Privacy

Privacy policy in accordance with Art. 13 of European Data Protection Regulation no. 2016/679

This page describes how the website is managed with regard to the processing of the personal data of users who consult it. Users’ personal data will be processed in accordance with applicable law, with particular reference to EU Regulation 2016/679 and to Italian laws and regulations (hereinafter the “Applicable Privacy Legislation”). This notice is provided to those who interact with the web services accessible electronically from the address: www.ied.edu.

This notice applies only to the website indicated above and not to any other websites the user may visit through links.

Pursuant to Article 13 of the General Data Protection Regulation (EU) 2016/679 on the protection of personal data, we inform you that the data collected will be processed by:

  • ISTITUTO EUROPEO DI DESIGN S.p.A. Società Benefit,
  • I.L.E.M. S.r.l.,
  • ISTITUTO EUROPEO DI DESIGN SL (hereinafter “IED Spain”)
  • KUNSTHAL CENTRO SUPERIOR DE DISEÑO SL (hereinafter “KUNSTHAL IED”)
  • ISTITUTO EUROPEO DI DESIGN – ESCOLA LTDA. – EPP (hereinafter “IED Brazil”), ISTITUTO EUROPEO DI DESIGN-BRASIL (also “IED RIO”) and ISTITUTO EUROPEO DI DESIGN – SÃO PAULO (IED-SÃO PAULO) (also “IED São Paulo”)

as independent Data Controllers, in compliance with applicable law. The updated list of internal and external processors is available from the Data Controllers.

Each independent Data Controller carries out the processing relating to the courses for which it is responsible: the entity that delivers the course, and is therefore the controller of the data processed, is indicated in the information sheet of the course itself.

As operator of the website, Istituto Europeo di Design SpA collects the data of those interested in the courses and transfers it to the data processors, responding to users’ requests for information and/or proceeding with enrolments.

In light of the above, the user is informed that the Data Controllers for each area are the following:

  • ISTITUTO EUROPEO DI DESIGN S.p.A. Società Benefit, with registered office in Milan, Via Bezzecca 5, represented by its legal representative pro tempore.
  • I.L.E.M. S.r.l., with registered office in Como, Via Petrarca 9, represented by its legal representative pro tempore.
  • ISTITUTO EUROPEO DI DESIGN SL, with registered office at C/ Flor Alta 8, Madrid 28-MADRID, represented by its legal representative.
  • KUNSTHAL CENTRO SUPERIOR DE DISEÑO SL, with registered office at c/ Ribera de Deusto, 17 48014 Bilbao (Vizcaya), represented by its legal representative.
  • ISTITUTO EUROPEO DI DESIGN – ESCOLA LTDA. – EPP, with registered office at R Maranhao, Andar 9, CJ.93, São Paulo, represented by its legal representative.
  • ISTITUTO EUROPEO DI DESIGN-BRASIL, with registered office at Av. Joao Luis Alves, Rio De Janeiro, represented by its legal representative.
  • ISTITUTO EUROPEO DI DESIGN – SÃO PAULO (IED-SÃO PAULO), with registered office at R Maranhao, Andar 9, CJ.93, São Paulo, represented by its legal representative.

The Data Protection Officer for the processing carried out by Istituto Europeo di Design S.p.A. Società Benefit and I.L.E.M S.r.l. is Ecoconsult S.r.l., based in Milan, Via Carlo Goldoni, 1, who can be contacted at dpo@ied.it.

The Data Protection Officer for the processing carried out by ISTITUTO EUROPEO DI DESIGN SL and KUNSTHAL CENTRO SUPERIOR DE DISEÑO SL is Áudea Seguridad de la Información S.L., based at Calle Ribera del Loira, 38, Madrid, who can be contacted at dpo@ied.es.

The rights set out in Articles 15–22 of the Regulation, including the erasure of data or objection to its use, may be exercised at any time by sending an email to privacy@ied.it.

Types of data processed

Browsing data: During their normal operation, the IT systems and software procedures used to run this website acquire certain personal data whose transmission is implicit in the use of Internet communication protocols. By their nature, this information could, through association and processing with data held by third parties, allow users/visitors to be identified (e.g. IP addresses, domain names of the computers used by users/visitors connecting to the website, etc.). This data is used only for statistical information (and is therefore anonymous) and to check that the website is working correctly. No data deriving from the web service will be communicated or disseminated. The data may be used to establish liability in the event of possible computer crimes against the website; except in this case, data on web contacts is currently not kept for more than seven days.

Data provided voluntarily by the user: Except as specified for browsing data, users/visitors are free to provide their personal data through the contact forms on the website. The personal data provided (first name, last name and email address) will be processed exclusively to respond to the user’s requests, or to provide a specific service. Failure to provide the data in the fields marked with an asterisk may make it impossible to use the service offered. Specific summary notices will be progressively included or displayed on the pages of the website set up for particular on-demand services.

Cookies: The full notice on the processing of data through the website’s cookies is available at the following link.

