PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA
(Article 13, EU Regulation 2016/679 – “GDPR”)
1. Who is responsible for your data?
Controller: Maartje Wessels
Via Castello 1, 61030 Cartoceto (PU), Italy
Tel. +39 344 464 4555 | Email info@verbaperegrina.com
As a sole trader, I personally handle all processing described below. No Data Protection Officer (DPO) is required or appointed.
2. What personal data do I collect?
| Category | Typical items collected | Purpose |
|---|---|---|
| Identity & contact details | name, address, email, phone | enrolment, everyday communication, invoicing |
| Course details | language level, attendance, progress notes, exam results | delivering and improving the English course |
| Billing data | tax code / VAT number, payment details | issuing legally compliant invoices |
I do not collect special-category data (e.g. health) unless you volunteer it and it is strictly necessary (e.g. for learning accommodations).
3. Why and on what legal basis do I process your data?
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Running the English course, keeping academic records, issuing certificates | Contract – Art. 6 (1)(b) |
| Invoicing, accounting, tax compliance | Legal obligation – Art. 6 (1)(c) |
No automated decision-making or profiling is performed.
4. How do I process and protect your data?
Data are stored in locked paper files and on password-protected devices backed up to encrypted cloud storage. Only I (and, if strictly necessary, an IT technician bound by confidentiality) can access them.
5. Who else receives your data?
- No third parties normally receive your data.
- Exceptionally, accountants, banks or IT service providers may access data solely to perform services for me and only under written confidentiality agreements.
- Where required by law (e.g. tax audits) data may be disclosed to public authorities.
6. Do I transfer data outside the EEA?
Email, backup or invoicing services may be hosted outside the European Economic Area. When this happens I rely on:
- an EU adequacy decision (e.g. the EU–US Data Privacy Framework), or
- Standard Contractual Clauses approved by the European Commission,
to guarantee a GDPR-equivalent level of protection.
7. How long will I keep your data?
| Data set | Retention period |
|---|---|
| Course records & communications | 3 years after the course ends |
| Invoices & accounting documents | 10 years (Italian tax law) |
After these periods, data are securely deleted or anonymised.
8. Your rights
You may, at any time and free of charge:
- Access your data;
- Request rectification of inaccurate data;
- Request erasure (“right to be forgotten”) where legally possible;
- Restrict or object to processing;
- Request portability of data you provided on the basis of contract.
Simply write to info@verbaperegrina.com. I will reply within one month.
9. Complaints
If you believe your data have been processed unlawfully, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority in the EU country where you live or work.
Last updated: 2 May 2025.