Privacy notice on the processing of personal data (Wellbeing and sport)

The Data Controller is the University of Padua, with its registered office at Via VIII Febbraio n. 2, 35122 - Padua. To contact the Data Controller, write an email to the certified email address amministrazione.centrale@pec.unipd.it or to the email address benessere.sport@unipd.it.

At the University, there is a Data Protection Officer, appointed pursuant to Article 37 of EU Regulation 2016/679, who can be contacted at the following email address: privacy@unipd.it.

The University processes the personal data provided by the data subject for the purpose of carrying out activities related to the provision of the wellbeing and sport service.

The personal data that may be processed, exclusively for the purposes indicated in point 4, are:

1. personal details and contact data;
2. images and video recordings taken during the course of the activity and events.

The processing of personal data is intended exclusively for carrying out wellbeing and sport activities for the benefit of all members of the university community and the wider public. In particular, the processing is carried out for the following purposes:

1. registration for the specific wellbeing and sport event;
2. management of the activities and communications relating to the event;
3. promotion of the University’s wellbeing and sport events;
4. surveys and statistical analyses carried out in order to improve the wellbeing and sport services offered, and for informative and outreach purposes concerning those activities and third mission activities.

The data subject's personal data are processed with the support of electronic and paper-based means.

The University adopts appropriate organisational and technical measures to protect and ensure the confidentiality of the personal data in its possession, in particular against the loss, theft, as well as the unauthorised use, disclosure or alteration of personal data.

Any statistical surveys are conducted anonymously and the results are disseminated exclusively in aggregated form, with no possibility of tracing back to the personal identity of the participants.

The University does not use automated decision-making processes relating to the data subject's rights on the basis of personal data, including profiling, in compliance with the safeguards provided for by Article 22 of the EU Regulation.

Any processing of special categories of data is carried out in compliance with the “Regulations for the processing of the University's sensitive and judicial data”, available at Regolamenti di interesse generale.

Personal identification and ordinary personal data, as well as images and video recordings, are processed for the performance of tasks carried out in the public interest as defined by law, the University Statute and internal regulations, pursuant to Art. 6(1)(e) of the EU Regulation.

With regard to staff, the processing of personal data is based on the performance of the contract and the rules governing the employment relationship.

Images contained in photographs, videos or other audiovisual material that may be acquired during the event may be published on the official communication channels of the University, where one of the following conditions applies:

1. signature of a specific release by the data subject or, in the case of minors, by the parent/legal guardian;
2. images connected with facts, events or ceremonies of interest to the community or taking place in public, with due respect for the honour, reputation and dignity of the persons concerned. In any case, compliance with the principles of moderation and relevance is guaranteed (exclusion of close-ups, blurring, “pixelation”, etc.).

If a specific release for the use of the images has not been collected, the University shall give notice, by means of a specific pictorial notice displayed near the event, that photographs or video recordings of participants will be taken during the event.

The recipients of the data are the natural persons appointed by the University to process the data, including the University’s employees and collaborators, including self-employed collaborators, or those of bodies affiliated with the University.

Data processors

The recipients of the data also include the Data processors appointed by the University, including:

• CINECA, as the main provider of IT services, with registered office at via Magnanelli 6/3, 40033 Casalecchio di Reno (BO) - CINECA Privacy policy;
• Google Ireland Limited, as the provider of the email service, with registered office at Gordon House, Barrow Street, Dublin 4, Ireland - GSUITE Privacy policy;
• exclusively for the purposes of delivering remote activities, Zoom Video Communications, Inc. is appointed as Data processor - San Jose, CA 95113, 55 Almaden Blvd, Suite 600 - Zoom Privacy policy;

In any case, personal data may be disclosed to third parties in connection with compliance with legal and contractual obligations, specific requests from the data subject, the handling of any complaints or disputes, and the prevention and prosecution of fraud and any unlawful activity.

The determination of the retention period for personal data complies with the principle of necessity of processing. Personal data will therefore be retained for the entire period necessary to carry out the purposes set out in section 4.

The data subject may exercise the rights provided for in Articles 15 et seq. of the EU Regulation, including the right of access, the right to rectification or completion of their data, the right to erasure (right to be forgotten) and restriction of processing, and the right to data portability, under the conditions and within the limits set out in the EU Regulation.

A request for the erasure of personal data cannot be granted to the extent that processing is necessary for compliance with a legal obligation, for the performance of institutional tasks, for the establishment, exercise or defence of a legal claim, and in any other case provided for by Article 17(3) of the EU Regulation.

The data subject has the right to object at any time to the processing of their personal data, in accordance with Article 21 of the EU Regulation.

The data subject may lodge a complaint with the Garante per la protezione dei dati personali.

To exercise their rights, the data subject may contact the University by writing to the certified email address amministrazione.centrale@pec.unipd.it or to the email address benessere.sport@unipd.it. Alternatively, the data subject may write to: University degli Studi di Padua, via VIII Febbraio n. 2, Padua.

The University is required to provide a response within one month of the request, extendable up to three months in the event of particular complexity of the request.

Amendments and additions to this privacy notice are published in the privacy section of the institutional website at www.unipd.it/privacy.

In any case, the University undertakes to communicate directly to data subjects, through its institutional channels, any changes to the purposes of the processing, the identity of the data controller, and any other change capable of significantly affecting the rights of data subjects or their exercise.