Data Controller

Alma Mater Studiorum – University of Bologna, represented by the Rector as legal representative (legal address: via Zamboni, 33 – 40126 Bologna, Italy; email: privacy@unibo.it; Certified Email: scriviunibo@pec.unibo.it).

 

Data Protection Officer

Data Protection Officer at Alma Mater Studiorum – University of Bologna (DPO) (legal address: via Zamboni, 33 – 40126 Bologna, Italy; email: dpo@unibo.it; Certified Email: scriviunibo@pec.unibo.it).

 

Purposes of Personal Data Processing

The primary purposes pursued by Alma Mater Studiorum – University of Bologna (“University”) are research and teaching, inseparable activities aimed at pursuing critical knowledge open to dialogue and interaction between cultures. The University is also tasked with protecting and innovating cultural heritage, promoting the development, transfer, dissemination, and valorization of knowledge for the benefit of individuals and society. In addition to the purposes established by the University Statute, the University pursues other instrumental purposes for carrying out the aforementioned primary activities, with the responsible contribution, within their competencies, of all university community members. In particular, these purposes and tasks are pursued, also through the processing of data from:

• students;
• professors, researchers, technical administrative staff, and collaborators;
• third parties who have contacts, even occasional, with the University.

Data is also processed to ensure the use of suitable tools to achieve institutional purposes while providing adequate protection of the data processed and university assets.

Further processing of such data, in aggregated or anonymous form, may be performed for statistical, research purposes, and more generally, within the purposes pursued by the University.

Institutional purposes may also be achieved through the use of services and tools from third parties.

 

Legal Basis

The processing carried out by the University is founded on the following legal bases:

• Article 33 of the Constitution and Article 6 of Law No. 168/1989 and subsequent amendments and integrations;
• under Article 6 of Regulation (EU) 2016/679, paragraph 1, letter c) (processing for legal obligations), letter e) (processing for reasons of public interest), letter b) (processing necessary for the execution of a contract to which the data subject is party or for the execution of pre-contractual measures taken at the request of the same);
• under Article 9, paragraph 2, letter g) (processing for reasons of public interest) and letter j) (for the purposes of archiving in the public interest, scientific or historical research or statistical purposes) of Regulation (EU) 2016/679;
• in Article 2-sexies, paragraph 2, letter bb) (University education) of Legislative Decree 196/2003 and subsequent amendments and integrations;
• under Articles 9, paragraph 2, letter j) (archiving in the public interest, for scientific or historical research, or for statistical purposes) of Regulation (EU) 2016/679 and 2-sexies, paragraph 2, letter cc) (archiving in the public interest or for historical research, for scientific research purposes, and for statistical purposes) of Legislative Decree 196/2003 and subsequent amendments and integrations;
• Legislative Decree No. 42 of January 22, 2004, “Code of Cultural Heritage and Landscape, pursuant to Article 10 of Law No. 137 of July 6, 2002”.

Should processing be based on different and/or additional legal bases to those identified above, specific indication will be provided in any relevant information notices.

 

Recipients of Personal Data

The processing of personal data by employees and collaborators of the University takes place exclusively for the pursuit of the institutional functions of the University, in line with the legislative and regulatory provisions in reference (for example, in terms of work, welfare, assistance, and fiscal obligations) and in accordance with the directions provided by the Data Controller.

Data may also be processed by public and private entities (Foundations, Associations, etc.), appointed Data Processors under the effects of Article 28 of Regulation (EU) 2016/679, for the management of institutional activities of the University and for the outsourcing of services within its competence.

