Information for students

Privacy policy applicable to orientation activities

Privacy policy applicable to orientation activities (in Italian)

Privacy policy applicable to entry tests or the assessment of access requirements

Privacy policy applicable to users intending to enrol in degree programmes with restricted access at local and national level (in Italian) 

Privacy policy applicable to users intending to enrol in degree programmes with restricted access at local or national level with internal ranking procedure (in Italian) 

Privacy policy applicable to users intending to enrol in degree programmes with restricted access at local or national level with external ranking procedure (in Italian)

Privacy policy applicable to online entrance exams and/or other admission tests (in Italian)

Data processing for the purposes of delivering training courses and managing degrees (from matriculation to the award of the qualification)

Purposes of processing personal dataSpecific processing purposes and methods

Personal data and special categories of personal data (for example, the data necessary to support students with special needs or specific learning disorders or to support students on maternity) and/or criminal records data (in the case of detained students) that are collected as of matriculation/registration up to the award of the undergraduate or postgraduate degree, or in any case up to the conclusion of the students’ studies, will be processed in order to:

  • facilitate the learning and completion of the studies in question;
  • allow management and certification of the academic degree or training undertaken by exchange students;
  • enter into training agreements in the case of PhD students and medical students;
  • enable students to undertake curricular internships, as specified in more detail in the relative privacy policy;
  • guarantee the democratic representation and participation of students in University life (for example, the election of student representatives to degree programme, department and school committees and to some centralised academic boards in order to perform functions related to representation in academic bodies).

Legal basisLegal basis of the processing and nature of the provision of data


The legal basis for the data processing is found in:

  • articles 6, paragraph 1, letters c) (processing in order to comply with a legal obligation) and e) (processing carried out in the public interest) and 9, paragraph 2, letter g) (processing for reasons of substantial public interest) of Regulation (EU) 2016/679;
  • the sources of law related to the education of students (including: Royal Decree Law 20-06-1935, no. 1071; Law no. 910 of 11 December 1969), PhD students (for example: Law no. 28 of 21 February 1980, Law no. 341 of 19 November 1990; Law no. 210 of 3 July 1998, Ministerial Decree no. 45 of 8 February 2013) and postgraduate students undertaking specialised training (Legislative Decree no. 368/99, Interministerial Decree 68/2015; Interministerial Decree 402/2017).

The provision of personal data is compulsory. Refusal to provide the data will make it impossible to perform the operations necessary to establish the relationship between the student and the University. Refusal would also mean that the administrative and educational management of the students’ studies, which is necessary in order to comply with legal obligations, would be impossible.

Recipients of personal dataRecipients


In addition to the recipients mentioned in the general privacy policy, the data may also be sent to:

  • third parties that manage funding and collaborate with regard to the organisation of postgraduate degree programmes. Said parties, appointed as Data Processors in accordance with art. 28 of Regulation (EU) 2016/679, may collaborate directly with the University in performing certain activities that entail the processing of personal data (among which: accessing the list of enrolled students; managing selections for admission; managing the degree programmes; printing the certificates for degrees or other qualifications);
  • third parties who, in their capacity as Data Processors pursuant to art. 28 of Regulation (EU) 2016/679, process the data as part of the service to print the degree certificates (Scriptorium Decore S.r.l.);
  • Almalaurea, which, in its capacity as a Data Processor pursuant to art. 28 of Regulation (EU) 2016/679, may assist the University with activities performed with a view to improving the quality of teaching;
  •  third parties who, in their capacity as Data Processors pursuant to art. 28 of Regulation (EU) 2016/679, assist the University in managing its information systems and services (for example: Cineca, Microsoft, Respondus, Zoom, Panopto, Omnia Card);
  • in the case of medical students, to bodies that are part of the education network but outside of the individual school networks, appointed as Data Processors pursuant to art. 28 of Regulation (EU) 2016/679;
  • in the case of medical students undertaking training with healthcare service providers, to other public or private bodies and/or universities (insofar as they process the personal data of postgraduate students undertaking specialised training, within the scope of the tasks performed on behalf of the University), appointed as Data Processors pursuant to art. 28 of Regulation (EU) 2016/679;
  • public or private bodies that fund specialist training contracts or other training courses;
  • local bodies for the purposes of awarding funding for special categories of students; 
  • the Ministry of Foreign Affairs and International Cooperation, police stations and embassies in relation to permits of stay, recognition of particular statuses, citizenship and any qualifications of the student;
  • Regional Management Bodies (equipped with administrative and managerial autonomy and set up in accordance with the laws in force governing the right to higher education) and other institutions in order to promote the international mobility of students and/or to assess benefits and assign accommodation;  
  • MIUR;
  • bodies, institutions or associations in order to facilitate the integration of exchange students into their host country and the University as well as to promote intercultural dialogue between young people and the exchange of their experiences;
  • foreign universities involved in the degree programmes that award qualifications in collaboration with the University of Bologna;
  • prison services in order to guarantee education and training in prison institutions;
  • foreign universities or the relative bodies in order to verify the award of the qualifications necessary for admission to the university’s degree programmes;
  • the home and host universities/institutions of exchange students in order to manage the exchange programme.

