Privacy policy

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA
Updated version – March 2026

1. Data controller

The controller of personal data processing is:

JO-IN S.r.l.

Piazza Teresa Noce 17/D – 10155 Torino (TO), Italy

VAT number: 13289940010

E-mail: vacanzestudio@jo-in.it

Website: www.jo-in.it

For any question concerning the processing of personal data, you may contact the Controller at the e-mail address given above.

2. Categories of data processed

JO-IN S.r.l. processes the following categories of personal data as part of its activity as a tour operator specialising in study stays for underage students:

2.1 Identity and contact data of parents/guardians

• First name, surname, date and place of birth, tax code

• Address of residence

• Telephone contacts (of both parents or those acting in their place)

• E-mail address

• Billing data

2.2 Identity and travel data of students (minors)

• Full first name and surname as shown on the travel document

• Date of birth

• Type, number, expiry date and place of issue of the travel document

• Health insurance card number

2.3 Special categories of data (art. 9 GDPR) of students

Given the nature of the service provided and the protection of the health of underage students during their stay abroad, JO-IN S.r.l. processes the following special categories of data, subject to the explicit consent of the parent/guardian:

• Health data: allergies, food intolerances, medicines taken, relevant medical conditions

• Particular dietary requirements of a religious or cultural nature

Such data is processed exclusively in order to ensure the safety and well-being of the student during the stay and is disclosed, to the extent strictly necessary, to the accommodation providers and partner schools.

2.4 Website browsing data

Each access to the website www.jo-in.it automatically records technical data such as: IP address, browser type and version, operating system, referring URL, date and time of access. Such data is used exclusively for anonymous statistical purposes and to ensure the correct functioning of the site.

3. Purposes and legal bases of the processing

The personal data collected is processed for the following purposes, each founded on a specific legal basis pursuant to EU Regulation 2016/679.

Management of the travel contract — data is processed for the booking, organisation and delivery of the travel package, as well as for the management of payments and contractual documentation. Legal basis: performance of a contract (art. 6.1.b GDPR).

Legal obligations — data is processed in order to comply with applicable legal obligations, including mandatory communications to the competent authorities, the management of documentation for minors abroad and tax and administrative obligations. Legal basis: legal obligation (art. 6.1.c GDPR).

Emergency management — the parents’ contact data and the student’s health information may be used to ensure a timely response in the event of a medical emergency, injury or other critical event during the stay. Legal basis: protection of the vital interests of the data subject (art. 6.1.d GDPR).

Students’ health data — information concerning allergies, intolerances, medicines and relevant health conditions is transmitted, to the extent strictly necessary, to the accommodation providers and partner schools in order to ensure the student’s safety during the stay. Legal basis: explicit consent of the parent/guardian (art. 9.2.a GDPR).

Commercial communications — contact data may be used to send information about new packages, offers and initiatives of JO-IN S.r.l., exclusively subject to the explicit consent of the data subject and with the possibility of withdrawal at any time. Legal basis: consent (art. 6.1.a GDPR).

Photographs and videos of the stay — images and videos portraying students during activities may be used for internal sharing among the parents of the group or for promotional purposes, exclusively subject to the explicit consent of the parent/guardian given through the dedicated form attached to the travel contract. Legal basis: explicit consent (art. 6.1.a GDPR).

4. Recipients of the data

Personal data may be disclosed, to the extent strictly necessary for the delivery of the service, to the following categories of recipients:

• Partner schools and language institutes (at the destination), for the management of teaching activities and of the welcome;

• Accommodation providers (residences, host families, hotels), for the management of the stay;

• Airlines and transport carriers, for the issuing of travel documents;

• Partner insurance companies, for the taking out and management of the policies included in the package or requested optionally;

• Competent authorities (border authorities, consular authorities, law enforcement), where required by law or in the event of an emergency;

• Providers of IT and management services who process the data on behalf of JO-IN S.r.l. as Data Processors pursuant to art. 28 GDPR.

Data is not transferred to third parties for marketing purposes, nor publicly disseminated, except with the explicit consent of the data subject.

