Privacy Policy

This Privacy Policy was drawn up pursuant to art. 13 and 14 of Regulation (EU) 2016/679 (hereinafter also "Rules"or"GDPR"), in order to inform those who interact with the site www.unicampus.it (hereinafter, also the "Website") regarding the ways in which personal data will be processed both through simple consultation and through the use of specific services made available through the Site.

The information is provided exclusively for the site mentioned above and not for other websites or sections/pages/spaces owned by third parties that may be consulted by the user via specific links for which reference is made to the respective privacy policies. 

***

1. OWNER AND DATA PROTECTION OFFICER

The Data Controller is theUniversità Campus Bio-Medico di Roma (right away, "UCBM","University"or"Holder"), CF 97087620585 with registered office in Rome, in Via Álvaro del Portillo n. 21. The data protection officer (hereinafter, "(Data Protection Officer or DPO)"or"DPO") can be contacted at the following addresses:

• by e-mail, to the address: [email protected];
• by ordinary mail, to the address ofUniversità Campus Bio-Medico di Roma, based in Rome (RM) at via Alvaro del Portillo, n. 21, CAP 00128, ca of the Data Protection Officer.

2. PERSONAL DATA SUBJECT TO PROCESSING

The Data Controller will process the following categories of Personal Data:

to. Browsing data

The Data Controller will process the common type of Personal Data collected as part of your browsing on the Site. Such Personal Data includes, for example, the IP address, the location (country), the domain names of your computer or device. used, the URI (Uniform Resource Identifier) ​​addresses of the resources requested on the Site, the time of the requests, the method used to send the requests to the server, the size of the file obtained in response to a request, the numerical code indicating the status of the response given by the server (success, error, etc.), and so on.

The operation of the Site, in fact, involves the use of computer systems and software procedures that collect information on users of the Site as part of their normal operation. Although the Owner does not collect such information in order to link it to specific users, it is still possible to identify such users either directly through such information, or by using other information collected - as such, this information is also considered personal data.

b. Common data voluntarily provided

The Data Controller will process common Personal Data provided in the context of requests forwarded to the email addresses and assistance telephone numbers on the Site or voluntarily provided in the relevant contact or course registration/registration forms. Where necessary, specific vertical information on the processing of personal data pursuant to articles. 13 and 14 of the Regulation and any requests for consent will be progressively reported or displayed on the pages prepared for particular Services accessible through this Site.

d. Cookies

The Owner will process Personal Data collected through cookies and other tracking tools. For more information on the Personal Data processed through cookies and other tracking tools, you can consult the relevant information Cookies Policy.

3. PURPOSE OF THE PROCESSING AND LEGAL BASIS OF THE PROCESSING

Your data will be processed for the following purposes:

a) allow navigation of the Site and interaction with the contents present therein, including the management of the security of the Site

The Data Controller will process, pursuant to theart. 6.1, letter. b), of the Regulation (legal basis), the Personal Navigation Data referred to in the previous paragraph 2, letter. a), in order to allow you to access and navigate the Site as well as to guarantee its correct functioning. The provision of Personal Data for this purpose is optional but failure to provide it would make it impossible to access and navigate the Site.

b) manage and respond to specific requests or provide the requested services

The Data Controller will process, pursuant to theart. 6.1, letter. b) of the Regulation (legal basis) the common type of Personal Data referred to in the previous paragraph 2, letter. b), in order to satisfy a request or provide a service. The provision of Personal Data for this purpose is optional but failure to provide it would make it impossible to forward the request and, consequently, to receive a response from UCBM.

c) fulfill any obligations established by current laws, regulations or legislation community, or satisfy requests from the authorities

The Data Controller will process, pursuant to theart. 6.1, letter. c) of the Regulation (legal basis: legal obligation), the Personal Data referred to in the previous paragraph 2 in order to fulfill a regulatory obligation weighing on the same.

d) satisfy any defensive needs, possibly connected to the detection, prevention, mitigation and verification of fraudulent or illegal activities in relation to the services provided on the site

