We do not sell, share or profile. No automated decision-making affects you.
  • Learning evidence is kept for ten years because it is the proof that the training took place: for those records the right to erasure is limited, and we explain why below.
  • For everything else you can ask for access, correction or erasure at any time.

1. Who processes your data

The data controller is NormaShield Academy. You can get in touch about anything concerning your data through the support contact form, which is also reachable from the footer of every page and does not require you to have an account.

2. What we process, why, on what basis and for how long

Every processing operation serves a stated purpose, has a lawful basis identified in Article 6(1) of Regulation (EU) 2016/679 and a retention period of its own. The six purposes below are the same ones published in the data retention summary, where you will also find the detail for each area of the platform.

Managing your account

Creating and managing your personal account, authentication and service messages.

Data processed: first name, surname, email address, town, account preferences and profile picture
Lawful basis: Article 6(1)(b): performance of the contract to which you are a party
Retention: 3 years from your last activity, after which the account is deleted

Delivering the learning paths

Enrolment on learning paths, access to the content and tracking of your learning progress.

Data processed: progress through the paths, completion status of activities
Lawful basis: Article 6(1)(b): performance of the contract
Retention: 5 years from completion of the path

Assessing and certifying skills

Learning tests, marking of submitted work and issuing of certificates.

Data processed: test attempts and scores, exercises completed, marks, certificates issued
Lawful basis: Article 6(1)(b) and (c): contract and legal obligation
Retention: 10 years. This is the evidence that proves the training was carried out, for the purposes of cybersecurity obligations (NIS2 and the determinations of the ACN, Italy's National Cybersecurity Agency): for these records retention prevails over a request for erasure, as explained in section 3

Communication and learner support

Forum discussions, tutor announcements and support for learners during and after the path.

Data processed: messages posted in the forums and support requests
Lawful basis: Article 6(1)(f): our legitimate interest in supporting the people who study with us
Retention: 3 years

Buying access to a learning path

Opening the order, collecting the payment, sending the activation keys and keeping the accounting records.

Data processed: first name, surname, email address, organisation where given, amount and status of the order
Lawful basis: Article 6(1)(b) and (c): performance of the purchase contract and tax obligations
Retention: 10 years for paid orders, which are accounting records (Article 2220 of the Italian Civil Code) and remain even if you ask for erasure; orders never paid are deleted along with you

Running and securing the platform

Operation of the site, security, prevention of abuse and administrative duties.

Data processed: access and activity logs, sessions, IP addresses
Lawful basis: Article 6(1)(b) and (f): our legitimate interest in keeping the platform running and secure and in preventing abuse
Retention: 10 years

Interface preferences

Interface elements and browsing preferences, with no documentary value of their own.

Data processed: blocks displayed, history of recent visits
Lawful basis: Article 6(1)(f): our legitimate interest in providing a working interface
Retention: 6 months

3. Your rights

The Regulation gives you the rights below. To exercise them, write to the controller using the support contact form: we reply within one month.

  • Access (Article 15): to know what data we process and obtain a copy of it.
  • Rectification (Article 16): to correct inaccurate data or complete incomplete data.
  • Erasure (Article 17): to have your data deleted, within the limits set out below.
  • Restriction (Article 18): to ask that your data be kept but not processed further while a dispute is being resolved.
  • Portability (Article 20): to receive the data you provided to us in a machine-readable format.
  • Objection (Article 21): to object to processing based on legitimate interest, that is the last three purposes in section 2.
The limit on erasure

Learning evidence (test results, exercises completed, certificates issued) is not erased on request for ten years. This is not a commercial choice: it is the proof that a given person completed a given course, and the organisation that had you take it needs it to show that it met its own obligations. Deleting it would make the certificate you earned impossible to verify.

Everything else, including your account, preferences and forum posts, follows the ordinary rules and is deleted on request.

4. Where the data is held and who we share it with

The platform is hosted on infrastructure located in the European Union. We do not sell or pass your data to third parties, and we do not use it for profiling or automated decision-making.

The only external parties that process data on our behalf are the provider of the infrastructure hosting the platform and the provider of the email service used for service messages, both appointed as processors under Article 28 of the Regulation. If your access was arranged by your employer or by the organisation you belong to, your learning results are visible to that organisation's training contact.

Access is paid for by bank transfer to the account of the data controller: the platform neither asks for nor stores payment card data, and your bank and ours handle the transfer as independent controllers, not on our behalf. All we learn of the transaction is that the money arrived, which a manager records against the order.

5. Complaints to the supervisory authority

If you believe the processing of your data breaches the Regulation, you can lodge a complaint with the Garante per la protezione dei dati personali, Italy's data protection authority (garanteprivacy.it), or bring court proceedings. Complaining to the Garante is free of charge and does not stop you from coming to us first.

6. Updates to this notice

Every revision of this notice is published as a new version with its own date: earlier versions remain available and there is a record of which text you accepted and when. When the text changes you are asked to accept it again at your next sign-in.

Back
Back to top