Privacy policy

Privacy policy in accordance with Art. 13 of European Data Protection Regulation no. 2016/679

In compliance with Section 13 13 of European Data Protection Regulation no. 2016/679 (hereinafter also “GDPR”) setting provisions about data protections, we inform you that your collected data will be processed by:

• I.L.E.M. S.r.l.,
• ISTITUTO EUROPEO DI DESIGN SL (hereinafter also “IED Spain”)

as independent Data Controllers, in compliance with applicable laws. The updated list of internal and external data processors is available from the Data Controller, where required by applicable laws.

Each independent Data Controller carries out the processing of personal data as related to each respective Courses of competence: the specific indication of the organisation providing the Course, and therefore act as the Data Controller of the processed Personal Data, is described in the Course privacy policy of the Course for which the Data Subject is asking for contact/interview/enrolment.

The processing of Personal Data collected through the website form will be carried out in full respect of confidentiality, fairness, lawfulness and transparency principles also by using electronic and/or automated means and will be exwcuted for the folloqing purposes:
1. provide execution to the request for contact / interview / registration made by the Data Subject from the website page, send requests for customer satisfaction surveys with respect to the requested service;
2. To send promotional and advertising materials related to the Data Controllers as they are part of IED Group, also through external companies, duly identified as Data Processors, which may result suitable for such a purpose;
3. To send to Data Subject, even through external and unrelated companies compared to the Data Controller, promotional and advertising materials as related to any kind of service eventually supplied by third parties, to be proposed to their users, with whom the Data Controller may have stipulated business/commercial agreements.

Data voluntarily provided by the Data Subject.
Without prejudice to what have been specified for navigation/browsing data, users / Data Subject are free to provide their personal data through the contact forms on the website. The Personal Data provided (name, surname, e-mail address, telephone number and other personal and residence / domicile indications) will be processed exclusively to respond to the requests of the Data Subject, or for the provision of a specific service or to also submit, even through questionnaires, surveys on the degree of satisfaction with respect to the services provided. Failure to provide data relating to fields marked with an asterisk may make it impossible to use the service offered.
The data provided with the questionnaires, or the answers provided during compilation, are collected by the Data Controller for the purposes indicated above. These data are not collected to be associated with identified Data Subjects. The Data Controller, in any way and for no reason, will perform data interconnection operations in order to trace the identity of the user / Data Subject through processing and association with other data eventually held. However, it should be noted that by virtue of the answer to particular profile questions (such as the origin, the school or the structure to which it belongs), which could significantly restrict the number of subjects, it may be possible to identify, even if involuntarily, the Data Subject.
The data provided and recorded within the software in use by the Data Controller, or this information automatically recorded by, or at, the software used for the online compilation of the questionnaires (such as the e-mail address, the compilation of the questionnaire, the date and time of the operation) are collected and processed for the sole purpose of allowing the sending, even automatically, to the Data Subject of the request to fill in the questionnaires / satisfaction surveys.

Legal basis of the processing.
The GDPR provides that each data processing must be based on specific principles of lawfulness. The basis of lawfulness of the processing are, among others, consent, fulfilment of contractual obligations, vital interests of the person concerned or of third parties, legal obligations to which the data controller is subject, public interest or exercise of public powers, prevailing legitimate interest of the data controller or of third parties to whom the data are communicated.
In particular, the legal basis on which the processing described in point 1 are based is (i) the need to respond to the request sent through the form and the legitimate interest of the Data controller to improve its services, as well as (ii) pursuant combined provisions of Recital 47 to the GDPR and art. 6.1.f of the same GDPR, the legitimate interest of the Data Controller to improve its services to the extent that they are, or have been, provided to the Data Subject / user upon his request.
The legal basis on which the processing described at the remaining points 2 and 3 is the Data Subject express consent.

Data retention period.
The data provided through the website forms will be kept only for the management of the request referred to in point 1 and for the possible submission of questionnaires / surveys about satisfaction re service offered. In the case of consent referred to in points 2 and 3, Personal Data will be kept up to cancellation request.
With the exception of the purpose of point 1, authorizations to data processing for the purposes set out above are optional and pursued only with consent to the processing of data.
In the light of the foregoing, Data Subject is informed bout the fact that the Data Controllers for each area are the following:
• ISTITUTO EUROPEO DI DESIGN S.p.A., with registered office in Milano, Via Bezzecca 5, in the person of its legal representative pro tempore.
• I.L.E.M. S.r.l.,with registered office in Como, Via Petrarca 9, in the person of its legal representative pro tempore.
• ISTITUTO EUROPEO DI DESIGN SL, with registered office in C/ Flor Alta 8, Madrid 28-MADRID, in the person of its legal representative pro tempore.
• ISTITUTO EUROPEO DI DESIGN – ESCOLA LTDA. – EPP, with registered office in R Maranhao, Andar 9, CJ.93, São Paulo, in the person of its legal representative pro tempore.
• KUNSTHAL CENTRO SUPERIOR DE DISEÑO SL, with registered office in c/ Ribera de Deusto, 17 48014 Bilbao (Vizcaia), iin the person of its legal representative.
• ISTITUTO EUROPEO DI DESIGN-BRASIL, with registered office in Av. Joao Luis Alves, Rio De Janeiro, in the person of its legal representative pro tempore.
• ISTITUTO EUROPEO DI DESIGN – SÃO PAULO (IED-SÃO PAULO), with registered office in R Maranhao, Andar 9, CJ.93, São Paulo, in the person of its legal representative pro tempore.

In addition to the Data Controllers, categories of Data Processors and authorized persons involved in the company organization of the Site may have access to the Data. In addition, the Data Controllers may make use of external subjects (such as suppliers of third party providing technical services, hosting providers, cloud services, IT companies) that may be appointed as external Data Processors. The updated list of Data Processors can always be requested from the Data Controllers. The data processed by the Data Controllers will not be disclosed.

Data Transfer to third countries.
The GDPR provides for the obligation to inform Data Subjects in the case of transfer of data concerning them to third countries (not belonging to the EU or to the European Economic Area: Norway, Iceland, Liechtenstein) or to international organizations .
The Data Controllers hereby inform the Data Subjects that communications and / or data transfers to third countries could be made, especially only if a request is made through the pages of the website in consideration of the Data Subject expression of interest to be informed about a course managed by the Data Controllers IED Brazil, IED Sao Paulo and IED Rio and / or to be enrolled by the same and / or to conduct interviews with them.

Data Protection Officer.
The Data Protection Officer, in relation to data processing carried out by IED Istituto Europeo di Design S.p.A. and I.L.E.M S.r.l. is Ecoconsult S.r.l., with registerd office in Milan, Via Goldoni, 1, which can be contacted at

Exercise of rights and complaints.
At any time you can exercise your rights under articles 15-22 of the Regulations, including the erasure of data or objection to their use, by sending an email to being understood that, in such a case, the Data Controller may not be in a position to provide you with the requested services and/or to give execution to performances requested by the Data Subject
To exercise your rights within the Data Controllers IED Spain, Kunsthal IED, IED Rio, IED Sao Paulo and IED Brazil you must refer to the privacy policies published on their websites.
The Data Subject can submit a complaint about data processing of personal data refering to him/her in front of the competent data protection authority:

Garante sulla Protezione dei Dati personali
Piazza di Monte Citorio n. 121
00186 ROMA
Fax: (+39) 06.69677.3785
Phone: (+39) 06.696771

Modification and updates
This policy is applicable from 25/05/2018 and has been updated on 27/01/2019.