Privacy Policy En

Privacy Notice

Vita-Salute San Raffaele University is constantly committed to protecting the online privacy of its users. This document has been prepared in accordance with Articles 13 and 14 of EU Regulation 2016/679 (hereinafter: “GDPR”) to inform you of our privacy policy when you browse the website https://labdisinformazione.it/ (hereinafter also “Website” or “Site”) or use the services provided through it.

The information and data you provide or that are otherwise collected in connection with your use of the services provided by the Vita-Salute San Raffaele University – such as registration for specific activities (including streamed lectures, training sessions, virtual campus tours, open houses, and organized events) – access to the Campus’s own services, as described in more detail below (hereinafter collectively referred to as “Services”), will be processed in compliance with the provisions of the GDPR and the confidentiality obligations that guide the University’s activities.

In accordance with the provisions of the GDPR, the processing carried out by the University will be based on the principles of lawfulness, fairness, transparency, purpose and storage limitation, data minimization, accuracy, integrity, and confidentiality.

Data Controller and Data Protection Officer

The Data Controller for the processing of data collected through the Website is Università Vita-Salute San Raffaele, with headquarters in Milan, Via Olgettina 58, Tax ID 97187560152 (hereinafter also referred to as “University,” “UniSR,” or “Data Controller”). For any information regarding UniSR’s processing of personal data, including the list of data processors, please write to the following address: titolare.privacy@unisr.it.

In accordance with the provisions of (i) the GDPR (see Art. 37) and (ii) the CODAU Guidelines, by resolution of the Board of Directors dated January 22, 2018, the University has appointed GSD SISTEMI E SERVIZI S.C.A.R.L., with registered office at Via Giovanni Spadolini, 4, Milan, VAT No. 06959200962 (hereinafter, “GSDSS”), as the Data Protection Officer (hereinafter, the “DPO”).

The professional designated by GSD to serve as DPO can be contacted at the following email address: privacy@unisr.it.

The DPO is available to provide any information regarding the processing of personal data carried out by the University.

Categories of Data Subjects

The University processes the personal data of data subjects who are users of the Website.

Categories of Processed Data

3.1. Browsing Data:

Technical Data

This category of data includes the IP addresses or domain names of the computers used by users browsing the Site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response provided by the server (successful, error, etc.), and other parameters related to the user’s operating system and IT environment. This Data is used solely for statistical purposes and to verify the proper functioning of the Site, and is deleted immediately after processing. The Data may be used to establish liability in the event of hypothetical cybercrimes against the Site, as further detailed in Section 4 of this policy.

Cookies

The Website collects Data using cookies or similar technologies. For more information, please visit the Website’s “Cookie Policy”.

3.2. Data Voluntarily Provided by the Data Subject

Certain parts of the Website—such as, for example, registration for online services (the so-called university intranet) for managing a student’s academic career, filling out specific forms to obtain more detailed information regarding requests made by the user, to register for events organized by the University, or to use the admission test simulation service, requires the Data Subject to provide certain personal data (including both general categories of data and special categories of data).

3.3. Third-Party Data

If you decide to provide us with third-party data, please ensure that these individuals have been adequately informed in advance about the methods and purposes of processing described herein.

Services Offered by the Website. Purposes of processing, legal basis, and retention period for personal data
Management of the “Contact Us” Section

The Data Controller provides users with the “Contact Us” section, through which they can request the information they need. For this purpose, a form is provided for collecting personal data (first name, last name, email address, phone number) and for the information users wish to send to the University.

Providing this data is optional for the user but is necessary in order to contact the University through the “Contact Us” section.

Legal basis for processing: Article 6(1)(b) of the GDPR: “Processing is necessary for the performance of a contract to which the data subject is a party.”

Retention period: The data is retained for 12 months from the last action taken in response to your request.

4.2. Management of the “Meet UniSR” Section

The Data Controller makes the “Meet UniSR” section available to users, which allows them to schedule an individual consultation with the career counseling office to learn more about degree programs, career counseling initiatives, admission requirements, and career opportunities. To schedule the meeting, the Data Controller has provided a form for data collection (first name, last name, user’s time zone, phone number, email address).

The provision of data by the user is optional but is necessary in any case to schedule the individual consultation with the counseling office.

Legal basis for processing: Article 6(1)(b) of the GDPR: “Processing is necessary for the performance of a contract to which the data subject is a party.”

Retention period: Personal data will be retained until the event is completed.

4.3. Registration and Creation of a Personal Account on the University Intranet

The Data Controller has created the university intranet, within which each user may, upon registration, create their own secure account to manage all activities—including administrative ones—related to their academic program. In the context of specific activities related to the management of the academic program, the Data Controller may also be required to collect information regarding the data subject’s health status or other strictly personal information.

The provision of data by the data subject is necessary for the management of their academic program.

Legal basis for processing: for general data, pursuant to Article 6(1)(b) of the GDPR, “processing is necessary for the performance of a contract to which the data subject is a party”; where applicable, with regard to special categories of data pursuant to Article 9(2)(g) of the GDPR, in conjunction with Article 2-sexies(2)(bb) of the Privacy Code, “processing is necessary for the performance of a task carried out in the public interest by the Data Controller.”

Retention period: Personal data is retained indefinitely for the entire duration of the University’s existence.

4.4. Management of Registration Requests for Activities, Initiatives, and Events Organized by UniSR

The Data Controller periodically organizes open house days—events that allow students and their families to learn about UniSR’s organization—as well as activities that enable users to prepare for admission tests through practice sessions, and opportunities for students (both high school and college) to attend classes directly online. To this end, the Data Controller has included specific forms on the Website that allow data subjects to register for individual activities. The Data Controller collects personal data such as first name, last name, email address, and, depending on the case, also the tax identification number, high school of origin, and nationality.

Providing this data is optional but is necessary for participation in the activity of interest.

Legal basis for processing: Article 6(1)(b) of the GDPR—“processing is necessary for the performance of a contract to which the data subject is a party.”

Retention period: Personal data is retained until the event is completed.

4.5. One-time distribution of satisfaction/evaluation questionnaires regarding activities offered by UniSr

The Data Controller processes the personal data provided by users who register, via designated forms, for individual activities organized by UniSr (see paragraph 4.4.) in order to send participants a specific satisfaction and evaluation questionnaire regarding the activity in question, with the aim of receiving feedback on the service provided and identifying any areas for improvement.

For the processing of personal data provided in the questionnaire, the Data Controller provides a specific privacy notice pursuant to Article 13 of the GDPR before the questionnaire is completed.

Legal basis for processing: Article 6(1)(f) of the GDPR, “processing is necessary for the purposes of the legitimate interests pursued by the data controller.”

4.6. Periodic Distribution of Reputation Surveys

The Data Controller, subject to the user’s free consent, processes the personal data contained in the registration forms for individual activities organized by UniSr in order to send registered users—on a periodic basis—reputation surveys (“reputation surveys”) to identify strengths and any areas for improvement and growth.

For the processing of personal data provided in the survey, the Data Controller provides a specific privacy notice pursuant to Article 13 of the GDPR before the survey is completed.

Legal basis for processing: Article 6(1)(a) of the GDPR—“processing requires the consent of the data subject.”

Providing consent is optional. The data subject may revoke their consent at any time by clicking the “unsubscribe” link at the bottom of the communication received or by writing to the Data Controller and/or the DPO at the email address indicated above, without prejudice to the lawfulness of the processing based on the consent given prior to revocation.

4.7. Sending Promotional and Marketing Communications

The Data Controller, subject to the user’s free choice, may send promotional and marketing communications, including newsletters, following the completion of specific forms provided on the Website for the collection of personal information (such as first name, last name, and email address).

Legal basis for processing: Article 6(1)(a) of the GDPR—“processing requires the consent of the data subject.”

Retention period: Personal data will be retained until the data subject requests the withdrawal of consent.

4.8. Handling of Ongoing Inquiries Regarding Scientific Conferences Organized by CeNRI

The Data Controller provides users with a dedicated form in the “Research” section dedicated to the Center for Nursing Research and Innovation (CeNRI). By entering their first name, last name, and email address, users can request to be kept informed about scientific conferences organized by this research center.

Providing this data is optional for the user but is necessary for processing the request.

Legal basis for processing: Article 6(1)(b) of the GDPR—“processing is necessary for the performance of a contract to which the data subject is a party.”

Retention period: Personal data is retained for a period of 1 year from the last participation in a conference organized by CeNRI, subject, however, to the possibility of unsubscribing from the service at any time via the footer at the bottom of each communication. In the latter case, personal data will be deleted immediately.

4.9. Establishing, Exercising, and Defending Rights in Extrajudicial and/or Judicial Proceedings

The Data Controller, where necessary, processes the personal data of Data Subjects collected through the Website in order to establish, exercise, or defend its rights in extrajudicial and/or judicial proceedings, or whenever judicial authorities exercise their judicial functions.

Legal basis for processing: Article 6(1)(f) of the GDPR, “processing is necessary for the purposes of the legitimate interests pursued by the controller.”

Retention period: Personal data will be retained for a period strictly limited to the duration of the dispute, until the time limits for filing appeals have expired.

4.10. Website Security

The Data Controller, where necessary, processes the personal data of Data Subjects collected through the Website in order to ensure the Website’s security.

Legal basis for processing: Article 6(1)(f) of the GDPR, “processing is necessary for the purposes of the legitimate interests pursued by the controller.”

Retention period: Personal data will be retained for the period strictly necessary to verify the security of the Website.

Methods of Processing and Disclosure of Personal Data

In pursuit of the purposes set forth in paragraph 4, the processing of personal data is carried out primarily by electronic or automated means, which are in any case suitable for ensuring the security and confidentiality of the data, as well as for preventing unauthorized access to personal data by third parties. In any case, personal data may be disclosed to:

persons authorized by the Data Controller to process personal data (pursuant to Article 29 of the GDPR and Article 2-quaterdecies of the Privacy Code), in their capacity as employees and/or collaborators, who have received adequate operational instructions, have committed to confidentiality, or are subject to an adequate legal obligation of confidentiality;
individuals, companies, or professional firms that provide assistance and consulting services to the Data Controller, duly appointed as Data Processors pursuant to Article 28 of the GDPR. The list of Data Processors is available to Data Subjects upon request from the Data Controller. By way of example, the following are some categories of entities that process data on behalf of the Data Controller: companies that provide hosting, communication, and marketing services, as well as university administrative management services;
Entities, bodies, or authorities to which the disclosure of the data subject’s personal data is mandatory pursuant to legal provisions or orders from the competent authorities.

Data is processed and stored on servers belonging to the Data Controller and/or third-party companies designated as Data Processors. These servers are located within the European Union.

Transfer of Data Outside the European Union

Personal Data is not transferred to countries outside the European Union and the European Economic Area.

Data Subjects Rights
Data Subjects Rights

Pursuant to Articles 15 through 22 of the GDPR, the Data Subject has the right to obtain, from the Data Controller, confirmation as to whether or not personal data concerning him or her is being processed and, if so, to obtain access to such data.

Furthermore, the Data Subject has the right to:

obtain confirmation from the Data Controller as to whether or not personal data concerning them are being processed, and to access their personal data and all information related to the processing carried out by the Data Controller;
request that the Data Controller rectify or erase the data or restrict the processing of data concerning them;
object to the processing of the data, subject to the Data Controller’s right to evaluate your request, which may not be granted if there are compelling legitimate grounds for the processing that override your interests, rights, and freedoms;
if the data were not collected from the data subject, to receive all available information regarding its origin;
to be informed of the existence of automated decision-making, including profiling as referred to in Article 22, paragraphs 1 and 4, and, at least in such cases, to receive meaningful information regarding the logic involved, as well as the significance and the anticipated consequences of such processing for the data subject;
in the cases and within the limits provided for by the GDPR, the Privacy Code, and any applicable sector-specific regulations, to exercise the right to data portability—that is, to receive data from the Data Controller in a structured, commonly used, and machine-readable format, and to transmit such data to another Data Controller without hindrance;
withdraw the consent provided for the purpose referred to in paragraph 4.5 at any time, without affecting the lawfulness of processing based on consent given prior to the withdrawal.

Please also note that, pursuant to Article 140-bis of the Privacy Code, the data subject may file a complaint with the Italian Data Protection Authority or bring an action before the courts.

Requests must be submitted in writing to the Data Controller or the DPO at the contact information provided in the header.

This Privacy Policy is effective as of April 19, 2024.