The communication of personal data to other public and private entities is provided:

• for the fulfillment of purposes, tasks, and/or functions assigned by law (for example, in the case of data transfer required by law to the Ministry of University and Research or checks and controls carried out by the Revenue Agency) or in compliance with legal obligations;
• for the realization of international mobility activities;
• for the control of substitute declarations made for the purposes of Presidential Decree No. 445/2000 by certifying administrations;
• to ensure the training of personnel;
• for the management of human resources involved in funded research projects;
• to confirm the presence of any titles/certifications, at the request of the data subject;
• for the evaluation, management, and settlement of a claim by the data subject or a third party connected to them by insurance companies and/or brokers, as well as for the monitoring and analysis of claims involving the University;
• to ensure insurance coverage in favor of the data subject or subjects connected to them by insurance companies and/or brokers;
• for investigations and/or assessments by the judicial authority;
• for the extrajudicial and judicial protection of the University;
• for the performance of functions assigned by Legislative Decree 81/2008 to the Competent Doctor and by Legislative Decree 101/2020 to the Authorized Doctor, also with regard to health surveillance.

The communication of data to the aforementioned recipients for the performance of a task of public interest or connected to the exercise of public powers is carried out when provided by a law or, in cases provided by law, regulation, or when necessary for the performance of tasks of public interest and for the performance of institutional functions, in compliance with the definitions in Legislative Decree 196/2003 and subsequent amendments and integrations

In cases where processing occurs through services or systems that allow the processing of personal information of workers, as well as in cases where one wishes to know the complete and updated list of Data Processors involved in a specific processing, it is possible to know the identity of the same and the system administrators by writing to the Manager/Director of the structure that manages the service or to the Data Protection Officer mentioned above.

 

International Data Transfer

Data may be communicated outside the European Economic Area:

• on the basis of an adequacy decision by the European Commission, per Art. 45 of Regulation (EU) 2016/679;
• through the adoption of one of the safeguard measures indicated by Art. 46 of Regulation (EU) 2016/679 (for example, the standard data protection clauses adopted by the European Commission);
• or, in the absence of the conditions mentioned above, through the adoption of the conditions under Art. 49 of Regulation (EU) 2016/679:
  – where the data subject has unequivocally consented to the transfer;
  – the transfer is necessary for the execution of a contract between the data subject and the University or for the execution of pre-contractual measures taken at the request of the data subject;
  – the transfer is necessary for the conclusion or execution of an agreement, concluded or to be concluded in the interest of the data subject, between the Data Controller and a third party;
  – the transfer is necessary or prescribed by law for the safeguarding of a significant public interest, or for asserting, exercising or defending a right in court;
  – the transfer is necessary for the protection of the vital interest of the data subject;
  – the transfer occurs from a public register (subject to the conditions of access to registers in general).

Data Retention Period

Data is stored by the University for the time strictly necessary to achieve the purposes described above, except for a term of ten years to ensure compliance with fiscal, accounting, and administrative obligations required by law and possibly longer terms, not determinable a priori, due to different conditions of lawfulness of processing (for example, judicial actions that make necessary the processing for more than 10 years).

It is also specified that some personal data are subject to conservation constraints for historical purposes in relation to, for example, documents kept in the University archives declared of significant historical interest.

 

Data Subject Rights

Data subjects have the right to obtain from Alma Mater Studiorum – University of Bologna, in the cases provided, access to personal data and the rectification or deletion of the same or the restriction of processing concerning them or to object to the processing (Arts. 15 et seq. of the Regulation). The appropriate request to Alma Mater Studiorum – University of Bologna is submitted by contacting the Data Protection Officer mentioned above.

Data subjects who believe that the processing of personal data relating to them is carried out in violation of the provisions of Regulation (EU) 2016/679 or Legislative Decree 196/2003 and subsequent amendments and integrations have the right to lodge a complaint with the Data Protection Authority, as provided by Art. 77 of the cited Regulation, or to take appropriate legal action (Art. 79 of the Regulation).

 

Further Purposes of Personal Data Processing

Beyond the purposes not expressly indicated above, the University may process data where processing is necessary for the performance of a task of public interest or for the exercise of public powers vested in the University. Data, in anonymous or pseudonymized form, may be processed for archiving in the public interest, or for scientific or historical research or for statistical purposes.