Information on the processing of personal data (Contracts and Tenders)

The Data Controller is the University of Padova (hereinafter the University), with legal campus in Via VIII Febbraio n. 2, 35122 - Padova
(certified e-mail: amministrazione.centrale@pec.unipd.it).

At the University there is a Data Protection Officer, appointed pursuant to art. 37 of the EU Regulation. The Data Protection Officer can be contacted at privacy@unipd.it.

The personal data that may be processed by the Data Controller for the purposes indicated in point 4 are specified.

1. Personal data provided directly by the data subject belonging to the data subject and its employees and collaborators (including, by way of example, legal representatives, partners, attorneys, employees, delegates and related parties). Common data, such as personal data, tax identification code (of employees or customers), identification of identity documents (driver's license/C.I./Passport), contact data (PEC, e-mail, telephone contacts), credentials, personal identification code (Customer ID), economic/financial, tax data, bank details, credit card and transactions.
2. Personal data, including special and judicial data, acquired from public administrations and judicial authorities. Judicial data contained in the criminal record, in the register of administrative sanctions dependent on crime and related pending charges, or the status of defendant or suspect, conditional release, prohibition or obligation to stay, alternative measures to detention. Judicial data, i.e. personal data relating to criminal convictions and offences or related security measures, are processed in compliance with Art. 10 of the EU Regulation and art. 2-octies of Legislative Decree no. 196 of 30 June 2003 (so-called "Legislative Decree no. Privacy Code).

The data acquired are processed for the stipulation and execution of contracts and agreements between the University and third parties and for the conduct of any tender procedures, starting from the qualification and enrolment of companies in the University Electronic Market (hereinafter Me.Unipd) and in the University Procurement Portal, including the storage of administrative and technical documentation and the related further obligations.

In particular, the data are processed for the following purposes:

1. verification of all the general and special requirements of the contractor, required in fulfilment of precise legal obligations and tender documentation;
2. management of the participation and use of the Electronic Market by authorized interested parties and administrations. As part of this purpose, for example, the data of the interested parties-authorized suppliers, as well as the commercial information concerning the products and contained in the catalogues (products offered, price and so on), are published on the Electronic Market platform and made visible and accessible to the Ordering Points, in the manner and within the limits necessary for the correct use of the Electronic Market; suppliers' data are acquired by the Ordering Points for the purposes of the procedure for choosing the contractor, the subsequent stipulation and execution of the Contract, including the legal, fiscal, accounting obligations related to it and the related economic and administrative management and execution;
3. stipulation of the contract or agreement;
4. execution of the contract or agreement and any amendments, including those subsequently concluded with the interested parties;
5. management of litigation or debt collection procedures;
6. any market research, economic and statistical analysis, disclosure of services, sending of information material and updates on initiatives and programs of the University, for purposes related to the monitoring of consumption and the control of expenditure, as well as for the analysis of further cost savings that can be obtained, for the exercise of information activities with other Public Administrations and for further purposes related and connected to the implementation of the syllabus of rationalisation of public spending.

The processing of data is carried out in such a way as to guarantee maximum security and confidentiality and can be carried out using manual, computer and telematic tools suitable for storing, managing and transmitting them. These data may also be combined with those of other subjects on the basis of qualitative, quantitative and temporal criteria identified from time to time as part of the activities indicated in point 4.

The personal data collected through the platforms published https://www.unipd.it/portale-appalti are stored on the servers of the CINECA Interuniversity Consortium and protected by appropriate IT security measures, according to the indications of the Agid Guidelines.

Automated decision-making processing of the collected data is excluded.

The processing of personal data is carried out by the University exclusively for the purposes indicated in point 4 and on the basis of one of the following conditions of lawfulness:

1. execution of a contract to which the data subject is a party or of pre-contractual measures adopted at the request of the same pursuant to art. 6(1)(b) of the EU Regulation;
2. fulfilment of a legal obligation to which the Data Controller is subject pursuant to art. 6(1)(c) of the EU Regulation.

Special personal data are processed for reasons of important public interest pursuant to Art. 9(2)(g) of the EU Regulation.

The processing is necessary for the completion of the contract or agreement, the completion of tender procedures as well as the fulfilment of specific contractual, regulatory and tax obligations for the University. The provision of data is therefore mandatory for the stipulation of the contract or agreement, for the awarding of the contract and for the purpose of participating in the tender procedures announced by the University and the management of any obligations related to them.

The data may be communicated, exclusively for the purposes indicated in point 4, to University staff, to independent collaborators, professionals, consultants, including external ones, to other parties involved in the contractual relationship and to data processors and sub-processors who may be designated for the execution of the contract.

Personal data are also communicated to the National Anti-Corruption Authority (ANAC) pursuant to art. 213 of Legislative Decree No. 50 of 18 April 2016 (Public Procurement Code), as well as to other interested parties who request access to the documents of the procedure within the limits permitted pursuant to Law No. 241 of 7 August 1990 (New rules on administrative procedure).

Within the limits of the legal obligations that impose administrative transparency, personal data are published and disseminated through the website www.unipd.it, in the "Transparent Administration" section.

The University, subject in any case to compliance with the rules on the correct processing of data, may transfer data to third countries outside the European Union only in case of necessity attributable to the institutional purposes of the institution (for example, reporting activities of international projects).

Personal data will be stored for as long as necessary for the fulfilment of the purposes set out in point 4. The retention period, therefore, is directly related to the duration of the procedures and the fulfilment of all legal obligations, including subsequent ones, as well as the execution of the contract or agreement. After the termination of the contractual effects and the conclusion of the procedure, the data will be stored in accordance with the rules on the retention of administrative documentation.

Personal data may be stored for a longer period, if the need arises for a legitimate purpose, such as the defense, including in court, of the University's rights.

The data subject has the following rights:

1. right of access to your personal data (art. 15 EU Regulation);
2. right to rectification or integration of your data (art. 16 EU Regulation);
3. Right to erasure (right to be forgotten), within the limits permitted by art. 17, paragraph 3, EU Regulation;
4. Right to restriction of processing under the conditions set out in Art. 18 EU Regulation;
5. right to data portability, as governed by art. 20 EU Regulation;
6. the right to object to the processing at any time (Article 21 of the EU Regulation);
7. the right to lodge a complaint with the Data Protection Authority.

To exercise their rights, the interested party may contact the University, by writing to the certified e-mail address amministrazione.centrale@pec.unipd.it or to the e-mail address urp@unipd.it. Alternatively, the interested party can write to: University of Padova, via VIII febbraio n. 2, Padova.

The University is required to provide a response within one month of the request, extendable up to three months in case of particular complexity of the request.

Any changes and additions to this policy are published in the privacy section of the institutional website at www.unipd.it/privacy.