Information on the processing of personal data (Payments)

The Data Controller is the University of Padova, with legal campus in Via VIII Febbraio n. 2, 35122 - Padova (certified email address:
amministrazione.centrale@pec.unipd.it

At the University there is a Data Protection Officer, appointed pursuant to art. 37 of the EU Regulation, which can be contacted at the following e-mail address: privacy@unipd.it

The University provides for the processing of the personal data of those who interact with the Pago PA Payment Portal-Portal  service accessible electronically from the address:
https://unipd.pagoatenei.cineca.it

The personal data that may be processed exclusively for the purposes indicated in point 4 are:

a)  Personal, personal and contact data (including Name, Surname, residence, e-mail, telephone);
b)   navigation data, related to the use of internet communication protocols, IP addresses or domain names  of the computers used by users who connect to the service, URI rotation addresses and other parameters relating to the operating system and the user's IT environment;
c)   data relating to the transaction for the payment to be made to the University of Padova (including transaction-ID, outcome, notice number, amount, deadline, reason, payment date)

The purpose of data processing is to:
a)  carrying out the activities necessary for the use of the PagoPA electronic payment service;
b)  carrying out the activities necessary for the use of the "Payment Portal" service
c)  fulfilment of obligations related to the University's membership of PagoPA or deriving from the law, regulations and EU legislation;
d)  fulfilment of the obligations related to the University's adhesion to the service "Portal of payments prepared by CINECA.

The personal data of the interested party are processed with the support of computer and paper means.

The University shall take appropriate organisational and technical measures to protect and guarantee the confidentiality of the personal data in its possession, in particular against the loss, theft, as well as the unauthorised use, disclosure or modification of personal data.

The processing of personal data within the scope of the purposes indicated in point 4 is carried out by the University on the basis of the following legal bases.
a)  stipulation and execution of the contract, including in the pre-contractual phase (Art.  6 para. 1 lit. b GDPR);
b)  Fulfilment of legal obligations to which the Data Controller is subject (Article 6(1)(c) of the GDPR);
c)  performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(1)(e) of the GDPR).

The data will be processed within the University, under the responsibility of the Data Controller, by authorized and adequately trained subjects pursuant to art. 29 of the GDPR, involved in the functions necessary to carry out the specific purposes indicated and operating in the relevant offices such as the budget office, student secretariats, departments, document management.

The recipients of the data are:

a) Data Processors. He has been appointed Data Processor CINECA, as the main provider of IT services and in particular as the provider of the pago Università portal with campuses in via Magnanelli 6/3, 40033 Casalecchio di Reno (BO) - Privacy policy CINECA;

b) Third parties. Personal data, in any case, may be disclosed to third parties in relation to the fulfillment of legal and contractual obligations, specific requests of the interested party, management of any complaints or disputes and for the prevention and repression of fraud and any illegal activity: pro-tempore treasurer institute of the University of Padova and other credit institutions for the fulfillment of pecuniary obligations.

Personal data are not subject to dissemination, unless expressly consented to by the interested party.

Personal data are stored for the entire period necessary to carry out the purposes set out in point 4 and for the entire duration required to comply with legal obligations regarding storage (tax, anti-money laundering and financial transaction obligations).

The interested party may exercise the rights provided for in Articles 15 et seq. of the EU Regulation, such as the right of access, the right to rectification or integration of their data, the right to erasure (right to be forgotten) and restriction of processing and the right to data portability, under the conditions and within the limits indicated by the EU Regulation.

The request for erasure of personal data cannot be accepted to the extent that the processing is necessary for the fulfilment of a legal obligation, for the performance of institutional tasks, for the establishment, exercise or defence of a right in judicial campus and in any other case provided for by art. 17, paragraph 3 of the EU Regulation.

The interested party has the right to object at any time to the processing of his/her personal data, in accordance with the provisions of art. 21 EU Regulation.

The interested party may lodge  a complaint with the Guarantor for the protection of personal data.

To exercise their rights, the interested party may contact the University, by writing to the certified e-mail address amministrazione.centrale@pec.unipd.it or to the e-mail address urp@unipd.it. Alternatively, the interested party can write to: University of Padova, via VIII Febbraio n. 2, Padova.

The University is required to provide a response within one month of the request, extendable up to three months in case of particular complexity of the request.

Changes and additions to this policy are published in the privacy section of the institutional website at www.unipd.it/privacy. In any case, the University undertakes to communicate directly to the data subjects, through its institutional channels, any changes in the purposes of the processing, the identity of the data controller and any other changes that may significantly affect the rights of the data subjects or their exercise.