Policy on Personal Data Processing (Video Surveillance)

The data controller is the University of Padua, legally represented by the Rector pro tempore, with registered office at via VIII Febbraio n. 2, Padua - 35122.

To exercise their rights, the data subject may contact the data controller writing indicated in point 11 or sending an email to the certified email address amministrazione.centrale@pec.unipd.it or to the email address urp@unipd.it.

The University has designated its own Data Protection Officer pursuant to art. 37 of EU Regulation 2016/679.
The Data Protection Officer may be contacted at the following email address: privacy@unipd.it

Within the scope of this policy, the data subject is any natural person whose personal data are processed when accessing the video-surveilled area.

The personal data that may be processed exclusively for the purposes indicated in point 4 are the images captured by the cameras located at the University premises, which may be viewed in real time or video-recorded.

Access to the video-surveilled areas entails the collection, recording, storage and deletion of the images of the data subjects.

The University processes personal data in the execution of video surveillance activities at its facilities. Specifically, the processing is carried out for the following purposes:

• ensuring the safety and security of university staff, students, and visitors to university premises;
• protecting the University's movable and immovable property;
• monitoring and controlling access to areas not open to the public and reserved for staff use only;
• preventing the commission of any unlawful acts against the University.

Your data will be processed using video surveillance system, which allows real-time view ("live") as well as recording of the images.

The video surveillance system operates 24 hours a day, 7 days a week.

The view and management of the images captured by the video surveillance system are reserved for the Data Controller and its formally appointed personnel. The data are stored using appropriate security measures to prevent access by unauthorised personnel and to ensure their confidentiality and integrity.

The University does not adopt automated decision-making processes relating to the rights of the Data Subject using personal data, including profiling, in accordance with the garantees provided by art. 22 of the EU Regulation.

Personal data are retained for a period not exceeding twenty-four hours after their capture, after which they are automatically deleted. Exceptions are made for special needs of further retention in relation to public holidays or university closure, as well as in the case of specific investigative requests from judicial authorities or police forces.

During scheduled closures of the University, recordings may be retained for security reasons for the entire closure period.
In the event of capturing images concerning alleged crimes or events relevant to public safety, environmental, or public heritage protection, the Data Controller shall promptly notify the competent Authority and ensure their storage.

The video-surveilled areas are indicated through appropriate signs, clearly visible in all lighting conditions, which also mention the pursued purposes. These signs are placed before the cameras' range of action, also in their immediate vicinity, and not necessarily in direct contact with the systems (annex A).

The processing of personal data for the aforementioned purposes is carried out by the data controller based of the pursuit of a legitimate interest pursuant to Article 6, paragraph 1, letter f), of EU Regulation 2016/679.

The recipients of the data are the natural persons appointed by the University to data processing, including the employees and self-employed contractors of the University of Padua and affiliated entities.

Third parties

Personal data may, in any case, be discolosed to third parties to fulfil legal and contractual obligations, specific requests from the Data Subjects, management of any complaints or disputes, and for the prevention and repression of fraud and any illegal activities.

For the purposes indicated in point 4, personal data may be disclosed to third parties, including judicial and public security authorities.

The data subject may exercise the rights provided for in Articles 15 et seq. of the EU Regulation, including the right of access, the right to rectification or completion of their data, the right to erasure (right to be forgotten) and restriction of processing, and the right to data portability, under the conditions and within the limits set out in the EU Regulation.

A request for the erasure of personal data cannot be granted insofar as the processing is necessary for compliance with a legal obligation, for the performance of institutional tasks, for the establishment, exercise or defence of a right in judicial proceedings, and in any other case provided for by Article 17(3) of the EU Regulation.

The data subject has the right to object at any time to the processing of their personal data, in accordance with Article 21 of the EU Regulation.

The data subject may lodge a complaint with the Garante per la protezione dei dati personali.

To exercise their rights, the data subject may contact the data controller by sending an email to the certified email address amministrazione.centrale@pec.unipd.it or to the email address urp@unipd.it. Alternatively, they may write to: University of Padua, via VIII Febbraio n. 2, Padua.

The data controller is required to provide a response within one month of the request, extendable up to three months in cases where the request is particularly complex.

The University may modify or supplement this Policy at any time. Changes will be published in the Privacy section of the institutional website.