The Data Controller will process, pursuant to theart. 6.1, letter. f) of the Regulation (legal basis: legitimate interest), the Personal Data referred to in the previous paragraph 2 for the purpose of defending one's right and/or legitimate interest in judicial and extrajudicial proceedings. We remind you that, pursuant to art. 21 of the Regulation, you have the right to object at any time, based on your particular situation, to the processing of your Personal Data for this purpose. In the event of opposition, the Data Controller reserves the right to evaluate this request, which may not be accepted if there are compelling legitimate reasons to proceed with the processing which prevail over your interests, rights and freedoms.

e) market purposesing direct

The Data Controller will process, subject to his consent pursuant to theart. 6.1, letter. a) of the Regulation (legal basis: consent), the Personal Data referred to in the previous paragraph 2 letter. b), also for promotional and information purposes, including customer satisfaction activities and the sending of newsletters, relating both to training activities in the academic field or to orientation initiatives and events annually planned by theUCBM (e.g. fairs or Open Days organized by the University, etc.), through automated tools (SMS, MMS, e-mail, use of social networks, WhatsApp) and non-automated tools (ordinary mail, telephone with operator) and in the clinical setting -scientific, also in order to raise awareness of fundraising for the support and development of scientific research, through automated tools (SMS, MMS, e-mail, automated call systems without operator, use of social networks, WhatsApp) and otherwise (ordinary mail, telephone with operator).

f) for profiling purposes

The Data Controller, subject to his consent pursuant to theart. 6.1, letter. a) of the Regulation (legal basis: consent), the Personal Data referred to in the previous paragraph 2 letter. b) also for the analysis of your preferences relating to the degree courses and possibly the course you attended, in order to better structure personalized promotional communications (relating to initiatives and events, including orientation events, organized by the Campus Biomedico University), or to carry out general analyzes for strategic orientation purposes and, in general, for profiling activities.

g) for soft spam purposes

The Data Controller will process, pursuant to theart. 6.1, letter. f) of the Regulation (legal basis: legitimate interest), the Personal Data referred to in the previous paragraph 2 letter. b) in order to send commercial communications via email about products or services similar to those already purchased. We remind you that, pursuant to art. 21 of the Regulation, you have the right to object at any time, based on your particular situation, to the processing of your Personal Data for this purpose. In the event of opposition, the Data Controller reserves the right to evaluate this request, which may not be accepted if there are compelling legitimate reasons to proceed with the processing which prevail over your interests, rights and freedoms.

4. RECIPIENTS OF PERSONAL DATA

Your Personal Data may be shared, for the purposes referred to in paragraph 3 of this Privacy Policy, with the following subjects below, collectively defined as "Recipients":

- persons authorized by the Data Controller, pursuant to articles. 29 and 32 of the Regulation and 2-quaterdecies of Legislative Decree 196/2003 (so-called "Privacy Code"), to the processing of personal data necessary to carry out activities strictly related to the provision of services, which are committed to confidentiality or have an adequate legal obligation of confidentiality;

- subjects who typically act as data controllers pursuant to art. 28 of the Regulation on behalf of the Owner, in particular subjects in charge of providing services necessary for the usability of the Site (for example, hostsing providers, suppliers of technical maintenance services, etc.); Furthermore, the Data Controller may communicate your Personal Data to subjects, bodies or authorities whose communication is mandatory pursuant to legal provisions or orders of the authorities. These subjects will process the Personal Data as independent data controllers.

5. UNDERAGE USERS

If the user is under 16 years of age, it is advisable not to use the contact forms on the website as the data referring to minors must be communicated by those exercising parental responsibility. In the event that they are communicated directly by the interested parties, the data thus collected will be deleted and will be processed in no way. We do not knowingly collect personal information from minors under 16 years of age, and consequently there is no liability on our part.

