Privacy notice on the processing of personal data (Fundraising)

The Data Controller is the University of Padua, with registered office at Via VIII Febbraio n. 2, 35122 - Padua.
To contact the Data Controller, write an email to the following certified email address: amministrazione.centrale@pec.unipd.it.

At the University there is a Data Protection Officer, appointed pursuant to Article 37 of EU Regulation 2016/679, who can be contacted at the following email address: privacy@unipd.it.

The University processes the personal data provided by the data subject as a result of fundraising activities in support of the University of Padua.

The personal data that may be processed exclusively for the purposes indicated in point 4 are:

1. personal details (first name, surname, date of birth, sex), contact details (email, telephone), and residence details;
2. economic and financial data, such as bank details, credit card details and transactions;
3. images. Photos and/or video recordings of donors collected on the occasion of significant donations and/or through the platform called “Donor Wall”.

The processing of personal data is intended exclusively for carrying out all activities connected with, or even merely arising from, fundraising in support of the University of Padua. In particular, the processing is carried out for the following purposes:

1. raising funds;
2. management of operations relating to and resulting from donations;
3. management of records through a CRM database;
4. disseminating knowledge of and raising awareness among data subjects about the institutional activities and the specific purposes of the organisation;
5. providing information on fundraising initiatives, activities and projects carried out by the University;
6. sending communications and informational material reserved for supporters and donors, including potential donors, in paper and digital format;
7. requesting participation in fundraising campaigns;
8. raising awareness of issues relating to the specific activities of the University of Padua;
9. possible inclusion of the donor’s name on the “Sostieni Unipd” webpage of the University website (at the link https://www.unipd.it/sostenitori) as well as on the University’s social networks, newsletters and printed material promoting the institutional activities of the University, subject to the explicit consent of the data subject;
10. publication on the institutional website, on the University’s social networks, in newsletters and on printed material promoting the institutional activities of the University, subject to the explicit consent of the data subject, of images (photos and/or video recordings) collected on the occasion of the signing of significant donations and/or through the platform called “Donor Wall”

The data subject’s personal data are processed using both electronic and paper-based means.

The University adopts appropriate organisational and technical measures to protect the personal data in its possession, through security measures suitable for ensuring the confidentiality and security of personal data, in particular against loss, theft, as well as unauthorised use, disclosure or modification of personal data.

The Data Controller does not use automated decision-making processes relating to the data subject’s rights on the basis of personal data, including profiling, in compliance with the safeguards provided for in Article 22 of the EU Regulation.

The data are provided directly by the data subjects, whether in person, through postal services or through IT and telephone tools, exclusively for the pursuit of all the purposes indicated in point 4.

The processing of personal data within the scope of the purposes indicated in point 4 is carried out by the Data Controller on the basis of the following lawful grounds.

The legal basis for processing for promotional and informational activities aimed at obtaining resources instrumental to the performance of the institutional tasks of teaching, research and so-called third mission is the performance of a task carried out in the public interest pursuant to Article 6(1)(e) of the EU Regulation.

The legal basis for the processing of personal data, for the purposes referred to in Article 4(b), is the performance of a contract to which the data subject is party or of pre-contractual measures adopted at the request of the same pursuant to Article 6(1)(b) of the EU Regulation.

Exclusively for the purposes of disclosing the donor’s name and publishing images (point 4, letters i and j), the processing of data takes place subject to the explicit consent of the data subject, pursuant to Article 6(1)(a) of the EU Regulation.

The provision of personal data for the purposes indicated in point 4, letters a) and b), is indispensable for the establishment and management of the relationship between the data subject and the University, as well as for compliance with specific contractual, regulatory and tax obligations incumbent on the University.

The data subject may request the restriction of the processing of their personal data with reference to the other purposes indicated in point 4.

The recipients of the data are the natural persons appointed by the University to process the data, including the employees and collaborators, including self-employed collaborators, of the University of Padua and affiliated bodies.

In any case, personal data may be disclosed to third parties in relation to compliance with legal and contractual obligations, specific requests from the data subject, the handling of any complaints or disputes, and the prevention and prosecution of fraud and any unlawful activity.

Personal data will not be disseminated, except with the express consent of the data subject.

Data Processors

The recipients of the data also include the Data Processors appointed by the University, including :

1. companies responsible for the provision of electronic payment services;
2. CINECA, as the main provider of IT services and in particular as the provider of the pago Atenei portal (registered office at via Magnanelli 6/3, 40033 Casalecchio di Reno (BO) - CINECA Privacy policy);
3. METADONORS S.R.L., as the main provider of the “Donor Wall” platform and the “Donodoo” CRM database (registered office at via Sante Pisani 71, 59100 Prato (PO) - IT06519890484 – Metadonors Privacy policy);
4. The acting treasury institution of the University of Padua.

Third parties

In any case, personal data may be disclosed to third parties in relation to compliance with legal and contractual obligations, specific requests from the data subject, the handling of any complaints or disputes, and the prevention and prosecution of fraud and any unlawful activity.

Personal data are not subject to dissemination, except with the express consent of the data subject.

Personal data are retained for the entire period necessary to carry out the purposes set out in point 4, in accordance with the provisions of the legislation in force and the University Regulations on records retention and disposal with regard to the student's file.

The data subject may exercise the rights provided for in Articles 15 et seq. of the EU Regulation, such as the right of access, the right to rectification or completion of their data, the right to erasure (right to be forgotten) and restriction of processing, and the right to data portability, under the conditions and within the limits set out in the EU Regulation.

The request for erasure of personal data cannot be granted to the extent that processing is necessary for compliance with a legal obligation, for the performance of institutional tasks, for the establishment, exercise or defence of a legal claim, and in any other case provided for by Article 17(3) of the EU Regulation.

The data subject has the right to object at any time to the processing of their personal data, in accordance with Article 21 of the EU Regulation.

The data subject may lodge a complaint with the Garante per la protezione dei dati personali.

To exercise their rights, the data subject may contact the University by writing to the certified email address amministrazione.centrale@pec.unipd.it or to the email address urp@unipd.it. Alternatively, the data subject may write to: University of Padua, via VIII Febbraio n. 2, Padua.

The University is required to provide a response within one month of the request, which may be extended up to three months in cases where the request is particularly complex.

Any amendments and additions to this privacy notice are published in the privacy section of the institutional website at www.unipd.it/privacy.

In any case, the University undertakes to communicate directly to the data subjects, through its institutional channels, any changes to the purposes of the processing, the identity of the data controller, and any other change capable of significantly affecting the rights of the data subjects or their exercise.