Privacy policy

Information on the processing of personal data
pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)

Percorsi di Crescita SAS, ImpulsoFuturo
Last updated: May 2026

1. Data Controller

Percorsi di Crescita SAS, operating under the brand ImpulsoFuturo.

Registered office: Via Gerardo dei Tintori 16, Biassono (MB)
VAT no.: 02789550130
Email: isabellaflecchia@impulsofuturo.it

For any communication relating to the processing of personal data, the data subject may write to the Data Controller at the email address above.

2. Data processed, purposes and legal bases

The Data Controller processes personal data in the following situations and for the following purposes.

2.1 Browsing the website

While the website impulsofuturo.it is being browsed, technical data (IP address, browser type, pages visited, length of visit) are collected automatically by means of statistical analysis tools.

Purpose: anonymous statistical analysis of traffic, improvement of the website.
Legal basis: legitimate interests of the Data Controller (Art. 6(1)(f) GDPR).
Retention: in accordance with the policies of the tools used; aggregated data are not retained for more than 26 months.

2.2 Contact by email, form or telephone

When the data subject contacts the Data Controller through the website form, by email or by telephone, the data provided (first name, surname, email, telephone, content of the message) are processed.

Purpose: replying to the request and managing the preliminary relationship.
Legal basis: performance of pre-contractual measures at the request of the data subject (Art. 6(1)(b) GDPR).
Retention: for the time necessary to handle the request and, if no relationship is started, for no more than 12 months.

2.3 Provision of consultancy and coaching services

In the course of business coaching, team coaching and organisational consultancy programmes, the Data Controller processes data relating to clients who are natural persons and to the natural persons named by corporate clients (managers, programme participants):

• identification and contact data (first name, surname, email, telephone, role in the company);
• professional and organisational information shared during the programme;
• session notes, reflections, objectives and progress in the programme.

Purpose: delivery of the contractually agreed service.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR); for data provided by corporate clients, legitimate interests in delivering the service (Art. 6(1)(f) GDPR).
Retention: for the whole duration of the contractual relationship and for the 10 years following its conclusion, in compliance with civil-law and tax obligations.

2.4 Skills assessment

In the course of assessment and skills evaluation activities, data may be processed relating to the professional profile, to behavioural and relational skills, and to the results of assessment tools.

Purpose: delivery of the assessment service and communication of the results to the commissioning party and/or to the assessed person.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR); for data sent by third-party organisations, legitimate interests (Art. 6(1)(f) GDPR).
Retention: for the duration of the relationship and for 5 years after its conclusion, unless otherwise agreed in the contract.

Note: assessment reports containing individual profiles are handled with particular confidentiality. They are not shared with third parties without the explicit consent of the assessed person, unless the contract with the commissioning party provides otherwise and the data subject has been informed of this.

2.5 Participation in courses, webinars and events

In connection with training courses, webinars, workshops and other events organised by the Data Controller, the following are processed:

• identification and contact data for managing registrations;
• participation data (attendance, certificates);
• materials produced during training activities.

Purpose: organisation and management of the event, issue of certificates, administrative obligations.
Legal basis: performance of the contract or of pre-contractual measures (Art. 6(1)(b) GDPR); for publicly funded events (e.g. ESF), legal obligation (Art. 6(1)(c) GDPR).
Retention: for the duration of the relationship and for the 10 years following, in compliance with legal obligations; for ESF events, within the timeframes prescribed by the funding programme.

2.6 Photographs and video recordings during events

During events, courses and workshops, photographs and video recordings may be made, which may be used for institutional communication and on the Data Controller’s social media channels.

Purpose: documentation and promotion of the Data Controller’s activities.
Legal basis: explicit consent of the data subject (Art. 6(1)(a) GDPR), collected by means of a specific release form before the event.
Retention: up to 10 years, unless consent is withdrawn. In the event of withdrawal, images that have already been made public may not be fully removable.
Withdrawal of consent: the data subject may withdraw consent at any time by writing to the Data Controller. Withdrawal does not affect the lawfulness of the processing carried out before the withdrawal.

2.7 Commercial communications and newsletters

With prior explicit consent, the Data Controller may send informational communications about its services, articles, events and free resources.