In the case of students enrolled on a PhD programme degree, the data may also be shared with:

  • external commissioners with regard to the national selection procedure;
  • external commissioners and examiners with regard to admission to the final exam;
  • public or private bodies that have adhered to a consortium or an agreement concerning training and research projects;
  • the Ministry of Education and Research (in relation to the register of PhD graduates).

Data relating to medical students undertaking specialised training may also be sent to:

  • public and private healthcare structures, other universities and public or private bodies in order to facilitate performance of the specialised training activities;
  • MIUR in order to manage the ranking of students, assign and monitor study grants and fulfil other institutional duties;
  • the Regional Council with regard to the award and monitoring of study grants funded by the Region, within the scope of the competences defined in Legislative Decree 368/99;
  • other public and private bodies that provide study grants for medical students.

Transfer abroad of personal dataTransfer of data outside of the EU and the conditions applicable to the
transfer

In addition to the cases provided for in the general privacy policy, the personal data collected may be transferred to a country outside of the European Economic Area (EEA, namely the EU + Norway, Liechtenstein and Iceland) in cases where:

  • it is specifically requested by the student;
  • it concerns incoming or outgoing exchange students enrolled on degree programmes delivered in collaboration with several universities/institutions or who are admitted to degree programmes at the University of Bologna with qualifications gained abroad.

Data relating to the students indicated above may be transferred to: 

  • universities or the relative bodies outside of the EU (in the event that it is necessary to verify the student’s qualification for professional reasons or so that they may continue with their studies); 
  • foreign embassies or embassies located abroad (also for military service exemption purposes);
  • home and/or host universities/institutions outside of the EU in order to manage student exchange programmes, including with regard to degree programmes delivered in collaboration between several universities/institutions;
  • foreign authorities for various purposes including the provision of benefits and professional practice. 

The data may be transferred when necessary for reasons of substantial public interest in accordance with art. 96 of Legislative Decree 196/2003, as amended, and art. 49, paragraph 1, letter d) of Regulation (EU) 2016/679.

Data retention periodData retention period

All documents containing personal data that are necessary in order to have a record of important legal and economic events concerning the student are retained indefinitely. The retention period for the remaining data depends on the administrative documents in which they are contained and/or on the relative legal requirements (for example, ten years in order to comply with statutory tax and accounting requirements).

Processing for the purposes of managing internships and placements

Purposes of processing personal dataSpecific processing purposes and methods

Personal data (for example: personal details, contact details, information related to the student’s course of study and the duties performed in the organisation or company in which the internship is undertaken) and special categories of data (concerning, for example, persons with disabilities or specific learning disorders) are processed in order to manage:

  • curricular internships undertaken in Italy or abroad by students enrolled on an undergraduate or master’s degree programme or by incoming exchange students;
  • extracurricular internships undertaken in Italy or abroad by persons who have already completed their studies.

