Privacy notice on the processing of personal data (Students)

The Data Controller is the University of Padua, with registered office at Via VIII Febbraio n. 2, 35122 - Padua (certified email address: amministrazione.centrale@pec.unipd.it).

At the University, there is a Data Protection Officer, appointed pursuant to Article 37 of the EU Regulation, who can be contacted at the following email address: privacy@unipd.it.

The University processes the personal data provided by the data subject during registration, pre-enrolment, enrolment and registration on degree courses, PhD, specialisation courses, master's programmes and any other advanced or professional training course offered by the University, including after the award of any final qualification.

The personal data that may be processed exclusively for the purposes indicated in point 4 are:

a) personal details (first name, surname, date of birth, sex), contact details, residence details, data relating to academic career, participation in teaching activities (attendance on the day, place and time), qualifications held and income conditions;

b) browsing data when using platforms and online services;

c) images and video recordings made in the course of distance learning activities;

d) special category data (for example, data relating to health, racial and ethnic origin, sexual orientation), the processing of which is carried out only if authorised by an express provision of law, for the pursuit of purposes of substantial public interest, or with the consent of the data subject given at the same time as contingent needs arise (such as, for example, a possible accident);

e) data relating to criminal convictions and offences.

The processing of data is intended exclusively for carrying out all activities connected with the institutional tasks and tasks in the public interest falling within the University’s remit. In particular, the processing is carried out for the following purposes:

I.   Management of the university career and provision of services

a) management of admission procedures for degree courses and postgraduate courses;
b) pre-enrolment and enrolment for access to degree courses and registration for educational activities however named;
c) management of the university career, including the award of the degree and any other final certificate;
d) communications relating to administrative procedures;
e) calculation of the amounts of fees due and, more generally, access to financial benefits (e.g. awards, scholarships, so-called students ex 200 hours);
f) management of the inclusion service within the student community for students with specific disabilities, SLD and SEN, as more specifically set out in the relevant Student Inclusion Notice;
g) international mobility;
h) possible participation in research projects or other institutional activities of the University;
i) management of procedures connected with the elections of student representatives and for the possible performance of tasks pertaining to the elective office held by the data subject in University bodies;
j) management of disciplinary proceedings against students;
k) use of the information technology, online and email services provided by the University;
l) organisation of teaching, including distance learning, examinations and final degree examinations and any other final certificate, and attendance recording;
m) use of library services;
n) access to laboratories and other protected facilities;
o) activation and management of curricular and extracurricular traineeships, including with affiliated bodies;
p) video surveillance of University facilities;
q) management of claims relating to accidents;
r) verification of the truthfulness of self-certifications submitted pursuant to Presidential Decree no. 445/2000;
s) statistical surveys carried out within the University in order to improve services and assistance for students or to improve teaching activity;
t) publication of graduation data in the University degree thesis catalogue;
u) archiving in the public interest, scientific or historical research, or for statistical purposes.

II. Other institutional purposes

a) dissemination of degree courses and informational and cultural events organised or sponsored by the University or by teaching and research facilities;
b) entry guidance, tutoring activities and exit guidance, activities aimed at entry into the world of work (job placement), including through the communication of data to private and public entities and inter-university consortia for exclusively employment or professional purposes;
c)   communication and management of initiatives aimed at awarding scholarships, prizes, honours and events of public interest, including through the communication of data to public and private entities;
d) dissemination of communications relating to the Unipd Store shops of the University, including following the award of the degree

The data subject’s personal data are processed with the support of electronic and paper-based means.

The University adopts appropriate organisational and technical measures to protect and ensure the confidentiality of the personal data in its possession, in particular against the loss, theft, as well as the unauthorised use, disclosure or alteration of personal data.

The University does not use automated decision-making processes relating to the rights of the data subject on the basis of personal data, including profiling, in compliance with the safeguards provided for in Article 22 of the EU Regulation.

Any processing of special categories of data is carried out in compliance with the “Regulations for the processing of the University’s sensitive and judicial data”, available at www.unipd.it/regolamenti-interesse-generale.