6. TRANSFERS OF PERSONAL DATA

Some of your personal data may be shared with Recipients located outside the European Economic Area. The Data Controller ensures that in such cases, the processing of personal data by the Recipients takes place in compliance with the law or according to one of the methods permitted by law pursuant to articles. 44-49 of the Regulation, such as the consent of the interested party, the adoption of Standard Clauses approved by the European Commission, the selection of subjects adhering to international programs for the free circulation of data, in compliance with the provisions of Recommendations 01/ 2020 adopted on 10 November 2020 by the European Data Protection Board.

7. STORAGE OF PERSONAL DATA

Personal Data processed for the purposes referred to in paragraph 3, letter. a), b) of this Privacy Policy will be processed for the time strictly necessary to achieve those same purposes in compliance with the principles of minimization and limitation of conservation referred to in art. 5, par. 1, letter. c) and d) of the Regulation.

Personal Data processed for the purposes referred to in paragraph 3, letter. c) of this Privacy Policy will be kept until the time required by the specific obligation or applicable law. 

The Data Controller also reserves the right to retain Personal Data for as long as necessary to ascertain and exercise one's rights and/or satisfy any defense needs in court as well as in extrajudicial matters and in the phases preceding the dispute. 

Personal Data processed for marketing purposesing and profiling referred to in paragraph 3, letter. e) and f), will be processed until the consent is revoked and in any case no later than 2 years. For data processed on the basis of legitimate interest, the deadline for storage is identified as long as it is reasonably necessary to pursue the legitimate interest of the Data Controller identified in this information, unless you object, which is always possible.

8. RIGHTS OF THE INTERESTED PARTY

You, as an interested party, can, at any time, exercise the following rights:

• Right of access (art. 15 of the Regulation) – You have the right to obtain confirmation as to the existence or otherwise of processing concerning your personal data as well as the right to receive any information relating to the same processing; 
• Right of rectification (art. 16 of the Regulation) – You have the right to obtain the rectification of your personal data, if they are incomplete or inaccurate; Please note that, with respect to personal data collected through audio and video recording systems, the right of rectification cannot actually be exercised in consideration of the intrinsic nature of the data collected, which relates to an objective and specific fact; 
• Right to cancellation (art. 17 of the Regulation) – in certain circumstances, you have the right to obtain the cancellation of your personal data present in our archives; 
• Right to limit processing (art. 18 of the Regulation) – upon the occurrence of certain conditions, you have the right to obtain the limitation of the processing of your personal data; 
• Right to portability (art. 20 of the Regulation) – You have the right to obtain the transfer of your personal data to a different data controller as well as the right to obtain the data that is in a structured, commonly used and machine-readable format. They concern her; 
• Right to object (art. 21 of the Regulation) – You have the right to formulate a request to object to the processing of your personal data in which to highlight the reasons justifying the opposition; the Data Controller reserves the right to evaluate this request, which may not be accepted if there are compelling legitimate reasons to proceed with the processing which prevail over your interests, rights and freedoms.

Furthermore, if you believe that the processing of your Personal Data violates the legislation on the protection of personal data, we inform you that you have the right, pursuant to art. 77 of the Regulation, to lodge a complaint with the Supervisory Authority of the Member State in which he habitually resides, works or the place where the alleged violation occurred.

9. UPDATES TO THIS WEB POLICY

The Owner reserves the right to modify or simply update the content of this Privacy Policy, in part or completely, also due to changes in applicable legislation. The Data Controller therefore invites you to regularly visit this section to become aware of the most recent and updated version of the Privacy Policy in order to always be updated on the data collected and the related processing by the Data Controller.

10. HOW TO CONTACT THE DATA CONTROLLER AND EXERCISE THE RIGHTS OF THE INTERESTED PARTY

In case of questions or doubts in relation to the processing of Personal Data or to exercise any other right mentioned above, the interested party may send a written communication by registered letter with return receipt. Università Campus Bio-Medico di Roma, with registered office in Rome, in Via Álvaro del Portillo n. 21 to the DPO - Data Protection Officer or by email to the address [email protected].