The data are processed under an agreement entered into by the University and the host organisation/company or within the scope of the activities carried out by the University, with the support of a tutor where necessary, or in relation to international mobility programmes (such as, for example, the Erasmus+ Programme).

Legal basisLegal basis of the processing and nature of the provision of data


The legal basis for the data processing is found in:

  • articles 6, paragraph 1, letters c) (processing in order to comply with a legal obligation) and e) (processing carried out in the public interest) and 9, paragraph 2, letter g) (processing for reasons of substantial public interest) of Regulation (EU) 2016/679;
  • the sources of law aimed at promoting internships that benefit students (art. 18 of Law 196/1997; Ministerial Decree 142/1998; State - Regions conference of 25 May 2017; Regional Law 1/2019 amending Regional Law 17/2005; Law 56/1989 “Rules Governing the Psychology Profession”; Ministerial Decree 239/1992 “Regulation laying down provisions on post-lauream professional internships for admission to the State exam taken in order to qualify as a professional Psychologist”; Ministerial Decree 240/1992 “Regulation laying down provisions on the State exam taken in order to qualify as a professional Psychologist”; Ministerial Decree 142/1998 “Regulation setting out rules for implementation of the principles and criteria referred to in article 18 of Law no. 196 of 24 June 1997 concerning (non-curricular) training and guidance internships”; Ministerial Decree 509/1999 “Regulation laying down provisions on the curricular autonomy of Universities”; Presidential Decree 328/2001 “Amendments to the provisions on the requirements for admission to the State exam and the relative exams necessary in order to practice each profession, as well as to the provisions of the relative regulatory frameworks”; Law 170/2003 “Conversion into law, with amendments, of Decree Law no. 105 of 9 May 2003 laying down urgent provisions concerning universities, research bodies and professional qualifications”, as amended; Ministerial Decree 270/2004 “Amendments to the regulation laying down provisions on the curricular autonomy of universities”, approved with Decree no. 509 of 3 November 1999 of the Minister for Universities and Scientific and Technological Research.

For curricular internships, the provision of personal data is:

  • mandatory in cases where the internship forms an essential part of the curriculum. In these cases, refusal to provide the data will make it impossible to complete the programme of study.
  • optional in cases in which the internship is an optional part of the curriculum. However, refusal to provide the data will make it impossible to undertake the internship.

For curricular internships, the provision of personal data is optional. However, as above, refusal to provide the data will make it impossible to undertake the internship.

In relation to the provisions governing the various professional internships, provision of the data may be mandatory in order to achieve the professional qualification.

Recipients of personal dataRecipients


In addition to the recipients mentioned in the general privacy policy, the data may also be sent:

  • to Regional and National employment offices, in the case of extracurricular internships;
  • at the request of the data subject or where the curricular internship is mandatory, to accredited or authorised public and private operators and potential employers, for the purposes of guidance and induction into the world of work (pursuant to Law no. 30/2003 on the reform of the labour market and subsequent implementations);
  • to parties hosting the intern who, in their capacity as Data Processors or as authorised persons, process the data in order to attest to the student’s achievement of the learning outcomes (e.g., attendance, activities performed, etc.);
  • in the case of professional psychology internships, to the Professional Association of Psychologists of Emilia Romagna;
  • parties outside of Italy hosting the intern as part of international mobility programmes and to funding bodies of the same such as, for example, the National Documentation, Innovation and Educational Research Institute (INDIRE).

Transfer abroad of personal dataTransfer of data outside of the EU and the conditions applicable to the
transfer

The personal data collected may be transferred to a country outside of the European Economic Area (EEA, namely the EU + Norway, Liechtenstein and Iceland) only in cases where:

  • said transfer is specifically requested by the student or where the internship is undertaken abroad;
  • the student is participating in an international mobility programme.

The data may be transferred when necessary for reasons of substantial public interest in accordance with art. 96 of Legislative Decree 196/2003, as amended, and art. 49, paragraph 1, letter d) of Regulation (EU) 2016/679.

