Privacy Policy Rulex Academy

INFORMATION ON THE PROCESSING OF PERSONAL DATA

of users who use the learning management platform Rulex Academy in accordance with Article 13 of Regulation (EU) 2016/679 and Legislative Decree 196/2003 and subsequent amendments.

With this document, in accordance with Article 13 of EU Regulation 679/2016 (hereinafter referred to as "GDPR"), Rulex Innovation Labs S.r.l. informs you about the ways in which we handle personal data of users who use the Rulex Academy Learning Management System (hereinafter referred to as “LMS”), which can be accessed at the following address: http://learn.rulex.ai

This information is provided only for the address http://learn.rulex.ai and not for other websites that may be consulted by users through links on the LMS.

Data Controller

The Data Controller for your personal data is Rulex Innovation Labs S.r.l. (VAT no. 01715910996), based at Via Felice Romani, n. 9/2, Genoa, contactable at the email address: gdpr@rulex.ai, tel. +39 0108050190 (hereinafter referred to as "Rulex" or the "Company").

Purpose and legal basis for processing

The personal data provided by you (such as, for example, name, surname, tax code, email address, IP address, access data, navigation data, payment data) will be processed lawfully, correctly and in full compliance with current legislation, with the support of paper and/or computer means, exclusively for the following purposes and on the basis of the following legal grounds:

a) purposes related to the management of pre-contractual relationships and/or conclusion, management and execution of the contract: the processing is necessary for the execution of contractual and legal obligations on the part of Rulex in relation to the contract.

b) purposes of management of administrative, accounting, legal and tax obligations: the processing is necessary for the execution of contractual and legal obligations on the part of Rulex in relation to the contract.

c) purposes related to the technical management of the LMS: the processing is necessary to ensure the proper management and delivery of the LMS. The processing is carried out on the basis of Rulex's legitimate interest.

d) purposes of management of requests received from Users: the personal data provided by you voluntarily will be processed, with the support of computer means, only for the purpose of providing feedback to the requests received by Rulex. The legal basis for the processing is the execution of the contract or the performance of pre-contractual obligations.

e) purposes related to the performance of qualitative audits: the processing is necessary for the pursuit of Rulex's legitimate interest aimed at monitoring the correct execution of contractual performances and in the verification and maintenance of quality and safety standards in the performance of operational activities.

f) purposes of management of disputes: the processing is necessary for the management of complaints and/or disputes, for the prevention and repression of illicit acts, as well as, in general, for the protection of the rights and legitimate interests of Rulex and/or third parties, also in court. The legal basis for the processing is the legitimate interest (the interest of Rulex corresponds to the right of action and defence established by art. 24 of the Italian Constitution, socially recognized as prevailing over the interests of the individual concerned).

For the purposes for which the basis of lawfulness is identified in the legitimate interest, Rulex conducts, according to the normative provisions, an analysis regarding the balancing of interests between its legitimate interest and the rights and fundamental freedoms of the data subject.

It should be noted that your personal data will be communicated and processed by Rulex personnel duly authorized and instructed by the Company itself.

Types of data processed and period of preservation

Through the LMS, different types of personal data will be collected.

Personal data necessary for the execution of the contract

Generic personal data - such as name, surname, email address, banking data - necessary to carry out the contractual relationship.

Personal data provided directly by the User

The personal data provided by you voluntarily will be processed exclusively in order to provide feedback to requests received by Rulex. These data will not be used for profiling or direct marketing activities.

Access data

Rulex performs processing operations on the credentials of Users (such as username, password, and authorization profiles) who access the platform in order to allow proper management of access and visibility of content within the reserved area.

Usage data

In relation to the activities carried out by Users (e.g., course consumption, downloading materials, teaching materials, training minutes and certificates, management of course participation, use of chat or comments on content, carrying out tests) Rulex collects and records the relevant data with the goal of making them available to both Users and internal company personnel authorized to access them.

Navigation data

The computer systems and software procedures used to operate the LMS acquire, during their normal operation, some data whose transmission is implicit in the use of internet communication protocols. These data are processed to ensure proper management and delivery of the LMS.

These are information that are not collected to be associated with identified parties, but which by their nature could, through processing and association with data held by third parties, allow users to be identified.

