This Privacy Policy was designed to inform you, the visitors of this website and associated websites, users of our services, and participants in our events and the HIPPO contest, about how your personal data is gathered, used, stored, or otherwise processed. We own this and associated websites and organize HIPPO events and contests, so we are deemed the data controller over the personal data you share with us.
We are Hippo SRL, Via Galileo Galilei 10, 05100 Terni, Italy.
By interacting with our websites, you may provide us with personal data relating to the following:
• participation in the HIPPO contest,
• purchase of e-books offered on our website,
• registration for events organized by us and organization of associated accommodation and travel,
• general interaction with our websites.
We encourage you to read carefully the following sections to understand how we process and protect your personal data, which data protection rights you are entitled to exercise, and how to do so.
Personal data we process
By using our website, using our services, and participating in our events you may disclose various pieces of information, including those considered personal data. When your personal data is processed, you are considered to be a data subject and you are entitled to exercise your rights guaranteed by relevant data protection legislation, as explained in this Policy.
Taking into account that we determine the purposes and means of processing personal data you share with us, we are legally considered to be the Data Controller over your personal data on this website or in case of providing our services and/or organizing our events that you participate in. Being a Data Controller provides us with the opportunity to process your personal data but also obligates us to protect it in the way regulated by applicable legislation including the EU General Data Protection Regulation (GDPR).
Please note that different categories of personal data will be processed in different situations. Please read more about the activities we organize, services/products we offer, and content we provide to find explanations about the types of personal data we process and the purposes for processing.
Participation in the HIPPO contest
We organize international English language contests for students aged six to nineteen. The contest is open to students from all countries of the world. Students who wish to participate take the tests at one of the venues (state and private schools that are part of the formal education system). Our local coordinators in many countries and regions around the world work to organize the contest.
The registration process for the contest begins with the processing of the personal data of interested students in the school accounts (accounts of approved state and private schools that are part of the formal education system).
When registering interested students, the following personal data are required:
first and last name,
• date of birth,
• class,
• name of the school,
• and country.
As soon as the student is registered, we assign him/her a randomly generated identifier, which we call the candidate number.
The purpose of processing the data passed on to us is to distinguish the students and classify them into appropriate categories in terms of age and region/country and to use data for necessary logistical purposes in the context of the organization and implementation of contest.
Students can access the test results using their date of birth and candidate number. Apart from students, access to our databases that contain students’ data is only granted to authorized staff of approved schools and our coordinators.
Where appropriate, we may process some of the personal data listed in this section to issue internationally recognized certificates of English language proficiency. In addition, the final list of exam results is publicly available on our website for transparency purposes.
Purchase of e-books offered on our website
When you purchase e-books on our website, we process your selection of e-books and the required billing data:
• first and last name,
• your address,
• country/region/province where you live,
• your telephone number,
• your email address,
• financial details.
We may process information about your company and your VAT number if the purchase is processed through your company. The processing of this data is necessary to fulfill the legal requirements in connection with financial transactions and the execution of purchases. Your credit card data and/or PayPal data are processed for the purpose of the financial transfer.
The billing details are accessible to authorized financial personnel, while your credit card and/or PayPal data are only processed by payment providers.
Participation in our events
When organizing our events, including the final rounds of the HIPPO contest, we process personal data uploaded to our booking platform. The following categories of personal data are processed:
• first and last name,
• category of a participant (student/parent, teacher, coordinator),
• date of birth,
• country of origin,
• gender,
• dietary restrictions,
• a copy of a passport or identity card,
• financial details,
• recordings.
These data are required for making travel arrangements, assisting with visas (if required), booking accommodation, and arranging details of meals during the stay at the contest / event venue. We also process details of the categories in which students are competing in the final rounds of the HIPPO contest. If necessary, we process financial details to carry out financial transactions for the payment of fees for participating in our events.
These personal data are only processed by our staff responsible for travel arrangements and the local coordinators. In the case of financial transactions, billing details are processed by authorized financial personnel while credit card and/or PayPal data are processed by payment providers.
When you participate in our events, we may process video, audio, and screen recordings containing your images and voices. This is necessary to prepare the relevant material about the events that will be provided to event participants as a memento of the event and/or to promote the event through our commercial communication channels.
General interaction with our websites
When you use our website, we may process the IP address of the device you are using, the type and version of the browser and operating system you are using, and the time you logged in.
