Privacy notice on the processing of personal data (Ombudsperson)

The Data Controller is the University of Padua, with registered office at Via VIII Febbraio n. 2, 35122 - Padua (certified email: amministrazione.centrale@pec.unipd.it).

The Data Protection Officer, appointed pursuant to Article 37 of the EU Regulation, may be contacted at the following e-mail address: privacy@unipd.it.

The University processes the personal data provided by the data subject to the Ombudsperson when submitting a complaint or grievance for the exercise of their rights.

The personal data that may be processed, exclusively for the purposes indicated in point 4, are:

1.  personal details (first name, surname, date of birth, sex), contact details, residence details and data relating to academic career;
2.  special categories of data (for example, data relating to health, racial and ethnic origin, sexual orientation) provided by the data subject and exclusively for the protection of their rights and interests;
3.  data relating to criminal convictions and offences.

Data processing is carried out exclusively for the following purposes:

1. to provide advice and assistance to data subjects in exercising their rights;
2. to handle complaints and grievances submitted by data subjects;
3. to ensure the impartiality, fairness and timeliness of the University's administrative action.

The data subject's personal data are processed with the support of IT-based and paper-based means.

The University adopts appropriate organisational and technical measures to protect the personal data in its possession, through security measures suitable to guarantee the confidentiality and security of personal data, in particular against the loss, theft, as well as the unauthorised use, disclosure or alteration of personal data.

The Data Controller does not use automated decision-making processes concerning the data subject's rights on the basis of personal data, including profiling, in compliance with the safeguards provided for in Art. 22 of the EU Regulation.

Any processing of special categories of data, referred to in point 3), letter b), is also carried out in compliance with the “Regulations for the processing of the University's sensitive and judicial data”, which can be consulted on the page Regolamenti di interesse generale

The personal email mailbox, including certified email, any telephone contact communicated by the data subject, and the institutional email mailbox assigned at the time of enrolment or registration, or personally at the Difensore civico, are the means through which all communications and information relating to the pursuit of all the purposes indicated in point 4 are provided.

The provision of personal data for the purposes indicated in point 4 is essential for the establishment and management of the relationship between the data subject and the Ombudsperson, for the provision of the related assistance and consultancy services, and for compliance with the related legal obligations.

The processing of personal data within the scope of the purposes indicated in point 4 is carried out by the Controller on the basis of at least one of the following lawful conditions.

Personal identification and ordinary personal data (point 3, letter a) are processed for the performance of tasks carried out in the public interest as defined by law, by the Statute and by internal regulations (pursuant to Article 6(1) of the EU Regulation).

Consent is the legal basis for the processing of special categories of data (such as, for example, data relating to health, political opinions or religious beliefs, etc.) and judicial data (point 3, letters b and c), where one of the following legal bases does not apply:

a)    for reasons of substantial public interest on the basis of European Union or national law pursuant to Article 9(2)(g) of the EU Regulation and Article 2-sexies, paragraph 2, letter bb), of Legislative Decree No. 196/2003;
b)    for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Article 9(2)(j) of the EU Regulation and Article 2-sexies, paragraph 2, letter cc), of Legislative Decree No. 196/2003;
c)     for the establishment, exercise or defence of a legal claim in judicial proceedings.

The recipients of the data are the natural persons appointed by the University and assigned to the Ombudsperson, on whom they depend functionally.

Where necessary, the Ombudsperson avails themself of the collaboration of the University’s administrative offices in carrying out their functions of safeguarding data subjects. The staff are bound by official secrecy with regard to the facts and documents of which they become aware in the course of performing their duties.

Personal data are not subject to disclosure.

The determination of the retention period for personal data complies with the principle of necessity of processing. Personal data are therefore retained for the entire period necessary to fulfil the purposes set out in point 4.

The data subject is granted the following rights:

1. right of access to their personal data (Art. 15 of the EU Regulation);
2. right to rectification or completion of their data (Art. 16 of the EU Regulation);
3. right to erasure (right to be forgotten), pursuant to Art. 17 of the EU Regulation;
4. right to restriction of processing under the conditions set out in Art. 18 of the EU Regulation;
5. right to data portability, as governed by Art. 20 of the EU Regulation;
6. right to object at any time to processing (Art. 21 of the EU Regulation);
7. right to lodge a complaint with the Garante per la protezione dei dati personali.

To exercise their rights regarding the protection of personal data, the data subject may contact the Data Controller by writing to the email address urp@unipd.it or to the certified email address amministrazione.centrale@pec.unipd.it. Alternatively, the data subject may write to: University of Padua, via VIII Febbraio n. 2, Padua.

The Data Controller is required to provide a response within one month of the request, extendable up to three months in the event of particular complexity of the request.

Any amendments and additions to this privacy notice are published in the privacy section of the institutional website at https://www.unipd.it/difensore-civico.