PRIVACY NOTICE

pursuant to Articles 13–14 of EU Regulation No 679/2016 (GDPR)

www.goodlearning.it

1. Data Controller

The Data Controller is Goodlearning S.r.l. (hereinafter also referred to simply as ‘Goodlearning’ or ‘Controller’). For any enquiries regarding the processing of personal data, you may contact the Data Controller at the addresses indicated above.

2. Purposes and legal basis of the processing

The Data Controller processes the personal data of users visiting the website www.goodlearning.it (hereinafter the “Website”) for the following purposes:

2.1 Website navigation (browsing data)

The IT systems and software procedures used to operate the Website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.

This category includes: IP addresses, browser type, operating system, domain name of the website from which the user originates, pages visited and time of visit.

Legal basis: legitimate interest of the Data Controller (Article 6(1)(f) of the GDPR) for the management and security of the Website.

2.2 Contact and information requests

If the user submits a request via the contact forms or by email, the Data Controller processes the data provided (name, email address, message) to respond to the request and, where applicable, to fulfil pre-contractual obligations.

Legal basis: implementation of pre-contractual measures at the data subject’s request (Article 6(1)(b) of the GDPR) and the Data Controller’s legitimate interest.

2.3 Registration on the GoodSuite platform

The data provided during registration on the platform (first name, surname, email address, company details) is processed to activate and manage the service contract, ensure access to the platform and fulfil contractual and legal obligations.

Legal basis: performance of the contract (Article 6(1)(b) of the GDPR) and legal obligations (Article 6(1)(c) of the GDPR).

2.4 Marketing and commercial communications

Subject to the user’s express consent, the Data Controller may send promotional communications relating to its products and services via email or other digital channels.

Legal basis: consent of the data subject (Article 6(1)(a) of the GDPR). Consent may be withdrawn at any time.

3. Cookies and third-party tools

The Website uses cookies and similar technologies. The types of cookies used and the relevant third-party tools in use are described below.

3.1 Technical and session cookies

These are strictly necessary for the functioning of the Website and do not require the user’s consent. They are used to manage the browsing session and store the user’s preferences (e.g. language, cookie acceptance).

3.2 Google Analytics

The Website uses Google Analytics, a web analytics service provided by Google LLC (based in the USA). Google Analytics collects information on the use of the Website (pages visited, session duration, approximate geographical location, device type and browser) via third-party cookies.

The Data Controller has enabled IP anonymisation (IP anonymisation/masking), so that the last octet of the IP address is removed prior to any processing. The data collected is not used to identify individuals.

Provider: Google LLC

  • Service
    • Google Analytics 4 (GA4)
  • Data processed
    • Anonymised IP address, pages visited, session duration, device/browser data, approximate geographical location
  • Purpose
    • Statistical analysis of website usage
  • Legal basis
    • Consent of the data subject (Art. 6(1)(a) GDPR)
  • Transfer outside the EU
    • Yes – USA, with safeguards under the EU-US Data Privacy Framework
  • Retention period
    • 26 months (GA4 default setting)
  • Opt-out
  • Google Privacy

3.3 Vimeo (video in iframe)

The Website embeds videos via iframes provided by Vimeo LLC (based in the USA). When a user accesses a page containing a Vimeo video, the user’s browser establishes a direct connection with Vimeo’s servers, which may collect personal data such as the IP address, browser and device information, as well as data relating to video playback.

The Data Controller uses Vimeo’s ‘Do Not Track’ mode (parameter dnt=1 in the embed URL), which prevents Vimeo from tracking the viewing activities of users who are not registered with Vimeo.

Provider: Vimeo LLC

  • Service
    • Vimeo Player (iframe embed)
  • Data processed
    • IP address, browser/device data, video playback activity
  • Purpose
    • Playback of video content on the Website
  • Legal basis
    • Legitimate interest of the Data Controller / consent of the data subject
  • Transfer outside the EU
    • Yes – USA, with safeguards under the EU-US Data Privacy Framework
  • Retention
    • In accordance with Vimeo’s policies
  • Vimeo Privacy Policy

To manage their cookie preferences, users may use the cookie banner displayed on the Website upon their first visit or their browser settings.

4. Recipients of the data

Personal data may be disclosed, to the extent strictly necessary, to the following categories of recipients:

Technology and infrastructure service providers (hosting, cloud, LMS platform) appointed as data processors pursuant to Article 28 of the GDPR;

Web analytics service providers (Google LLC – Google Analytics);

Video hosting service providers (Vimeo LLC);

Professionals and consultants (legal, tax, accounting) bound by confidentiality obligations;

Public authorities and courts, in the cases provided for by law.

Data is not sold, transferred or disclosed to third parties for their own marketing purposes.

5. Transfer of data to third countries

Some service providers used by the Website (in particular Google LLC and Vimeo LLC) are based in the United States of America. The transfer of data to these entities takes place in accordance with the safeguards provided for by the GDPR, in particular on the basis of the EU–US Data Privacy Framework adopted by the European Commission by means of the adequacy decision of 10 July 2023 (Article 45 of the GDPR).

You may request further information on the safeguards adopted by contacting the Data Controller at the addresses indicated in point 1.

6. Data retention period

The types of data and their respective retention periods are set out below:

  • Browsing data (logs)
    • 12 months from collection
  • Contact requests
    • 24 months from the last interaction
  • Contractual data (GoodSuite)
    • 10 years from the termination of the contract (tax obligations)
  • Marketing data (with consent)
    • 24 months from consent or until withdrawal
  • Google Analytics data
    • 26 months (GA4 setting)

Once the specified periods have elapsed, the data is deleted or irreversibly anonymised.

7. Rights of data subjects

As a data subject, you have the right to:

  • Access (Art. 15 GDPR): obtain confirmation as to whether personal data concerning you is being processed and request a copy thereof;
  • Rectification (Art. 16 GDPR): obtain the correction of inaccurate data or the completion of incomplete data;
  • Erasure (Art. 17 GDPR): to have your data erased, in the cases provided for by law;
  • Restriction of processing (Art. 18 GDPR): to have processing restricted in certain cases;
  • Portability (Art. 20 GDPR): to receive your data in a structured, commonly used format, where technically feasible;
  • Objection (Art. 21 GDPR): to object to processing based on legitimate interest;
  • Withdrawal of consent (Art. 7(3) GDPR): to withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal;
  • Complaint (Art. 77 GDPR): lodge a complaint with the Data Protection Authority (www.garanteprivacy.it).

Requests may be sent to the Data Controller by email to support@goodlearning.it or via certified email (PEC) to goodlearning@legalmail.it. The Data Controller will respond within 30 days of receiving the request.

8. Minors

The Website and the GoodSuite platform are not intended for minors under the age of 16. The Data Controller does not knowingly collect personal data from minors under the age of 16. Should such data be collected in error, the Data Controller will ensure its immediate deletion.

9. Updates to this policy

The Data Controller reserves the right to amend this policy at any time, in particular following regulatory changes or modifications to the Website’s functionality. Any changes will be published on the Website, indicating the date of the last update. Users are therefore invited to consult this page periodically.

Last revised: May 2026