We process your electronic identification data to enable communication between your device and our server and to determine your approximate location, which can be further used to provide and customize services. Your approximate location may also be used for analytical purposes. The processing of information about the browser and operating system you use is necessary to ensure the proper provision of our services to you. We may also need these data to solve technical problems should they occur. The IP address of the user’s device may also be processed to prevent the user from re-registering on the website in the event of misconduct or identity fraud.
Much of the data used for analytical purposes to make the content visible and accessible to you is processed using technologies known as cookies. We therefore recommend that you read more details about our use of cookies in our Cookie Policy.
Principles governing the processing of your personal data
When we process your personal data, we are committed to adhering to the fundamental principles set out by the GDPR. These principles are designed to protect your rights and ensure that your personal data are handled with care, transparency, and fairness. Below is an overview of the principles we follow.
Lawfulness, Fairness, and Transparency
We process your data in a lawful, fair, and transparent manner. We take particular care when selecting the legal bases for processing your personal data. We always ask for your consent when this is required. If a data subject belongs to a vulnerable group (e.g. children) and is legally incapable of giving lawful consent for processing personal data, his/her guardian or a parent may provide consent to the processing of personal data.
In certain cases, lawful data processing is based on the conclusion and performance of a contract (e.g. when processing the purchase of our e-books or organizing travel arrangements for participation in our events). Where possible, our legitimate interests may be used to process your data (e.g. in limited situations when you interact with our website. For more details, please see our Cookie Policy. In certain cases, your data must be processed in order to comply with the requirements of mandatory laws.
In all cases, we will do our best to inform you about why we collect your data, how it is used, and what rights you have in relation to the processing of personal data.
Purpose Limitation
Your personal data are collected for specific, explicit, and legitimate purposes. We will not use your data for purposes that are incompatible with those originally disclosed to you. If we have an interest in continuing to use your data beyond the originally agreed purposes, we will ask for your consent to further data processing.
Data minimization
We only collect the personal data that are strictly necessary for the purposes stated in this Policy. This means that we limit our data collection and subsequent processing to what is relevant and necessary to provide you with our services, organize our activities, and ensure your access to the desired content.
Accuracy
We endeavor to keep your personal data accurate and up to date. If you notify us that your data are inaccurate or out of date, we will take prompt action to correct or delete it.
Storage Limitation
We store your personal data for different periods depending on the purpose it was collected. However, your personal data will only be stored for as long as it is needed for the purposes for which it was collected, or as required by law. Once they are no longer needed, we will securely erase or anonymize them.
Integrity and Confidentiality
We ensure that your personal data are processed in such a way that its security is guaranteed. This includes taking appropriate technical and organizational measures to protect them from unauthorized or unlawful processing, accidental loss, destruction, or damage. Based on business needs and security requirements, we apply access control restrictions to your personal data. It should be noted that access to your personal data is only granted to trained and authorized staff whose knowledge and skills are necessary to adequately process the personal data we collect.
Data processing by third parties
We may disclose your personal data to third parties, e.g. to service providers that we engage to perform tasks on our behalf or to other third parties. Third parties who process your data on our behalf are considered our data processors within the meaning of the GDPR. We therefore share your data with data processors. Please note that data sharing has a very broad meaning and making data accessible (e.g. granting access rights) to third parties is also considered data sharing.
Why we share your personal data?
We share your personal data for the following purposes:
• to organize the HIPPO contest,
• to carry out the purchase of e-books,
• for the organization of our events, including travel and booking arrangements, booking hotels, restaurants, and airlines tickets,
• when you interact with our websites for analysis of our business objectives (more about this in our Cookie Policy).
Please note that we share your personal data with the members of our corporate group in order to carry out the activities, and provide services and content as described in this Policy. The members of our corporate group are the following legal entities:
• Global Hippo Association, via Federico Fratini 37, 01500 Terni, Italy
• Hippo SRL, Via Galileo Galilei 10, 05100 Terni, Italy
• GLT – Gestione Locazioni Turistiche SRLS, Via Galileo Galilei 10, 01500 Terni, Italy
During the final round of the HIPPO contest selection process, students have the opportunity to take the internationally recognized certification exam in the English language. If students choose to take the exam, we will provide the necessary personal data (first and last name, date of birth, copy of the passport or ID card) to the certification exam provider – Gatehouse Awards – so that they can register candidates for the exams and administer the exam.
We will also share your data with authorities and law enforcement agencies if required to do so by law.
The complete list of all data processors is available here.
How are your data processed by third parties?
