Privacy notice on the processing of personal data (Payments)

The Data Controller is the University of Padua, with registered office at Via VIII Febbraio n. 2, 35122 - Padua (PEC address:
amministrazione.centrale@pec.unipd.it

The Data Protection Officer is appointed within the University, in accordance with Article 37 of the EU Regulation, and may be contacted at the following email address: privacy@unipd.it

The University processes the personal data of those who interact with the Pago PA Portale dei Pagamenti-Portale service, accessible electronically from the address:
https://unipd.pagoatenei.cineca.it

The personal data that may be processed exclusively for the purposes indicated in point 4 are:

a)  Personal, identity and contact data (including Name, Surname, residence, email, telephone number);
b)   browsing data, connected with the use of internet communication protocols, IP addresses or the domain names of the computers used by users connecting to the service, URI rotation addresses and other parameters relating to the user's operating system and IT environment;
c)   data relating to the payment transaction to be made to the University of Padua (including transaction ID, outcome, notice number, amount, deadline, reason, payment date)

The processing of data is aimed at:
a)  carrying out the activities necessary for the use of the PagoPA electronic payment service;
b)  carrying out the activities necessary for the use of the “Payments Portal” service;
c)  fulfilling the obligations connected with the University’s participation in PagoPA or arising from the law, regulations and EU legislation;
d)  fulfilling the obligations connected with the University’s participation in the “Payments Portal” service provided by CINECA.

The data subject’s personal data are processed with the support of IT and paper-based means.

The University adopts appropriate organisational and technical measures to protect and ensure the confidentiality of the personal data in its possession, in particular against the loss, theft, as well as the unauthorised use, disclosure or modification of personal data.

The processing of personal data within the scope of the purposes indicated in point 4 is carried out by the University on the basis of the following legal bases.
a)  conclusion and performance of the contract, including at the pre-contractual stage (Art.  6(1)(b) GDPR);
b)  compliance with legal obligations to which the Data Controller is subject (Art. 6(1)(c) GDPR);
c)  performance of a task carried out in the public interest or connected with the exercise of official authority vested in the data controller (Art. 6(1)(e) GDPR).

The data will be processed within the University, under the responsibility of the Controller, by authorised and adequately instructed persons pursuant to Art. 29 of the GDPR, involved in the functions necessary for carrying out the specific purposes indicated and operating in the relevant offices such as the budget office, student offices, departments, and document management.

The recipients of the data are:

a) Processors. CINECA has been appointed as Processor, as the main provider of IT services and in particular as the provider of the pago Atenei portal, with registered office at via Magnanelli 6/3, 40033 Casalecchio di Reno (BO) - Privacy policy CINECA;

b) Third parties. Personal data may in any case be disclosed to third parties in relation to compliance with legal and contractual obligations, specific requests by the data subject, management of any complaints or disputes, and for the prevention and suppression of fraud and any unlawful activity: the University of Padua’s acting treasury institution and other credit institutions for the fulfilment of pecuniary obligations.

Personal data are not subject to dissemination, except with the express consent of the data subject.

Personal data are retained for the entire period necessary to carry out the purposes set out in point 4 and for the full period required to comply with legal retention obligations (tax, anti-money laundering and financial transaction obligations).

The data subject may exercise the rights provided for in Articles 15 et seq. of the EU Regulation, such as the right of access, the right to rectification or completion of their data, the right to erasure (right to be forgotten) and restriction of processing, and the right to data portability, under the conditions and within the limits indicated by the EU Regulation.

The request for erasure of personal data cannot be granted to the extent that the processing is necessary for compliance with a legal obligation, for the performance of institutional tasks, for the establishment, exercise or defence of a legal claim, and in any other case provided for by Article 17(3) of the EU Regulation.

The data subject has the right to object at any time to the processing of their personal data, in accordance with Article 21 of the EU Regulation.

The data subject may lodge a complaint with the Italian Data Protection Authority.

To exercise their rights, the data subject may contact the University by writing to the certified email address amministrazione.centrale@pec.unipd.it or to the email address urp@unipd.it. Alternatively, the data subject may write to: University of Padua, via VIII Febbraio n. 2, Padua.

The University is required to provide a response within one month of the request, extendable up to three months in the event of particular complexity of the request.

Changes and additions to this privacy notice are published in the privacy section of the institutional website at www.unipd.it/privacy. In any case, the University undertakes to communicate directly to the data subjects, through its institutional channels, any changes to the purposes of the processing, the identity of the data controller, and any other change capable of significantly affecting the rights of the data subjects or the exercise thereof.