In this category of data fall the IP addresses or domain names of the computers used by users connecting to the LMS, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (success, error, etc.) and other parameters related to the operating system and the user's computer environment.

These data are used solely for the purpose of obtaining anonymous statistical information on the use of the LMS and to control its correct operation

Retention Period

Your personal data will be retained for the necessary time to fulfil contractual obligations as well as for the additional purposes and legal bases outlined above for a maximum period of 10 years from the termination of the contract, unless certain requirements justify further retention, such as the emergence of disputes. In this latter case, your personal data will be retained until the expiration of the statute of limitations for any legal actions.

Data voluntarily provided by you without the establishment of a contract with Rulex will be retained for 12 months before being deleted.

Recipients of personal data

The personal data provided by You may be communicated and made accessible, in accordance with the above purposes, to the following categories of persons:

• e-learning service provider (Litmos US, L.P. - privacy policy available at the following address: https://www.litmos.com/it-IT/privacy-policy).
• Rulex group companies,
• Italian and/or foreign supervisory authorities.
• other subjects for whom the current legal and/or contractual regulations provide for the obligation to communicate in compliance with the regulations for employers and/or in cases where communication must take place on the basis of a contractual relationship with Rulex.

The subjects who may eventually be recipients of Your personal data may process them as "Data processors" specifically appointed and instructed by Rulex or as "Autonomous data controllers" authorized to access them by virtue of legal, regulatory and/or normative provisions.

The contact details of external processors who carry out activities in the interest of Rulex can be requested by You at the following email address: gdpr@rulex.ai.

Transfer of personal data abroad

Rulex may transfer the personal data provided by You outside the European Economic Area (EEA). In order to protect Your personal data in the context of international transfers, Rulex will adopt appropriate guarantees, i.e. adequacy decisions of the European Commission under Article 45 GDPR, standard contractual clauses approved by the European Commission and contractual instruments that provide adequate guarantees (Article 46 GDPR); alternatively, transfers will take place in the presence of the exemptions provided for by Article 49 GDPR (i.e. consent of the data subject, necessity of the transfer for the purpose of contractual/pre-contractual measures, overriding public interest, right of defence in court, vital interests of the data subject or of other individuals, data entered into a public register).

Rights of the data subject

We inform you that as a data subject you can exercise all the rights provided for by Article 15 and following of the GDPR towards Rulex. In particular:

• right of access (Article 15 GDPR): confirmation that data processing concerning you is taking place and, if so, the right to obtain, among other things, access to your personal data and information regarding the purposes of the processing, the categories of personal data in question, the recipients, or categories of recipients to whom the personal data have been or will be communicated.
• right to rectification (Article 16 GDPR): rectification of inaccurate personal data concerning you without undue delay and completion of incomplete personal data concerning you.
• right to erasure (“right to be forgotten” Article 17 GDPR): erasure of personal data concerning you without undue delay.
• right to restriction of processing (Article 18 GDPR): restriction of processing in the cases provided for by Article 18 GDPR.
• right to data portability (Article 20 GDPR): receipt of your personal data in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance.
• right to object (Article 21 GDPR): the right to object to processing of personal data concerning you for direct marketing purposes and for processing based on legitimate interest or performance of a task in the public interest.
   

Exercise of rights and complaint to the data protection authority

To exercise the rights described above, you can contact the Data Controller by sending a formal request to the email address: gdpr@rulex.ai, attaching a document for identification.

You also have the right to submit a complaint to the supervisory authority under Article 77 of the GDPR, if you believe that the processing concerning you violates the provisions of the GDPR. In Italy, the supervisory authority is the Data Protection Authority (https://www.garanteprivacy.it).

Nature of data provision and consequences in case of non-provision

The provision of your personal data is optional. However, failure to communicate your personal data for the above purposes will make it impossible for Rulex to carry out and execute the contract.

For further information and/or clarification, please contact the Data Controller at the following email address: gdpr@rulex.ai.

Updates and modifications

Rulex reserves the right to modify, supplement or periodically update this information in compliance with applicable regulations or measures adopted by the Data Protection Authority. Therefore, we invite you to consult this page periodically.

Last update: February 2023