Processing for the purposes of career guidance and job placement

Purposes of processing personal dataSpecific processing purposes and methods

Personal data (personal details, contact details, data pertaining to the student’s course of study, curriculum vitae, specific knowledge and skills) and any special categories of data are processed in order to provide career guidance to graduating students and to support them in entering the world of work. In particular, the data are processed:

  1. in relation to the training of graduating students (managing/monitoring the individual course of study, guidance counselling, supporting individual projects in respect of professional goals, also through specific meetings with the data subject and/or through participation in seminars/career guidance workshops). The data are processed also in order to ensure a specific focus on the outcomes of the career guidance Programmes;
  2. in order to provide students and graduates with the tools and support necessary to facilitate their entry into the world of work, also through dedicated web channels (for example, emails or apps) or through participation in events such as career days, recruiting days, company networking events and webinars.

Contact details and data relating to the academic programme undertaken by the student are processed in order to provide students and graduates with useful information concerning job placement and/or career guidance activities and events organised by the University.

The data are also processed for the purposes of researching and promoting models and practices within the university, exchanging information and experience, and monitoring the services provided in order to ensure they are adapted to the changes in the world of work and/or the different needs of students and graduates. For example, data relating to the guidance courses and
activities undertaken by each user (e.g. enrolment data) are documented/stored/processed by the University using its software in order to verify the efficacy of the service provided.

Legal basisLegal basis of the processing and nature of the provision of data


The legal basis of the processing performed for the purposes indicated in points “1” and “2” is found in:

  • art. 6, paragraph 1, letter c) (processing necessary for compliance with a legal obligation) of Regulation (EU) 2016/679;
  •  art. 6, paragraph 1, letter e) (processing necessary for the performance of a task carried out in the public interest) of Regulation (EU) 2016/679;
  • art. 9, paragraph 2, letter g) (processing necessary for reasons of substantial public interest) of Regulation (EU) 2016/679;
  • the sources of law identifying the University as an intermediary between the supply and demand of labour (articles 6 of Legislative Decree 276/2003, the so-called “Biagi Law”; Law no. 183 of 4 November 2010, the so-called “collegato lavoro”).

The provision of data for the purposes referred to in point “1” is optional. However, refusal to provide the data will make it impossible to benefit from the guidance services offered in relation to entering the world of work.

The provision of data for the purposes referred to in point “2” is optional.

If students wish to use the services described in point b), the University may share data relating to the interim and final results of the student’s training as well as other personal data for the purposes of facilitating their entry into the world of work, including abroad. For this purpose, said data may also be shared with private parties using electronic media. Where users wish to use services or take part in events aimed at bringing together prospective employers and job seekers, the provision of data (for example, through the submission of a curriculum vitae), where requested, is mandatory. If students refuse to provide the data, they will not be able to participate in the event and their data will not be sent to prospective employers.

Recipients of personal dataRecipients


In addition to the recipients mentioned in the general privacy policy, the data may also be:

  • sent to prospective employers in both the public and private sectors (including through employment agencies);
  • processed by Almalaurea in its capacity as the Data Processor assisting the University in achieving the aforementioned processing purposes;
  • processed by companies specifically appointed as Data Processors (for example, for website maintenance and/or to set up specific digital platforms).

Data retention periodData retention period

Personal data relating to events and to the studies undertaken by each student are kept only for the time strictly necessary to manage the same and to achieve the purposes described. The data may be retained for up to two years, after which they will only be processed in aggregate form.

Data relating to curricula vitae published or made available on the University’s website are kept for one year as of conclusion of the events for which the data was provided.

Processing for the purposes of providing tutorial, support and social inclusion services

Purposes of processing personal dataSpecific processing purposes and methods

Personal data (personal details and data pertaining to the student’s course of study) and special categories of data (relating, for example, to specific disabilities or learning disorders) are processed for the purposes of providing tutorial, support and social inclusion services and to support persons with disabilities or specific learning disorders (SLD). The processing of personal data strictly related to managing the academic programme undertaken by the student is not included.