Data collected through tracking tools in email communications (pixels and tracking links): In marketing email communications (for example newsletters, invitations to Open Days and events, information on courses and enrolment), the Data Controllers may use pixels and tracking links. These are small invisible images or strings of code that, when the message is opened or a link is clicked, allow the collection of technical information such as receipt and opening of the email, the date and time of opening, the links clicked and other interactions with the content. These tools are activated only for users who have given specific consent to tracking, separate from their consent to receive marketing communications. Without such consent, emails are sent without active tracking tools.

Legal basis and purposes of processing

The General Data Protection Regulation confirms that all processing must be based on an appropriate legal basis. The legal grounds for processing are consent, performance of contractual obligations, vital interests of the data subject or of third parties, legal obligations to which the controller is subject, public interest or the exercise of official authority, and the overriding legitimate interest of the controller or of third parties to whom the data is disclosed.

In particular, each Data Controller collects and processes Users’ personal data for the following purposes:

a) Responding to Users’ requests. Use of the user’s personal data to respond to requests sent by Users through the Website.

b) Sending marketing communications. With prior consent, the Data Controllers may send the User newsletters and informational and promotional communications about courses, enrolment, Open Days, events and IED initiatives. Legal basis: the User’s consent (Article 6(1)(a) of the Regulation). Consent is optional, and not giving it does not prevent the User from receiving a reply to their requests. Withdrawal: the User may withdraw consent at any time through the link at the bottom of each email or by writing to privacy@ied.it.

c) Analysis of interaction with marketing email communications. If the User has given consent to tracking, the Data Controllers use the information collected through pixels and tracking links to understand whether the newsletters and communications sent are of interest to the User. This makes it possible to send content relevant to the courses, subject areas, campuses and events the User is interested in (for example Open Days, workshops and course presentations) and to adjust how often messages are sent. Legal basis: the User’s consent to tracking (Article 6(1)(a) of the Regulation and Article 122 of the Italian Privacy Code, Legislative Decree 196/2003). Consent is optional, and not giving it does not prevent the User from receiving communications. Withdrawal: the User may withdraw consent to tracking at any time, while continuing to receive communications, through the link at the bottom of each email. The link allows the User to disable tracking or to unsubscribe from communications. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Recipients

In addition to the Data Controllers, categories of processors and authorised persons involved in the organisation of the Website may have access to the data. The Data Controllers may also use external parties (such as third-party technical service providers, hosting providers, cloud services and IT companies), which may be appointed as external processors. The updated list of processors may be requested from the Data Controllers at any time. The data processed by the Data Controllers will not be disseminated.

Transfer of data to third countries

The General Data Protection Regulation requires data subjects to be informed if the data concerning them is transferred to third countries (countries outside the EU or the European Economic Area: Norway, Iceland, Liechtenstein) or to international organisations.

The Data Controllers inform data subjects that they do not transfer data to third countries. In any case, should it become necessary, the Controller may also transfer the data to countries outside the European Union or the European Economic Area that are recognised by the European Commission as ensuring an adequate level of personal data protection or, otherwise, only if a level of personal data protection adequate to that of the European Union is contractually guaranteed and the exercise of data subjects’ rights is ensured.

Data retention

The data collected for the purposes indicated above will be kept for the time necessary to carry out the operations for which it is acquired. The retention period will be determined based on the assessment of each individual operation and will in any case comply with the principles of necessity, purpose limitation, relevance and data minimisation set out in the Regulation.

Processing methods

Processing is carried out using automated tools (e.g. electronic procedures and media) and/or manually (e.g. on paper) for the time strictly necessary to achieve the purposes for which the data was collected and, in any case, in accordance with the applicable legal provisions.

Exercising your rights

Under the Applicable Privacy Legislation, Users have the right to:

  • be informed of the purposes and methods of the processing of their personal data;
  • access their personal data;
  • obtain a copy of their personal data, where it is stored in countries outside the European Union, and obtain information on the place where such personal data is stored or transferred;
  • request the rectification, updating or completion of their personal data;
  • request the erasure, anonymisation or blocking of the processing of their personal data;
  • object, in whole or in part, to any processing carried out through automated decision-making, including profiling;
  • withdraw their consent to processing, where given, freely and at any time. Withdrawal of consent does not affect the lawfulness of processing based on the consent given before its withdrawal;
  • contact the Controller’s Data Protection Officer;
  • lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali);
  • data portability, i.e. the right to receive their personal data in a structured, commonly used and machine-readable format, and to transmit it to another controller freely and without hindrance, where applicable;
  • request the restriction of the processing of their personal data, where applicable.

The rights set out in Articles 15–22 of the Regulation, including the erasure of data or objection to its use, may be exercised at any time by sending an email to privacy@ied.it.

Complaints

A complaint regarding the processing may be lodged with the competent Authority:

Garante per la protezione dei dati personali (Italian Data Protection Authority) Piazza di Monte Citorio n. 121 00186 ROME Fax: (+39) 06.69677.3785 Switchboard: (+39) 06.696771 Email: garante@gpdp.it

Changes and updates

This Policy has applied since 25/05/2018 and was last updated on 28/10/2026.