When using data processors, the relevant obligations under the GDPR are complied with and appropriate measures must be taken. If necessary, we conclude data protection agreements with the recipients of your personal data. We carefully analyze what data we share with third parties, and when we do so, we make available only data needed to achieve agreed purposes.
We tend not to transfer your data outside the European Economic Area (EEA). Your personal data may be transferred to a recipient located in a country that the European Commission considers to have an adequate level of data protection. Further information on countries with an adequate level of protection can be found here.
However, we may transfer your personal data outside the EEA or receive personal data related to the data subjects based outside the EEA in order to provide our services and carry out the activities described in this Policy. We take all measures in relation to the recipients of your personal data to ensure an adequate level of protection and appropriate safeguards as set out in applicable data protection laws and in particular the GDPR. This includes, among other things, the implementation of the Standard Contractual Clauses (SSC) issued by the European Commission.
Your data protection rights
Whenever we process your personal data, we take actions that affect you and your privacy and your personal data. Therefore, as a data subject within the meaning of the GDPR, you are entitled to exercise certain data protection rights. These rights and the conditions for exercising them are explained below:
• Right of access – You have the right to obtain confirmation from us as to whether or not personal data concerning you are being processed, to obtain information about the processing of your data and your rights and, where applicable, to request access to the data.
• Right to rectification – You have the right to obtain from us the erasure of inaccurate personal data concerning you. Taking into account the purposes of the data processing, you have the right to have incomplete personal data completed and inaccurate data rectified.
• Right to erasure (right to be forgotten) – In certain circumstances, you have the right to request that we erase the data we hold about you. These are as follows:
• When the data are no longer needed for the purposes for which the were collected;
• If you have withdrawn your consent to the processing of your data and there is no other lawful basis on which we can continue to process your data;
• You have objected to the processing and there are no overriding legitimate grounds for the processing to continue;
• If the data have been processed unlawfully;
• If the data must be erased for compliance with a legal obligation.
We are exempt from this obligation if it is impossible to comply or if the identity of the applicant cannot be verified, as we can only respond to verifiable requests.
• Right to restriction of processing – You have the right to request the restriction of processing of your personal data in the following circumstances:
• If the accuracy of the data is contested, processing may be restricted for the period necessary for us to verify the accuracy of the data;
• The processing is unlawful and you request restriction instead of erasure;
• We no longer need the data for the purposes for which it was collected, but the data are still required for the establishment, exercise, or defense of legal claims;
• If you have objected to the processing of your personal data while awaiting verification as to whether our legitimate interests in processing your data override the interests of your fundamental rights and freedoms.
• Right to object to the processing of your personal data – You have the right to object to the processing of your data by us at any time on grounds relating to your particular situation. Upon your objection, we will stop processing your data unless we can demonstrate compelling legitimate grounds for continuing the processing that overrides the interests of your fundamental freedoms and rights, or further processing is necessary for the establishment, exercise, or defense of legal claims.
• Right not to be subject to automated decision-making – You have the right to object to our processing of your data for automated decision-making, including profiling, where such processing produces legal effects concerning you or similarly significantly affects you. Upon your legitimate objection, your personal data will no longer be processed for automated decision-making.
• Right to data portability – Under certain circumstances, you have the right to receive the personal data that you have provided to us in a structured, commonly used, and machine-readable format (i.e. in digital form). You have the right to request the transfer of this data to another entity without being prevented from doing so by us, provided that such transfer is technically feasible.
• Right to withdraw consent – We rely on your consent to process some categories of your personal data. You can withdraw your consent at any time without giving any reason and at no cost to you. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint
If you believe that your rights in relation to personal data have been violated, you have the right to lodge a complaint with your local data protection authority or the competent data protection authority. The determination of competent data protection authority may be based either on your habitual residence or on the place where the alleged personal data breach occurred.
As we are based in Italy, you can also contact the Italian Data Protection Authority.
The Italian Data Protection Authority (Garante per la protezione dei dati personali)
Address: Piazza Venezia 11, 00187 – Rome, Italy
Phone: +39 06.696771
Email: protocollo@gpdp.it
Contact us
If you have any questions regarding the processing of your personal data explained in this Policy or wish to exercise any of your rights listed above, please contact us via privacy@hippo-thecontest.org.
Modification clause
This Privacy Policy may be modified from time to time. Please review it for any essential or minor modifications that may have been made in the meantime. Our policy is also reviewed once a year.
This Privacy Policy was last reviewed on the 1 January 2025
Privacy Policy (PDF)