The data are processed, for example, in relation to:

  • services available to support students with disabilities in moving around the University premises;
  • the dissemination of information or initiatives to promote social inclusion;
  • the provision of support services (e.g., tutorial, interpreting and sign language services, specific front-office services, the loan of assistive aids) throughout the course of study, with a view to identifying and planning the support necessary for each student so that they can successfully complete their degree programme.

Legal basisLegal basis of the processing and nature of the provision of data


The legal basis for the data processing is found in:

  • articles 6, paragraph 1, letters c) (processing in order to comply with a legal obligation) and e) (processing carried out in the public interest) and 9, paragraph 2, letter g) (processing for reasons of substantial public interest) of Regulation (EU) 2016/679;
  • the sources of law concerning the right to higher education of students with disabilities and SLD. (Law 104/1992, Law 17/99, Law 170/2010 and Law 4/2004);
  • the sources of law concerning the right to higher education (Legislative Decree 68/2012, Decree of the President of the Council of Ministers dated 9 April 2001 and art. 2.1 of the University Regulations issued with Rector’s Decree 1203/2011).

The provision of data for the aforementioned purposes is necessary in order to provide the benefits and services described above.

Recipients of personal dataRecipients


In addition to the recipients mentioned in the general privacy policy, the data may also be sent to:

  • ER.GO. in order to coordinate the activities, services and economic benefits under its responsibility aimed at students with disabilities;
  • providers of support services, in other words Data Processors that support the University in providing its services to students with SLD and/or disabilities;
  • public bodies, organisations or associations with which the University collaborates in order to conduct information and guidance activities and to facilitate identification of useful local resources (for example: local health authorities, foundations that provide consultancy services, specific associations);
  • organisations/institutions/companies that can host international exchange students.

Processing for the purposes of providing services and activities related to the right to higher education

Purposes of processing personal dataSpecific processing purposes and methods

Personal data (personal details and data pertaining to the student’s course of study, financial data and banking details for the payment of financial support) and any special categories of data (relating to, for example, students with disabilities and/or the student's participation in political associations) are processed in order to guarantee the right to higher education and the possibility of accessing benefits, grants and services.

In particular, the data are processed in order to satisfy the requirements related to:

  • managing competitive procedures for the award of study grants      and benefits to students of the Alma Mater Studiorum - University of      Bologna;
  • managing services related to the right to higher education;
  • managing the relationships arising from the aforementioned      competitions and services, as well as the related payments, where      required;
  • maintenance of the Register of University Associations/Student
    Cooperatives recognised by the Alma Mater Studiorum - University of Bologna and managing the competitive procedures for the award of funding to the
    Associations entered in the aforementioned Register.

Legal basisLegal basis of the processing and nature of the provision of data


The legal basis for the data processing is found in:

  • articles 6, paragraph 1, letters c) (processing in order to comply with a legal obligation) and e) (processing carried out in the public interest) and 9, paragraph 2, letter g) (processing for reasons of substantial public interest) of Regulation (EU) 2016/679;
  • Legislative Decree 68/2012, Decree of the President of the Council of Ministers dated 9 April 2001 and art. 2.1 of the University Regulations issued with Rector’s Decree 1203/2011 (provisions on the right to higher education);
  • art. 1, paragraphs 252 et seq. of Law 232/2016 and the University Regulations issued with Rector’s Decree 662/2018 (Student tuition fees and relative exemptions);
  • art. 1, letter b) of Law 170/2003, art. 2 of Ministerial Decree 198/2003 (tutoring allowances);
  • art. 7 of Ministerial Decree 198/03 (fiduciary loans);
  • art. 5, paragraph 1, letter a) of Law 240/2010 (valorisation of legally recognised university colleges);
  • Decree Law 105 of 2003 converted into Law 170 of 2003 and art. 4 of Ministerial Decree 198/2003 (young people's support fund providing for ad hoc funding by the Ministry in order to incentivise enrolment on degree programmes of particular national interest and to promote student mobility);
  • Legislative Decree 33/2013 (publications for transparency purposes);
  • art. 3, paragraph 4, letters d) and g) of Legislative Decree 68/2012, art. 2.1, letter f) of the University Regulations issued with Rector’s Decree 1203/2011 and the regulations establishing the Register of University Associations/Student Cooperatives recognised by the Alma Mater Studiorum - University of Bologna, issued with Rector’s Decree 1157/2007 (registration with the Register of University Associations/Student Cooperatives and granting of financial assistance or other University resources to the same).

