Privacy notice on the processing of personal data (Claims)

The Data Controller is the University of Padua, with registered office at Via VIII Febbraio n. 2, 35122 - Padua (PEC address: amministrazione.centrale@pec.unipd.it).

The Data Protection Officer can be contacted at the following email address: privacy@unipd.it.

The University processes the personal data provided by the data subject or by whoever assumes their legal assistance for the management of claims directly or indirectly involving the University as well.

The personal data that may be processed exclusively for the purposes indicated in point 4 are:

1. personal and identifying data (first name, surname, date of birth), contact details, residence details, and any images relating to claims;
2. financial data (e.g. IBAN);
3. special category data and, specifically, data relating to health, the processing of which is carried out exclusively where contingent needs arise (such as, precisely, a claim).

The processing of data is solely for the purpose of managing the claim by the insurance companies.

The data subject’s personal data are processed with the support of electronic and paper-based means.

The University adopts appropriate organisational and technical measures to protect and ensure the confidentiality of the personal data in its possession, in particular against the loss, theft, as well as the unauthorised use, disclosure or modification of personal data.

The University does not use automated decision-making processes relating to the rights of the data subject on the basis of personal data, including profiling, in compliance with the safeguards provided for in Article 22 of the EU Regulation.

Any processing of special categories of data is carried out in compliance with the “Regulations for the processing of the University’s sensitive and judicial data”, available at Regulations of general interest.

The processing of personal data within the scope of the purposes indicated in point 4 is carried out by the University on the basis of at least one of the following legal bases.

Ordinary personal data (point 3, letters a and b) are processed for compliance with legal obligations to which the data controller is subject and for the performance of tasks carried out in the public interest, as well as for the pursuit of the legitimate interest of the University or of third parties (Art. 6(1)(c), (e) and (f) of the EU Regulation).

Special categories of personal data (point 3, letter c) are processed in order to fulfil obligations and exercise the specific rights of the University or of the data subject in the field of employment law and social security and social protection and, where required, on the basis of the data subject's consent (Art. 9(2)(a) and (b) of the EU Regulation).

The provision of personal data for the purposes indicated in point 4 is essential for the management of the documentation relating to the claim involving the data subject and for compliance with the related legal obligations.

The data subjects include the natural persons appointed by the University to process the data, including the employees and collaborators, including self-employed collaborators, of the University of Padua and affiliated bodies.

Data processors

The data subjects also include the Data processors appointed by the University, including:

• CINECA, as the main provider of IT services, with registered office at via Magnanelli 6/3, 40033 Casalecchio di Reno (BO) - CINECA Privacy Policy;
• Google Ireland Limited, as the provider of the email service and cloud services, with registered office at Gordon House, Barrow Street, Dublin 4, Ireland - GSUITE Privacy Policy.

Third parties

Personal data may, in any case, be disclosed to third parties in relation to compliance with legal and contractual obligations, specific requests from the data subject, the handling of any complaints or disputes, and the prevention and suppression of fraud and any unlawful activity.

For the purposes indicated in point 4, personal data may be disclosed to third parties, including:

1. insurance companies and intermediaries, including insurance brokers;
2. entities providing legal assistance and representation on behalf of the data subjects;
3. the pro-tempore treasury institution of the University of Padua and other credit institutions for the fulfilment of pecuniary obligations;
4. public bodies, including international bodies, for the performance of the institutional functions of the University;
5. affiliated bodies at which the data subjects carry out traineeship activities;
6. Ministry of Foreign Affairs, Police Headquarters, Embassies, Public Prosecutor's Office in relation to residence permits and the recognition of particular statuses;
7. health authorities and public security authorities.

Personal data are stored for the entire period necessary to carry out the purposes set out in point 4, in accordance with the provisions of the legislation in force and the University Regulations on records retention and disposal.

The data subject may exercise the rights provided for in Articles 15 et seq. of the EU Regulation, such as the right of access, the right to rectification or completion of their data, the right to erasure (right to be forgotten) and restriction of processing, and the right to data portability, under the conditions and within the limits indicated by the EU Regulation.

The request for erasure of personal data cannot be granted to the extent that processing is necessary for compliance with a legal obligation, for the performance of institutional tasks, for the establishment, exercise or defence of a right in court, and in any other case provided for by Article 17(3) of the EU Regulation.

The data subject has the right to object at any time to the processing of their personal data, in accordance with Article 21 of the EU Regulation.

The data subject may lodge a complaint with the Italian Data Protection Authority.

To exercise their rights, the data subject may contact the University by writing to the certified email address amministrazione.centrale@pec.unipd.it or to the email address urp@unipd.it. Alternatively, the data subject may write to: University of Padua, via VIII Febbraio n. 2, Padua.

The University is required to provide a response within one month of the request, which may be extended up to three months in the event of particular complexity of the request.

Any amendments and additions to this privacy notice are published in the privacy section of the institutional website at www.unipd.it/privacy.

In any event, the University undertakes to communicate directly to the data subjects, through its institutional channels, any changes to the purposes of the processing, the identity of the data controller, and any other changes capable of significantly affecting the rights of the data subjects or the exercise of those rights.