PRIVACY POLICY – QLEARNING (QIBLI S.R.L.)

1. Data Controller

The Data Controller is Qibli S.r.l., with registered office at Via Pagagini, 50 – 74023 Grottaglie (TA), email: info@qibli.it.

2. Persons Authorized to Process Data

The processing of personal data is carried out by personnel authorized by the Data Controller pursuant to Art. 29 of Regulation (EU) 2016/679 and by entities appointed as Data Processors pursuant to Art. 28 of the GDPR.

3. Data Protection Officer (DPO)

The Data Controller is not subject to the obligation to appoint a Data Protection Officer (DPO) pursuant to Art. 37 of Regulation (EU) 2016/679.

4. Types of Data Processed

• Personal details (first name, last name, date of birth, tax code)
• Contact details (email, telephone number, address)
• Professional data (profession, academic background, registration with professional associations/boards)
• Tax data (VAT number, billing address)
• Platform usage data (logs, access times, activities)
• Data related to CME (Continuing Medical Education) training:
  • tracking of educational activities
  • completion/usage times
  • learning tests and results
  • training credits earned

5. Purposes of Processing and Legal Basis

a) Provision of Courses and Account Management

Purpose: registration, access, and course participation
Legal basis: performance of a contract

b) CME (Continuing Medical Education) Requirements

Purpose: management of training credits, activity tracking, and transmission of data to competent authorities
Legal basis: legal obligation

Recipients: AGENAS (National Agency for Regional Health Services) and the Ministry of Health

c) Administrative and Tax Obligations

Purpose: billing and accounting
Legal basis: legal obligation

d) Security and Fraud Prevention

Purpose: platform protection and prevention of unauthorized access
Legal basis: legitimate interest

e) Marketing

Purpose: sending promotional communications relating to courses and services offered
Legal basis: user consent

The provision of data for marketing purposes is optional, and failure to provide consent does not affect the delivery of the service. Consent may be revoked at any time.

6. Processing Methods

Processing is carried out using computer and electronic tools, with technical and organizational measures suitable to ensure the security, integrity, and confidentiality of personal data.

7. Data Retention

• CME Data: retained for 5 years in compliance with regulatory obligations
• Administrative and tax data: retained in accordance with the terms provided by current legislation
• Data processed for marketing purposes: retained until consent is revoked

At the end of the retention periods, data will be deleted or anonymized.

8. Communication and Transfer of Data

• AGENAS