The personal email address, the telephone contact details, where provided by the data subject, and the institutional email address assigned at the time of enrolment or registration are the means through which all communications and information relating to the management of the academic record and the pursuit of all the purposes indicated in point 4 will be sent.

Single Sign On (SSO). Access to the platforms and online services made available by the University takes place through institutional credentials provided by the University and protected by the centralised access control system called Single Sign On (SSO). Users’ credentials are not accessible, not even in encrypted form, to service providers or to web and mobile applications, as the identification process always takes place within the University’s authentication system, based on the Security Assertion Markup Language (SAML) protocol.

For the purposes of recording attendance and managing the lesson schedule and examinations, the University uses the suite EasyAcademy, a SaaS service qualified by AgID (see Cloud MarketPlace di AgID).

Recording the attendance of students is required for courses with compulsory attendance, for the organisation of teaching activities, and to guarantee safety and the protection of public health.

Access to the online services of the suite EasyAcademy takes place through institutional credentials provided by the University and protected by the centralised access control system called Single Sign On (SSO), or through “local credentials”, in any case fully encrypted.

Browsing data may be used exclusively:

• to verify the proper functioning of the OrariUniPD app or to identify anomalies or abuse and to ascertain responsibility in the event of alleged cybercrimes against the application or third parties;
• in aggregated form and following pseudonymisation, to obtain statistical information on the use of the application.

Browsing logs are deleted 5 weeks after they are recorded.

Exclusively for the purposes of delivering distance learning, the University makes use of software and online platforms such as Moodle, Zoom, Kaltura, Compilatio and other innovative tools dedicated to e-learning. In using these platforms, the University acts in compliance with the principle of data minimisation, processing only the personal data strictly necessary for the pursuit of teaching purposes, without carrying out investigations into the private sphere of the data subject.

Recording. If the conduct of video lessons involves recording the images and contributions of participants as well, all data subjects are informed in advance in a clear and direct manner, with the clarification that each participant may independently turn off their camera.

Online examination sessions may be video recorded exclusively in order to verify the formal regularity of the procedure. The videos are stored for a maximum of 14 days within an area with access restricted to specifically authorised staff.

Publication. The publication or dissemination of video recordings that include images or video contributions of participants is permitted only with the documented consent of the data subjects, whose dignity, honour and reputation must in any case be respected. Publication is limited to teaching, cultural and non-profit purposes.

The processing of personal data for the purposes indicated in point 4 is carried out by the University on the basis of at least one of the following legal bases.

Personal identification and ordinary personal data (point 3(a)) and images and video recordings (point 3(c)) are processed for the performance of tasks carried out in the public interest, as defined by law, the University Statute and internal regulations.

The provision of personal data for the purposes indicated in Section I of point 4 (“I. Management of the university career and provision of services”) is essential for the establishment and management of the relationship between the data subject and the University, for the provision of services and for compliance with the related legal obligations.

Special categories of personal data (such as, for example, data relating to health, political opinions or religious beliefs, etc.) and judicial data (point 3(d) and  e)) are processed exclusively for the purposes indicated in point 4 and where one of the following conditions applies:

a) for reasons of substantial public interest on the basis of European Union or national law pursuant to Art. 9(2)(g) of the EU Regulation and Art. 2-sexies, paragraph 2, letter bb), of Legislative Decree No. 196/2003;
b) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 9(2)(j) of the EU Regulation and Art. 2-sexies, paragraph 2, letter cc), of Legislative Decree No. 196/2003;
c) to establish, exercise or defend a right before a court.

The data recipients are the natural persons appointed by the University to process the data, including employees and collaborators, including self-employed collaborators, of the University of Padua and affiliated bodies.

Data Processors

The data recipients also include the Data Processors appointed by the University, including:

• CINECA, as the main provider of IT services, with registered office at via Magnanelli 6/3, 40033 Casalecchio di Reno (BO) - CINECA Privacy policy;
• Google Ireland Limited, as the provider of the email service, with registered office at Gordon House, Barrow Street, Dublin 4, Ireland  - GSUITE Privacy policy.

