INFORMATION AND DECLARATION OF CONSENT TO PERSONAL DATA PROCESSING IN ACCORDANCE TO ARTICLE 13 OF GDPR (General Data Protection Regulation) EU REGULATION N. 679/2016 OF 27 APRIL 2016
This document is issued pursuant to Article 13 of EU Regulation 2016/679 of 27 April 2016 on protection of natural persons with regard to personal data processing and in compliance with the legislation on personal data processing, as well as on the free movement of such data.
Joint Data Controllers
Politecnico di Milano, based in Piazza Leonardo da Vinci, 32, 20133 Milano, in the person of the General Manager upon authorization of the pro-tempore Rector.
Contact: pecateneo@cert.polimi.it
Politecnico di Torino, based in C.so Duca degli Abruzzi, 24, 10129 Torino, in the person of the Rector.
Contact: politecnicoditorino@pec.polito.it
Responsible for data protection and contact points
Responsible for data protection (RDP) of Politecnico di Milano: privacy@polimi.it
Responsible for data protection (RDP) of Politecnico di Torino: dpo@polito.it
Purposes of data processing, legal basis, data categories and storage period
For the purposes of the application of European and national legislation on this matter (EU Reg. UE 679/2016, hereinafter Regulation), the following table specifies the purposes of the personal data processing, the legal basis, the categories of personal data being processed, and their storage period:
Purposes of the processing for which personal data are intended | Legal basis of data processing | Categories of personal data to be processed | Storage period of personal data |
a. Data processing with the aim to check the access requirements and attendance to the ASP b. Data processing aimed at providing the educational activities and the management of the ASP career (from the admission to the awarding of the ASP Diploma) c. Data processing aimed at organizing the ASP multidisciplinary projects; d. Data processing for tutoring services and provision of educational services | To fulfil the institutional activities of Politecnico di Milano and Politecnico di Torino (Article 6, paragraph 1, letter e; and art. 9, paragraph 2, letter g) of the Regulations | Personal data Personal email Academic career data Payments for taxes, contributions, surcharges, sanctions Self-certification of family economic situation, submitted to obtain the tax and contribution reduction Scholarships obtained from Politecnico, the Regional Agency for the Right to Education of Piedmont, Ente Regionale per il Diritto allo Studio (EDISU Piedmont) or other institutions Any documents certifying disability, if submitted | The data collected will be kept for the time established by current legislation or by the University regulations. In particular, it should be noted that personal data concerning the university career will be kept indefinitely, taking into account the storage obligations imposed by current legislation. |
Video and multimedia material production to be used as a promotional and informative tool of Politecnico di Milano and Politecnico di Torino. | Consent of the interested party (Article 6, paragraph 1, letter a) of the Regulations) | Photographic images and video shooting | These data will be stored for a period of time strictly necessary to achieve the institutional purposes for which they are processed. |
The provision of personal data concerning the institutional activities carried out by Politecnico di Milano and Politecnico di Torino must be considered compulsory. Failure to communicate and/or refusal to reply imply that you do not have access to the Alta Scuola Politecnica. On the other side, the provision of personal data collected with the consent of the interested party is optional.
For videos and images, it is specified that they will be published on institutional web sites and on social network channels through the official accounts of the Politecnico di Milano and Politecnico di Torino.
We inform that the ASP activities can be subject to filming and audio-video recordings. The data related to treatment, included images, filming and audio/video recordings (hereinafter, the “Images”), also in partial and/or modified or adapted form, realized during the event will be treated in full respect of the GDPR. The data will be processed, also through electronic means, by specifically appointed subjects, for dissemination and communication activities of Politecnico di Milano and Politecnico di Torino. The collected Images will be kept, also in electronic form and on any technological support for the purposes and within the limits defined above and may be disseminated in accordance with Law n. 150/2000 on institutional sites as well as through social network channels (Facebook, Twitter, Youtube, by way of example and not limited to). The party cannot be entitled to any compensation for the use of images. Politecnico di Milano and Politecnico di Torino have the right to access or disclose the party’s images without any consent, according to Article 97 of the law n. 633/1941. This authorization implies the granting of a non-exclusive license, without limits of duration and for the whole world, that can be transferred to third parties, for the use of the Materials and includes the rights mentioned in the following Articles, from 12 to 19 of the law n. 633 of 22 April 1941, including but not limited to: publication right; reproduction right through any mean or in any form; right of transcription, editing, adaptation, processing and reduction; right of communication to the public and dissemination, including screening, broadcasting and dissemination rights, also in a summarized and/or reduced version, by any technical means, the right to keep a copy of the Materials, also on electronic means and on any known technological support or available in the future for the purposes and within the limits defined above.
Processing methods
The data processing carried out for the above mentioned purposes can be performed both through paper and digital means, manually and/or with electronic tools or, in any case, through automated tools, including the Online Services portal of Politecnico di Milano. They are also stored in digital format for an indefinite period of time due to the transparency and good operation of the public administration.
Access to data acquired for the purposes mentioned above is allowed to duly authorized staff.
Recipient categories
Disclosed to the following public and private entities, including external ones, that provide services on behalf of the Data Controller:
- travel agencies
- companies providing hotel services
- companies for placement activities
Storage period of personal data and their return
For the purposes of storage and collection, the data necessary for a good operation of the Public Administration will be stored, in compliance with the principle of transparency and lawfulness, proportionality and minimization, for an indefinite period of time.
Transfer to Extra EU country
The personal data will not be, in any way, transferred to non-EU countries.
Rights of the interested parties
The interested party, in relation to the personal data subject of this information, has the right to exercise the rights provided by the EU Regulation mentioned below:
- right of access of the interested party [Article 15 of the EU Regulation] (the possibility of being informed about the processing performed on his/her Personal Data and eventually receive a copy);
- right to correct personal data [Article 16 of the EU Regulation] (the interested party has the right to correction of incorrect personal data concerning him/her);
- right to cancel their Personal Data without unnecessary delay (“right to be forgotten”) [Article 17 of the EU Regulation] (the interested party has, and will have, the right to cancel his/her data);
- right to limitation of his/her personal data processing, in the cases provided by Article 18 of the EU Regulation, including the case of unlawful processing or objections about the accuracy of Personal Data by the interested party [Article 18 of the EU Regulation];
- right to data portability [Article 20 of the EU Regulation], the interested party may request his/her Personal Data in a structured format, in order to forward them to another data controller, according to the cases provided by the same article;
- right to object to personal data processing [Article 21 of the EU Regulation] (the interested party has, and will have, the right to object the processing of his/her personal data);
- the right not to be subjected to automated decision-making processes [Article 22 of the EU Regulation] (the interested party has, and will have, the right not to be subjected to a decision based solely on automated processing).
Further information about the rights of the interested party is available on the web site www.garanteprivacy.it
The Joint Data Controllers, in compliance with Article 19 of the EU Regulation, will inform recipients, to whom the personal data have been communicated, about any corrections, cancellations or limitations of the treatment requested, where this is possible.
With reference to the aforementioned purposes, the interested party has the right to proceed, at any time, to the withdrawal of consent for identity and personal data processing by sending an email to: privacy@polimi.it and privacy@polito.it
Pursuant to Article 7 of the EU Regulation, the withdrawal of consent does not affect the legality of treatment, based on the consent before the withdrawal.
Right to submit a complaint
If the interested party deems that his/her rights have been compromised, s/he has the right to submit a complaint to the Data Protection Authority, according to the procedures indicated by this Authority at the following internet address:
www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524