INFORMATION ON THE COLLECTION AND PROCESSING OF DATA PURSUANT TO ART. 13 OF EU REGULATION N. 679/2016 OF 27 APRIL 2016
The current information is issued pursuant to art. 13 of EU Regulation 2016/679 of 27 April 2016 relating to the protection of natural persons with regard to the processing of personal data and in compliance with the legislation on the processing of personal data, as well as the free circulation of such data.
In particular, this Information refers to the conference DD29.
Data controller
Politecnico di Milano – General Director delegated by the Rector pro-tempore – contact: dirgen@polimi.it.
Internal data controller
Gabriele Ciaramella, Associate Professor at Politecnico di Milano, email: gabriele.ciaramella@polimi.it.
The data will be processed by further authorized parties trained for this purpose in compliance with current legislation.
Data Protection Officer and Contact Points Mail: privacy@polimi.it .
Purpose of processing, legal basis, categories of data and retention period.
For the purposes of applying European and national legislation on the matter (EU Reg. 679/2016, hereinafter Regulation), we inform you that your personal data will be used for the following purposes:
| Purpose of the processing for which the personal data are intended | Legal basis of the data processing | Categories of personal data being processed | Personal data retention period |
| Purpose 1 Registration for participation in the conference Purpose 2 Sensitive data processing (allergies, food intolerances) Purpose 3 Third parties data sharing and transfer | Consensus (art. 6 par.1, lett A – GDPR) | • Identification data • Personal data • Contact details • Health data (food allergies and intolerances) • Images and audio/video recordings | The data collected will be kept for a period of 2 years. |
We inform you that for the envisaged Purpose 1, the interested party may be the subject of audio-video filming and recordings. The data subject to processing, including images, filming and audio/video recordings (hereinafter, the “Images”), even in partial and/or modified or adapted form, made during the event will be processed, in full compliance with EU Regulation 2016/679.
The data will be processed, also with the aid of electronic means, by persons specifically appointed for the Data Controller’s dissemination and communication activities. The collected Images will be stored, also in electronic form and on any technological support for the purposes and within the limits defined above and may be disseminated pursuant to Law no. 150/2000 on institutional sites as well as through social network channels (Facebook, Twitter, Youtube by way of example but not limited to). The use of the images does not entitle you to any compensation.
The Owner has the right to access or disclose the user’s Images without any consent, pursuant to art. 97 of law no. 633/1941. This authorization implies the granting of a non-exclusive license, without duration limits and for the whole world, transferable to third parties, for the use of the Materials and includes the rights referred to in the articles. from 12 to 19 of the law of 22 April 1941, n. 633, including but not limited to: right of publication; right of reproduction in any way or form; right of transcription, editing, adaptation, processing and reduction; right of communication and distribution to the public, including the rights of projection, transmission and diffusion, including in summary and/or abridged versions, by any technical means, right to keep a copy of the Materials, including in electronic form and on any known technological support or future invention for the purposes and within the limits defined above.
It is in any case excluded pursuant to the aforementioned article and pursuant to art. 10 of the Civil Code any use of the Images that may cause damage to the honour, reputation or decorum of the person portrayed, filmed or recorded.
Data nature
The provision of the data requested for the purposes listed above is optional. In the absence of the requested data, the expected services/envisaged activities cannot be guaranteed.
Special categories of personal data
Pursuant to art. 9 of EU Regulation no. 2016/679, data that can be classified as “particular categories of personal data” may be processed, subject to the explicit consent of the interested party, in particular information relating to:
· food allergies and intolerances
communicated by the interested party during registration, in order to guarantee his participation in the event in the best possible way.
Processing Methods
The processing or treatments carried out for the purposes indicated above can be carried out both on paper and digitally, manually and/or with electronic or, in any case, automated tools, including in-house databases.
They are also stored in paper archives for the duration of the conference and in digital format indefinitely due to the obligations of transparency and good functioning of the public administration.
Access to the data acquired for the aforementioned purposes is permitted to duly authorized personnel.
Categories of recipients
In relation to the purposes indicated, the data may be communicated to public and/or private entities, or they may be communicated to companies and/or people who provide services, including external ones, on behalf, of the data controller.
In particular, the data collected my be transmitted to providers necessary for carrying out the initiative, who are formally appointed by the Politecnico di Milano as “External Data Processors”.
Furthermore, the data collected may be communicated to third party recipients for their own purposes as part of the initiative or similar events, subject to the explicit consent of the interested party.
In particular, the data will be transmitted to:
· DDM association
Lastly, personal data may also be communicated to other public administrations, such as anonymously if they need to process the same for any proceedings within their institutional jurisdiction, as well as to all those public entities to whom, in the presence of the relevant conditions, communication is required by provisions of the European law, laws or regulations, as well as insurance bodies for any accident practices.
Transfer to a non-EU country or international organizations
Personal data will be processed by the Data Controller within the territory of the European Union.
If for technical and/or operational reasons it is necessary to make use of subjects located outside the European Union, or it is necessary to transfer some of the data collected to technical systems and
services managed in the cloud and located outside the area of the European Union, the processing will be regulated in accordance with the provisions of Chapter V of the EU Regulation and authorized on the basis of specific decisions of the European Union
All necessary precautions will therefore be taken to ensure the most complete protection of personal data, basing the transfer on:
a) on adequacy decisions of the recipient third countries expressed by the European Commission;
b) on adequate guarantees expressed by the third party recipient pursuant to art. 46 of the EU Regulation;
c) on the adoption of binding corporate rules, so-called. Corporate binding rules.
Rights of interested parties
As an interested party, it is possible to ask at the Data Controller at any time:
· confirmation of the existence or otherwise of personal data concerning him;
· access to your personal data and information relating to them; the rectification of inaccurate data or the integration of incomplete data; the deletion of personal data concerning you (upon the occurrence of one of the conditions indicated in art. 17, paragraph 1 of the Regulation and in compliance with the exceptions provided for in paragraph 3 of the same article); the limitation of the processing of your personal data (in the event of one of the hypotheses indicated in art. 18, paragraph 1 of the Regulation), the transformation into anonymous form or blocking of data processed in violation of the law, including those for which it is not conservation is necessary in relation to the purposes for which the data were collected or subsequently processed;
·As an interested party, you also have the right to object in whole or in part:
· for legitimate reasons to process personal data concerning him, even if pertinent to the purpose of the collection;
· to the processing of personal data concerning him for the purposes of sending and promoting training initiatives and cultural events of the Polytechnic of Milan.
These rights can be exercised by contacting privacy@polimi.it.
If you believe that your rights have been violated by the owner and/or a third party, you have the right to lodge a complaint with the Personal Data Protection Authority and/or other competent supervisory authority pursuant to the Regulation.
Milano, 20 Maggio 2024.