Purpose: information about, and promotion of, the Data Controller’s services.
Legal basis: consent (Art. 6(1)(a) GDPR).
Retention: until consent is withdrawn or the data subject is removed from the list.
Withdrawal: at any time, through the unsubscribe link in every communication or by writing to the Data Controller.

2.8 Use of artificial intelligence tools

In the course of delivering its services, the Data Controller may use tools based on artificial intelligence (AI) to support design, documentation and professional reflection.

General principle: the Data Controller does not enter clients’ personally identifiable data into third-party AI tools without prior explicit consent. In particular:

• session notes and materials containing clients’ personal data are not uploaded to external AI platforms;
• any processing by means of AI is carried out on anonymised or aggregated data, or on content produced directly by the Data Controller;
• where the Data Controller uses AI tools to produce materials intended for a specific client (e.g. reports, personalised training programmes), the Data Controller will inform that client;
• data are not used to train third-party AI models.

The AI tools currently in use, or that may potentially be used, include services offered by European providers or by non-EU providers that guarantee adequate data protection measures (Standard Contractual Clauses or equivalent). The list of tools is available on request.

Note: legislation on AI and data protection is evolving rapidly (EU AI Act, Regulation 2024/1689). The Data Controller undertakes to update this section in line with regulatory developments.

3. Disclosure of data to third parties

Personal data may be disclosed to:

• Processors: external parties that provide services ancillary to the Data Controller’s activity (e.g. hosting and email providers, webinar platforms, management software, administrative and tax advisers). These parties act as processors pursuant to Article 28 GDPR and are bound by specific contractual instructions.
• Public authorities: in the cases provided for by law (judicial authorities, the Italian Revenue Agency, social security bodies, etc.).
• Funding bodies: in the case of funded training (e.g. ESF, interprofessional funds), participants’ data may be transmitted to the body providing the funding, within the limits of what the applicable legislation provides.

Data are not sold or transferred to third parties for those third parties’ own purposes.

4. Transfers outside the European Economic Area

Some tools used by the Data Controller (e.g. cloud platforms, AI tools) may involve the transfer of data to countries outside the EEA. In such cases the Data Controller ensures that the transfer takes place in compliance with Articles 44 to 49 GDPR, where there is:

• an adequacy decision of the European Commission, or
• Standard Contractual Clauses approved by the European Commission, or
• other appropriate safeguards provided for by law.

Specific information on transfers is available on request.

5. Automated decision-making and profiling

Data subjects’ personal data are not subject to solely automated decision-making or to profiling within the meaning of Article 22 GDPR.

Any AI tools used support the Data Controller’s work but do not replace human judgement in decisions concerning people.

6. Rights of the data subject

Pursuant to Articles 15 to 22 of the GDPR, the data subject has the right to:

• Access (Art. 15): obtain confirmation of the processing and a copy of the data.
• Rectification (Art. 16): correct inaccurate data or complete incomplete data.
• Erasure / right to be forgotten (Art. 17): obtain erasure of the data, in the cases provided for by law.
• Restriction of processing (Art. 18): obtain restriction in certain cases.
• Portability (Art. 20): receive their data in a structured and readable format, where the processing is based on consent or contract and is carried out by automated means.
• Objection (Art. 21): object to processing based on legitimate interests.
• Withdrawal of consent: at any time, without prejudice to the lawfulness of the earlier processing.

Requests may be sent to: isabellaflecchia@impulsofuturo.it

The Data Controller replies within 30 days of receipt (a period that may be extended by a further 60 days in cases of particular complexity).

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of the Member State in which they reside or habitually work.

7. Data security

The Data Controller adopts appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or unlawful disclosure, in accordance with Article 32 GDPR. These measures include, among other things, encryption of communications, controlled management of access and training of the persons authorised to process data.

8. Updates to this privacy notice

The Data Controller reserves the right to update this privacy notice in the event of legislative, technological or operational changes. The updated version will be published on the website with an indication of the revision date. For substantial changes that affect the rights of data subjects, the Data Controller will give direct notice where possible.

Date of entry into force: May 2026