Privacy notice.
Under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Version 2026-10-v1 of 9 October 2026. The Italian version prevails in case of doubt.
1. Who processes your data
The data controller is Well-Tec S.a.s. di Mario Vella & C., VAT IT06655120480, Via del Ronco Corto 13C, 50143 Florence, Italy, which runs EMS Training Academy ("the Academy"). For any privacy matter write to info@emstrainingacademy.com.
2. What data we process, why and on what legal basis
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| You ask for the Level I programme or the free guide, or join the Levels II and III waiting list | Name, email, role, country, language, what you asked for | Sending you what you asked for, telling you when the course opens or the level is available, up to three emails in the following ten days about the content you requested | Pre-contractual steps at your request (Art. 6.1.b) |
| You subscribe to the newsletter | Name, email, role, country, language, date of consent | Sending you one email a month on EMS Training and course news | Your consent (Art. 6.1.a), which you can withdraw at any time |
| You write to us via the contact form or register interest in an event | Name, email, country, subject, message | Replying to you | Your request (Art. 6.1.b) |
| You enrol on a course and pay | Personal and billing details, payment details provided by PayPal, exam result | Delivering the course, exam, certificate and licence; tax and accounting obligations | Contract (Art. 6.1.b) and legal obligations (Art. 6.1.c) |
| You obtain a certificate | Full name, certificate number, level, issue and expiry dates | Allowing anyone who has the certificate number to check its validity on this site | Contract (Art. 6.1.b): verifiability is part of the certification |
| You submit a form | Date, time and version of the notice you confirmed | Being able to prove consent and the information given | Legitimate interest (Art. 6.1.f) |
| You ask not to be contacted again | Respecting your request in the future too ("do not contact" list) | Legal obligation and legitimate interest (Arts. 6.1.c and 6.1.f) | |
| You browse the site | IP address and technical connection data logged by the hosting provider | Site security and operation | Legitimate interest (Art. 6.1.f) |
For email requests we ask you to confirm your address through a link (double opt-in). We do not make solely automated decisions about you and we do not sell your data.
3. Health data
The site's forms do not ask for health data: please do not include it in your messages.
4. Who we share data with
- Technical providers appointed as processors (Art. 28 GDPR): Cloudflare (site hosting and network), Brevo (email sending and subscription management), Airtable (contact and request records), Google (email).
- PayPal, which processes payment data as an independent controller under its own privacy notice.
- Tax and professional advisers and public authorities, when the law requires it.
5. Transfers outside the European Economic Area
Some providers (for example Cloudflare, Airtable and Google) may also process data in the United States. Transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses.
6. How long we keep data
- Programme, guide and waiting-list requests: up to 24 months from the last contact, unless you enrol on a course.
- Newsletter: until you withdraw consent.
- Contact-form messages: up to 24 months from the last exchange.
- Course, enrolment and payment data: 10 years, as required by tax rules.
- Certificate register: for the whole validity of the licence and up to 10 years after expiry, to allow verification.
- "Do not contact" list: as long as needed to respect your request.
- Technical browsing data: for the short period set by the hosting provider.
7. Your rights
You can ask at any time for access to your data, rectification, erasure, restriction and portability, and object to processing based on legitimate interest. You can withdraw newsletter consent with one click from the link in every email, without affecting earlier processing. To exercise your rights write to info@emstrainingacademy.com: we reply within one month. You can also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of your country.
8. Providing data and minors
Providing the data requested in the forms is optional, but without it we cannot send you what you asked for. The newsletter is always optional. The site's services are intended for adults.
9. Cookies
The site does not use profiling cookies or analytics or advertising tools. See the cookie policy for details.
10. Updates
This notice may be updated. The version in force is the one published on this page, with the date shown at the top.