The provision of data for the aforementioned purposes is optional but necessary in order to provide the benefits and services described above.

Recipients of personal dataRecipients


In addition to the recipients mentioned in the general privacy policy, the data may also be sent to:

  • ER.GO. in order to coordinate the activities, services and economic benefits under its responsibility aimed at students of the University;
  • at the request of the data subject, the University’s treasury office for the purposes of offering a fiduciary loan;
  • TPER S.p.A. in relation to the financial assistance available to university students to help them purchase travel cards;
  • TIM S.p.A., as the entity responsible for distributing SIM cards awarded to students by the University through a competitive procedure, in order to strengthen the digitalisation of teaching and learning;
  • parties appointed as Data Processors who provide services to help incoming exchange students with matters such as finding accommodation and immigration procedures;
  • other bodies that provide funding for international mobility programmes such as, for example, INDIRE (national Documentation, Innovation and Educational Research Institute) or MUR (Ministry of Universities and Research) for the Fondo Giovani (Young People’s Fund);
  • Callipigia s.r.l., as the Data Processor for processing carried out in order to maintain the applications used by the University in managing the register of university associations/student cooperatives recognised by the University;
  • other parties to whom specific services are outsourced to achieve specific purposes, and public or private partners with whom it is possible to collaborate in order to achieve the same purposes.

Privacy policy applicable to the diffusion of the final results and any connected elements

Privacy policy applicable to the diffusion of the final results and any connected elements (in Italian)

Processing for the purposes of managing disciplinary measures taken against students

Purposes of processing personal dataSpecific processing purposes and methods

Personal data, special categories of data and/or criminal records data
(which may be processed in cases where a health condition or other personal convictions/circumstances of the data subject come to light during proceedings initiated and/or in reports of disciplinary offences) are processed for the purposes of conducting investigations and any administrative proceedings against students, PhD students and medical interns.

Legal basisLegal basis of the processing and nature of the provision of data


The legal basis for the data processing is found in:

  • articles 6, paragraph 1, letters c) (processing in order to comply with a legal obligation) and e) (processing carried out in the public interest) and 9, paragraph 2, letter g) (processing for reasons of substantial public interest) of Regulation (EU) 2016/679;
  • the sources of law governing disciplinary measures and sanctions that may be applicable (Royal Decree 1592/1933, art. 16 of Royal Decree Law 1071/1935, University Regulations).

The provision of personal data is compulsory. Refusal to provide the data will make it impossible to perform the operations necessary for the purposes of the investigation and any administrative proceedings.

Recipients of personal dataRecipients

With regard to the potential recipients already indicated in the general privacy policy, it should be noted that the data may be processed:

  • by the Attorney General and by private lawyers;
  • where the investigation concerns an international student or a student enrolled on a joint degree programme, the data may be shared with the student’s home university.

Transfer abroad of personal dataTransfer of data outside of the EU and the conditions applicable to the
transfer


If an international student from a university outside of the EU is involved, the data will be shared with said university:

  • based on an adequacy decision of the European Commission pursuant to art. 45 of Regulation (EU) 2016/679;
  • by adopting one of the safeguards indicated in art. 46 of Regulation (EU) 2016/679 (for example, the clauses adopted by the European Commission on the type of data protection);
  • in the absence of the above, by adopting the conditions referred to in art. 49 of Regulation (EU) 2016/679 (for example, where the transfer is necessary for the establishment, exercise or defence of legal claims).