Exclusively for the purposes of managing teaching activity, in person or remotely, the following are appointed as Data Processors:

• Zoom Video Communications, Inc. - San Jose, CA 95113, 55 Almaden Blvd, Suite 600 - Zoom Privacy policy
• Kaltura, Inc. - New York, NY 10003, 250 Park Avenue South - Kaltura Privacy policy;
• Compilatio SAS - France, 74650 Chavanod, 47 rue Cassiopée - Compilatio Privacy policy;
• EasyStaff srl, with registered office at via Adriatica, 278 - 33030 Campoformido (UD) - EasyStaff Privacy policy.

Third parties

Personal data may, in any case, be disclosed to third parties in connection with compliance with legal and contractual obligations, specific requests from the data subject, the handling of any complaints or disputes, and the prevention and suppression of fraud and any unlawful activity.

For the purposes indicated in point 4, personal data may be disclosed to third parties, including:

a) ESU di Padova - Regional agency for the right to university education;

b) Regional Management Bodies (entities with administrative-management autonomy established pursuant to Law 390/91 on the right to university studies) and other institutions to promote international student mobility, for the purpose of assessing financial benefits and allocating accommodation (Law 390/1991 and Regional Law no. 37 of 14.09.87);

c) MIUR for inclusion in the National Student Registry (established by Law no. 170/2003) to monitor the progress of university students' careers and to carry out all the functions assigned by law;

d) the bank acting as the University of Padua's treasury institution pro tempore and other credit institutions for the fulfilment of financial obligations, in particular for the payment and reimbursement of university fees;

e) public bodies, including international bodies, for the performance of the University's institutional functions;

f) the Region, other accredited or authorised public and private operators, and potential employers for guidance and entry into the world of work;

g) affiliated bodies where the data subjects carry out traineeship activities;

h) insurance companies affiliated with the University;

i) Ministry of Foreign Affairs, Police Headquarters, Embassies, Public Prosecutor's Office in relation to residence permits and the recognition of particular statuses;

j) private and public entities and inter-university consortia for the performance of third mission activities;

k) health authorities and public security authorities.

Personal data are not subject to dissemination, unless the data subject has given express consent.

Personal data are retained for the entire period necessary to fulfil the purposes set out in point 4, in accordance with the applicable legislation and the University Regulations on records retention and disposal as regards the student file.

Data relating to electronic traffic (e.g. time and duration of connection) are deleted or anonymised when they are no longer necessary for the transmission of the communication, unless otherwise provided for by law (maximum 12 months).

The data subject may exercise the rights provided for in Articles 15 et seq. of the EU Regulation, such as the right of access, the right to rectification or completion of their data, the right to erasure (right to be forgotten) and to restriction of processing, and the right to data portability, under the conditions and within the limits set out in the EU Regulation.

A request for the erasure of personal data cannot be granted insofar as the processing is necessary for compliance with a legal obligation, for the performance of institutional tasks, for the establishment, exercise or defence of a right in judicial proceedings, and in any other case provided for by Article 17(3) of the EU Regulation.

The data subject has the right to object at any time to the processing of their personal data, in accordance with Article 21 of the EU Regulation.

The data subject may lodge a complaint with the Garante per la protezione dei dati personali.

To exercise their rights, the data subject may contact the University by writing to the email address urp@unipd.it  or to the certified email address amministrazione.centrale@pec.unipd.it.
Alternatively, the data subject may write to: University of Padua, via VIII Febbraio n. 2, Padua.

The University is required to provide a response within one month of the request, which may be extended up to three months in cases of particular complexity of the request.

Changes and additions to this privacy notice are published in the privacy section of the institutional website at www.unipd.it/privacy.

In any case, the University undertakes to communicate directly to the data subjects, through its institutional channels, any changes to the purposes of the processing, the identity of the data controller and any other changes capable of significantly affecting the rights of the data subjects or their exercise.