INFORMATION ON THE PROCESSING OF PERSONAL DATA
Version 1.0 — Register of Digital Communicators
1. Data controller and contacts
The Data Controller is Esse Social Academy — Professional and Training Association, P.IVA/C.F. 17139111003, with registered office at Via Antonio Salandra 18, 00187 Rome.
For requests relating to the protection of personal data, you can write to segreteria@comunicatoridigitali.it.
At the effective date of this information, a person responsible for the data protection (RPD/DPO). If designated in the future, the relevant contact details will be made available with the update of the information.
2. Scope of information
This information concerns the Registro Comunicatori Digitalisite and services, including registration and access, application, assessment and testing, verification of skills and experiences, management of professional profiles, registration and renewal, public registry, certificates, payments and services, assistance, operational communications, document management, security, audits and requests from interested parties.
Any additional or autonomous treatments will be accompanied, when necessary, by specific information.
3. Categories of data processed
They can be processed, depending on the service used: identification and personal data; tax code; contact data; professional and curricular data; information on skills, profiles, experiences, training and professional activity; answers, results and metadata of the assessments; documents uploaded to support the practices; data relating to registrations, orders, fees and payments; consents and views; requests for assistance and privacy; technical and security data, including session identifiers, logs, IP addresses or their pseudonymized fingerprints, user agents and information necessary to prevent abuse.
The portal does not normally require special categories of data pursuant to art. 9 GDPR. The interested party is invited not to include unnecessary information in the documents. If special data are accidentally contained in the transmitted documentation, they will be processed only to the extent necessary and on the basis of an applicable condition of lawfulness.
4. Purposes and legal bases
1.Account creation and management, authentication and resumption of the journey. Legal basis: execution of pre-contractual measures or the relationship requested by the interested party, art. 6, par. 1, letter b) GDPR; legitimate interest in the security of the service, letter f), for strictly necessary technical measures.
2.Application, assessment, Test, verification of skills and experiences, management of profiles and enrollment. Legal basis: execution of pre-contractual measures and the requested associative/professional relationship, art. 6, par. 1, letter b) GDPR; fulfillment of applicable obligations, letter c), where applicable.
3.Administrative management, orders, quotas, payments, reporting and accounting or tax obligations. Legal basis: art. 6, par. 1, letter b) and c) GDPR.
4.Publication in the Public Register of data and profiles for which a choice of the interested party is required. Legal basis: consent, art. 6, par. 1, letter a) GDPR, when the system requires such consent. Consent may be revoked for the future, without prejudice to the treatments already lawfully carried out and the applicable storage obligations.
5.Optional communications not necessary for managing the relationship. Legal basis: consent, art. 6, par. 1, letter a) GDPR, revocable at any time.
6.Security, prevention of fraud and abuse, protection of the integrity of the Registry, incident management, auditing and defense of rights. Legal basis: legitimate interest of the Data Controller, art. 6, par. 1, letter f) GDPR, and legal obligations where applicable. These activities are limited to what is necessary and proportionate.
7.Management of requests to exercise privacy rights and accountability obligations. Legal basis: fulfillment of legal obligations, art. 6, par. 1, letter c) GDPR.
5. Nature of the provision
The data marked as necessary in the registration, application, evaluation, registration or purchase processes are essential to provide the requested service. Failure to provide it may prevent the creation of an account, the termination of the application, the evaluation, the registration or the provision of the service.
The data and consents expressly indicated as optional may be omitted without preventing access to functionalities that do not depend on them.
6. Assessment, automated rules and review
The portal can apply predetermined computer rules to compose Tests, calculate scores, verify technical requirements, produce intermediate results or update the status of a course. Application rules must be consistent with approved and versioned professional and governance criteria.
When a fully automated decision falls within art. 22 GDPR and produces legal effects or similarly significant effects, the guarantees provided by the law will apply, including, where applicable, the right to obtain human intervention, express your opinion and challenge the decision. Merely technical, calculation or support functions do not attribute autonomous professional skills to the algorithm.
7. Public record and verifiability
Within the limits of the choices of the interested party, the Registry rules and the current administrative and professional position, some data may be made publicly available to allow verification of registration, status and recognized professional profiles.
The publication is limited to the data provided by the system and does not involve the indiscriminate publication of the documentation submitted, the answers to the Tests or data not intended for public consultation.
8. Technical cookie, session and navigation data
To maintain access to the personal area, the portal uses a technical session cookie. A random session identifier is stored in the cookie and the OTP code, the application documents or the user's personal data are not stored.
The configured maximum duration of the authenticated session is 8 hours of inactivity. The cookie is configured with security measures such as HttpOnly, Secure in production and SameSite=lax; after authentication, the session identifier is regenerated and the logout invalidates the session.
For cookies and strictly technical identifiers, prior consent is not required; the information required by the law is provided. Any non-technical or profiling tools, if introduced, will require a legal basis and, when necessary, prior consent and specific preference management.
9. Recipients and data processors
The data is processed by authorized persons and, when necessary, may be communicated to suppliers that support the provision of the service, such as hosting and IT infrastructure, e-mail and operational communications, payment systems, security and anti-abuse services, technical assistance, storage and backup, as well as to administrative, tax or legal advisors bound to confidentiality.
The subjects who process data on behalf of the Data Controller are designated as data processors pursuant to art. 28 GDPR when the conditions are met. The data may also be disclosed to authorities or other subjects when this is required by law or necessary for the protection of rights.
10. Transfers to third countries
The Data Controller selects suppliers, also taking into account the location of the treatments. If the use of a service involves transfers of personal data outside the European Economic Area, such transfers will be made only in the presence of a basis provided for by Chapter V GDPR, for example an appropriateness decision or appropriate guarantees such as standard contractual clauses, with any additional necessary measures.
Updated information on the guarantees applicable to a specific supplier may be requested from the Data Controller's privacy contact.
11. Storage
The data is kept for the time necessary for the purposes for which they are collected and subsequently for the periods required by law or necessary to protect the rights of the Data Controller and interested parties. The portal uses storage policies differentiated by accounts and personal data, assessments, practices and experiences, payments and administrative documentation, registration and registry history, consents and views, privacy requests, technical logs and audits.
When it is not possible to indicate a single term in advance, the duration is determined based on the permanence of the relationship, the closure of the practice or service, the applicable legal obligations, the statute of limitations and the documented security and accountability needs. Upon expiry, the data is deleted, anonymized or subject to revision according to the applicable policy.
12. Security and integrity
Technical and organizational measures are adopted proportionate to the risk, including access control, encrypted connections, session protection, separation of environments, backups, tracking of relevant administrative operations, pseudonymization of technical data where applicable, and measures against unauthorized access or use.
No system can guarantee zero risk; the measures are therefore reviewed according to technical evolution and the treatments actually carried out.
13. Rights of the interested party
In the cases provided for by the GDPR, the interested party may exercise the rights of access, rectification, cancellation, limitation of processing, opposition and portability, as well as revoke at any time a consent previously given without prejudice to the lawfulness of the processing carried out before the revocation.
Requests can be submitted to segreteria@comunicatoridigitali.it or through the features available in the personal area. The Data Controller may request the information strictly necessary to verify the identity of the applicant.
The interested party also has the right to lodge a complaint with the Guarantor for the protection of personal data or to the competent supervisory authority pursuant to the GDPR.
14. Updates to Policy
This policy has been revised. Substantial changes are published on the portal and, when necessary, a new review is requested or a further communication is provided to the interested parties.
Version 1.0 — effective as of 19 August 2026.