You are here:

Privacy Policy Statement

Data Controller

Alma Mater Studiorum - University of Bologna, of which the Rector is the Legal Representative (registered office: via Zamboni 33, 40126 - Bologna, Italy; e-mail: privacy@unibo.it; certified e-mail: scriviunibo@pec.unibo.it).

Data Protection Officer

Data Protection Officer at Alma Mater Studiorum – University of Bologna (DPO) (registered office: via Zamboni 33, 40126 - Bologna, Italy; e-mail: dpo@unibo.it; certified e-mail: scriviunibo@pec.unibo.it).

Purposes of processing personal data

The primary objectives pursued by Alma Mater Studiorum – University of Bologna (hereinafter, the “University”) are research and teaching, which are inseparable activities in the pursuit of critical awareness, open to dialogue and cultural interaction. The University also seeks to safeguard cultural heritage and make innovations, by promoting the elaboration, dissemination, transfer and enhancement of knowledge for the benefit of individuals and society. In addition to the objectives established in the University General Statute, the University also pursues other goals that contribute to its primary activities, with responsible assistance, to the extent of their competences, from all members of the University community. In particular, these objectives and goals are pursued, in part, by processing the data of:

students;
professors, researchers, professional staff and collaborators;
third parties that come into contact with the University, temporarily or otherwise.

The data are also processed in order to ensure the use of appropriate tools to achieve the University’s purposes and to guarantee adequate protection of the data processed through such tools and of the University’s assets.

Data pertaining to the data subjects may also be processed, in aggregate or anonymous form, for statistical and research purposes and, more generally, within the scope of the purposes pursued by the University.

The University’s purposes may also be pursued through the use of third-party services and tools.

Legal basis

The legal basis for the data processing performed by the University is found in:

art. 33 of the Constitution and art. 6 of Law 168/1989, as amended;
art. 6 of Regulation (EU) 2016/679, paragraph 1, letter c) (processing in order to comply with a legal obligation), letter e) (processing carried out in the public interest), letter b) (processing necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract);
art. 9, paragraph 2, letter g) (processing necessary for reasons of substantial public interest) and letter j) (processing necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes) of Regulation (EU) 2016/679;
art. 2-sexies, paragraph 2, letter bb) (University education) of Legislative Decree 196/2003, as amended;
article 9, paragraph 2, letter j) (processing necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes) of Regulation (EU) 2016/679 and article 2-sexies, paragraph 2, letter cc) (processing necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes) of Legislative Decree 196/2003, as amended;
Legislative Decree no. 42 of 22 January 2004 “Code of cultural and landscape heritage, pursuant to art. 10, Law no. 137 of 6 July 2002”.

In the event of processing carried out based on different and/or ulterior provisions in respect of those indicated above, the relative information will be provided.

Recipients of personal data

The personal data of University employees and collaborators is processed solely in order to carry out the institutional functions of the University, in line with the relevant legislative and regulatory requirements (governing such matters as work, pensions, social security and taxation) and in compliance with the instructions given by the Data Controller.

The data may also be processed by public and private parties (Foundations, Associations, etc.), appointed as Data Processors pursuant to and in accordance with art. 28 of Regulation (EU) 2016/679, for the purposes of managing University activities and outsourcing University services.

Personal data may be communicated to other public and private parties:

in order to carry out duties and/or functions specified by law (for example, in the case of data transfers required by law to the Ministry of Universities and Research or inspections and assessments carried out by the Italian Inland Revenue Agency) or to fulfil legal obligations;
for international mobility purposes;
in order that the certifying administrations may check the self-certifications made for the purposes of D.P.R. 445/2000;
in order to ensure the training of personnel;
in order to manage the human resources involved in funded research projects;
in order to confirm the presence of qualifications/certificates, at the request of the data subject;
for the purposes of assessing, managing and settling the claims of data subjects or related third parties by insurance companies and/or brokers, and in order to monitor and analyse claims concerning the University;
in order to ensure that data subjects or related third parties are covered by the insurance provided by the insurance companies and/or brokers;
in order to cooperate with investigations and/or inspections performed by the judicial authorities;
in order to protect the University’s interests in court proceedings and in extrajudicial settings;
in order to perform the functions attributed pursuant to Legislative Decree 81/2008 to the Competent Physician and by Legislative Decree 230/1995 to the Authorised Physician, also for health monitoring purposes.

Data will be shared with the aforementioned recipients in order to perform tasks in the public interest or in relation to the exercise of public powers only where provided for by law or if necessary in order to carry out tasks in the public interest or to perform institutional tasks, in accordance with the provisions set out in Legislative Decree 196/2003, as amended.

Where services or systems are used that allow the personal data of workers to be processed, or where a complete and updated list of the Data Processors involved in specific processing activities is required, the names of the Processors and of the System Administrators can be obtained by writing to the Head of the structure that administers the service or to the Data Protection Officer indicated above.

Transfer abroad of personal data

The data will be shared outside the European Economic Area:

or based on an adequacy decision of the European Commission pursuant to art. 45 of Regulation (EU) 2016/679;
or by adopting one of the safeguards indicated in art. 46 of Regulation (EU) 2016/679 (for example, the clauses adopted by the European Commission on the type of data protection);
or, in the absence of the above, by adopting the conditions referred to in art. 49 of Regulation (EU) 2016/679:
- if the data subject has given unambiguous consent for the transfer;
- the transfer is necessary in order to execute a contract between the data subject and the University, or to carry out pre-contractual work requested by the data subject;
- the transfer is necessary in order to complete or execute an agreement, concluded or to be concluded in the interests of the data subject, between the Data Controller and a third party;
- the transfer is necessary or required by law in order to safeguard a significant public interest, or to establish, exercise or defend a right via court action;
- the transfer is necessary in order to safeguard the vital interests of the data subject;
- the transfer is activated from a public register (subject to the access conditions applicable to the registers in general).

Data retention period

Data is retained by the University for the period strictly necessary in order to pursue the purposes described above, without prejudice to the minimum period of ten years required for compliance with the tax, accounting and administrative obligations specified by law, or to any longer retention periods, not determinable in advance, that may be necessary under other conditions governing the lawfulness of processing (for example, legal actions that may make processing necessary for more than 10 years).

It should also be noted that certain personal data are required to be kept for historical purposes such as, for example, documents stored in University archives that have been declared as being of significant historical interest.

Rights of the Data Subject

To the extent applicable, data subjects have the right to obtain from Alma Mater Studiorum - University of Bologna: access to their personal data and its rectification or erasure, the restriction of processing related to them or the blockage of such processing (art. 15 et seq. of the Regulation). Data subjects may make the appropriate requests to Alma Mater Studiorum - University of Bologna by contacting the Data Protection Officer mentioned above.

Persons who believe that their personal data has been processed in violation of the requirements of Regulation (EU) 2016/679 or decree 196/2003 and subsequent amendments and additions are entitled to lodge a complaint with the Italian Data Protection Authority pursuant to art. 77 of the above Regulation or seek an effective judicial remedy (art. 79 of the Regulation).

Additional purposes of processing personal data

In addition to the purposes expressly indicated above, the University may process the data needed to carry out a task in the public interest or exercise public powers assigned to the University. Data may be processed in an anonymised or pseudonymised form for storage in the public interest, for scientific or historical research or for statistical purposes.

Further information

Data subjects may find further information regarding the processing of their data in the relative privacy policies for: