Privacy Policy

Information on the processing of personal data

Foreword

Pursuant to Art. 13 of Regulation (EU) 2016/679 (General Data Protection Regulation or GDPR) of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, as well as Legislative Decree 196/2003 and subsequent amendments and additions, the University of Milan, hereinafter also referred to as the ‘University’, in the person of the Rector pro tempore, informs users regarding the use of their personal data by the sites that are part of the service (hereinafter also referred to as the ‘site’). This information is provided with regard to the manner in which the site is managed, in relation to the processing of the personal data of the users who consult it, who choose to register and/or who use the online services offered. This is without prejudice to compliance by the University of Milan with current legislation on transparency and the mandatory publication of data and documents. This information is limited to the sites listed here and has no value for external sites, even if they are accessible from links present on the same:

www.tracesofmobility.unimi.it

1. Data Controller and Data Protection Officer (DPO)

The data controller is the University of Milan, in the person of the Rector pro tempore, Via Festa del Perdono no. 7, 20122 Milan, e-mail infoprivacy@unimi.it. Pursuant to Articles 37 et seq. of EU Regulation 2016/679, the University has appointed a Data Protection Officer (DPO) who can be contacted at the e-mail address dpo@unimi.it.

2. Purpose and legal basis of the processing

The personal data that may be processed are: – IP address;

– browser type and parameters of the device used to connect to the site;

– name of the internet service provider (ISP);

– date and time of visit;

– the visitor’s web page of origin (referral) and exit;

– number of clicks, if any;

– provided voluntarily by the user when using online services offered on the site;

– data provided from time to time by users in relation to the specific service requested.

The aforementioned information is processed automatically and collected in aggregate form in order to verify the proper functioning of the site and for security reasons.

For security purposes (anti-spam filters, firewalls, virus detection), the automatically recorded data may possibly include personal data such as the IP address, which could be used, in accordance with the law in force, to block attempts to damage the site or cause damage to other users, or in any case harmful or criminal activities. In any case, such data will never be used for the purpose of profiling the site’s users, but only for the purpose of protecting the site and its users. The legal bases of the processing are therefore compliance with legal and contractual obligations, the fulfilment of specific requests by the data subject prior to the conclusion of the contract, and the processing of data connected with the management of any complaints or disputes and for the prevention and suppression of fraud and any illegal activity.

Personal data will also be processed in order to process the contact request made by the user via the form on the site. For the aforementioned purpose, personal data will be processed:

– company name;

– contact person profile (department);

– email;

– telephone;

– type of project;

– any further information entered in the contact form, inherent to the services managed.

Please note that in no section of the site, nor for access to any functionality of the site, is the provision of ‘special categories of personal data’ and/or ‘personal data relating to criminal convictions and offences’, as defined by Articles 9 and 10 of EU Reg. 679/2016, required. Should the User spontaneously send the Data Controller information of the aforementioned type, the Data Controller will delete it as it is not strictly necessary for the aforementioned purpose.

The legal basis of the processing relates to the provisions of Article 6 paragraph 1 letter a) of EU Reg. 679/2016, in that the data subject has given consent to the processing of his/her personal data for one or more specific purposes.

3. Types of data processed

Personal data are collected for the following purposes and using the following services. The computer systems and application procedures used to operate the site acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols. This information is used to obtain anonymous statistical information on the use of the site and to check its correct functioning and is not associated with identified users; however, due to its nature and through association with data held by third parties, it could allow the identification of the interested parties. This category includes, for example, the IP address of the system used to connect to the portal. This data is removed from the systems after the statistics have been processed and is stored off-line exclusively for the purposes of ascertaining liability in the event of computer offences and can only be consulted at the request of the judicial authorities.

For the use of online services that require authentication, registration or the sending of e-mails, personal data freely provided by users are used in various ways. The optional, explicit and voluntary sending of e-mails to the addresses indicated on the site entails the subsequent acquisition of the sender’s address, which is necessary in order to reply to requests, as well as any other personal data included in the message by the user.

4. Optional supply of data

Some of the data requested (e.g. those for registration and/or subscription to online services) are compulsory and failure to provide them will make it impossible to use the service requested. Registration and/or subscription data are provided voluntarily. Processing carried out prior to the revocation of consent by the person concerned shall nevertheless remain valid.

5. Method of processing

Data are collected in accordance with the principles of relevance, completeness and non-surplus in relation to the purposes for which they are processed. The personal data provided are processed in compliance with the principles of lawfulness, correctness and transparency, as set out in Article 5 of the GDPR, also with the aid of computerised and telematic tools suitable for storing and managing the data themselves, and in any case in such a way as to guarantee their security and protect the utmost confidentiality of the data subject. The data may be processed in anonymous form for the performance of statistical activities aimed at improving the services offered.

6. Use of cookies

Cookies are text files that are deposited on the computers of web users to enable the safe and efficient exploration of the site and to monitor its use.

The sites listed above use technical cookies and tracking cookies. No profiling cookies are used for purposes other than those stated here. However, there may be other profiling cookies or cookies with purposes different from those stated here used by third party services.

6.1 Technical, session (essential for the use of online services and access to reserved areas of the portal) and tracking cookies

The sites listed above use various http session cookies to manage authentication to reserved areas. The use of session cookies (which are not stored persistently on the user’s computer and are deleted when the browser is closed) is strictly limited to the transmission of session identifiers (consisting of random numbers generated by the server) necessary to allow secure and efficient exploration of the site. Disabling session cookies does not allow you to fully enjoy the resources made available on the site.

Tracking cookies can be disabled without any consequence on portal navigation: to disable them, see the next section.

6.2 Technical and monitoring cookies used

To find out which first- and third-party cookies are used, their retention period and how to customise your preferences, see the site’s cookie/cookie settings page.

6.3 How to disable cookies (opt-out)

You may deny your consent to the use of cookies by selecting the appropriate setting on your browser: unauthorised browsing on the site will still be available in full. Below we provide links explaining how to disable cookies for the

most widely used browsers (for other browsers that you may use, we suggest you look for this option in the help of the software normally available via the F1 key): Internet Explorer: http://windows.microsoft.com/it-IT/windows7/Block-enable-or-allow-cookies Google Chrome: https://support.google.com/chrome/bin/answer.py?hl=it-IT&answer=95647&p=cpn_cookies Mozilla Firefox: http://support.mozilla.org/it/kb/Bloccare%20i%20cookie?redirectlocale=en-US&redirectslug=Blocking+cookies Apple Safari: http://www.apple.com/it/privacy/use-of-cookies/

7. Rights of the data subject

The Data Subject may lodge a complaint with a supervisory authority and exercise the right under Articles 15 to 22 of the GDPR to

– to lodge a complaint with a supervisory authority

– request from the data controller access to the personal data concerning him/her, rectification or erasure of the same, restriction of processing

– object to the processing;

– request data portability,

by addressing the following contacts: Data Protection Officer – Via Festa del Perdono 7, 20122 Milan – e-mail: dpo@pec.unimi.it.

8. Changes to the information

This information may change over time. You are therefore advised to check, in the Privacy section of the website, that the version you are referring to is the most recent.