5. Transfer of data to third countries

Given the destinations of the study stays offered, some personal data is transferred to countries outside the European Union, in particular:

• United Kingdom: following Brexit, the United Kingdom is considered a third country. The transfer is nevertheless authorised by the adequacy decision adopted by the European Commission on 28 June 2021 (art. 45 GDPR).

• United States: the transfer takes place on the basis of appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission (art. 46 GDPR), or within the framework of the EU-US Data Privacy Framework where applicable.

• Other destination countries: the transfer takes place on the basis of the explicit consent of the data subject (art. 49.1.a GDPR) or of the necessity of performing the travel contract (art. 49.1.b GDPR).

Further information on the transfer mechanisms adopted may be requested from the Controller at the address vacanzestudio@jo-in.it.

6. Processing of minors’ data

JO-IN S.r.l. processes the personal data of minors under 18 years of age as part of the delivery of its study stay services. In accordance with art. 8 GDPR and with the applicable national legislation:

• Consent to the processing of the minor’s data is given by the parent or legal guardian;

• Minors’ data is not used for profiling, direct marketing or disclosure to third parties not strictly necessary for the delivery of the service;

• Photographs and videos portraying minors are subject to separate explicit consent of the parent/guardian, as provided for by the travel contract;

• JO-IN S.r.l. adopts strengthened technical and organisational measures for the protection of minors’ data.

7. Retention period

Personal data is retained for the period strictly necessary to achieve the purposes for which it was collected, in compliance with the storage limitation principles laid down by art. 5 GDPR and with the applicable legal obligations, including those of a civil, tax and administrative nature.

8. Security measures

JO-IN S.r.l. adopts technical and organisational measures appropriate to ensure a level of security proportionate to the risk, pursuant to art. 32 GDPR. Such measures include, by way of example: control of access to IT systems, use of encrypted connections for the transmission of data, periodic backup procedures, training of the personnel authorised to carry out the processing.

In the event of a personal data breach presenting a high risk to the rights and freedoms of the data subjects, JO-IN S.r.l. will notify the event to the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) within 72 hours and, where necessary, inform the data subjects directly.

9. Cookies and analytics tools

The website www.jo-in.it uses technical cookies necessary for the functioning of the site and, subject to consent, analytics and profiling cookies. For detailed information on the types of cookies used, on their purposes and on how to manage or refuse cookies, please refer to the Cookie Policy available on the site www.jo-in.it.

The site uses Google Analytics (Google LLC) for the analysis of web traffic. The data collected by Google Analytics is processed in aggregated and anonymised form. For further information: policies.google.com/privacy.

10. Rights of data subjects

Data subjects (parents/guardians and, where applicable, students of age) may exercise at any time the following rights vis-à-vis the Controller, pursuant to artt. 15-22 GDPR:

• Right of access (art. 15): to obtain confirmation that processing is taking place and to access one’s own personal data;

• Right to rectification (art. 16): to obtain the correction of inaccurate data or the completion of incomplete data;

• Right to erasure (art. 17): to obtain the erasure of one’s own data, save for legal obligations requiring its retention;

• Right to restriction of processing (art. 18): to obtain the suspension of the processing in certain cases;

• Right to data portability (art. 20): to receive one’s own data in a structured format and transfer it to another controller;

• Right to object (art. 21): to object to the processing on legitimate grounds;

• Right to withdraw consent: to withdraw at any time the consent given, without affecting the lawfulness of the processing carried out before the withdrawal;

• Right to lodge a complaint: to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

Requests concerning the exercise of these rights should be sent to: vacanzestudio@jo-in.it. The Controller undertakes to reply within 30 days of receipt of the request (extension to 3 months for complexity, and free of charge save for abuse)

11. Changes to this information notice

JO-IN S.r.l. reserves the right to update this Information Notice at any time, in particular following regulatory or organisational changes. The updated version will be published on the website www.jo-in.it with an indication of the date of update. In the event of substantial changes concerning processing based on consent, data subjects will be informed and, where necessary, new consent will be requested.