The European Data Protection Regulation No. 2016/679 (hereinafter referred to as GDPR) confirms the right of all persons to the protection of their personal data.

As a student (hereinafter "data subject"), the Free University of Bozen-Bolzano will inform you, in accordance with Articles 13 and 14 of the GDPR, of the purposes and methods of processing your personal data.

Special and further data protection instructions will also be provided you for specific administrative processes, administrative procedures and/or the use of services.

1. Data Controller of the data processing and Data protection officer

The controller of the data processing is the Free University of Bozen-Bolzano, registered office “Piazza Università 1, Bolzano” in the person of the President and legal representative pro tempore.

The data centers of unibz and Eurac Research (tax number: 01659400210, located in Bolzano, Viale Druso 1) collaborate through the scientific platform SCIENTIFIC NETWORK SOUTH TYROL (also "SNS") which unibz uses to provide certain services. unibz and Eurac Research are Joint Controllers of the personal data processed in this context and, accordingly, have entered into an agreement pursuant to art. 26 of the GDPR to define their respective roles and responsibilities. The Joint Controllers have determined that complaints and requests to exercise rights submitted by data subjects will be handled within the framework of the processing purposes set out in the Joint Controller Agreement, and data subjects may in any case exercise their rights against both Joint Controllers pursuant to art. 26, par. 3 of the GDPR.

The controller has appointed a Data Protection officer (DPO), who can be contacted under the following e-mail address: privacy@unibz.it.

For the processing of data in the context of some PhD programmes, there is a joint controllership of the data between the Free University of Bozen-Bolzano and other universities and, accordingly, agreements pursuant to art. 26 of the GDPR have been concluded to define the respective roles and responsibilities. The information pursuant to Art. 13-14 GDPR is provided below:

- Corso di Dottorato di interesse nazionale in robotics and intelligent machines: joint controllership with Università degli Studi di Genova, located in Via Balbi 5, 16126 Genova.

- Dottorato nazionale in sviluppo sostenibile e cambiamento climatico: contitolarità con la Scuola Universitaria Superiore IUSS di Pavia, con sede legale in Piazza della Vittoria n. 15, CAP 27100 Pavia.

2. The purposes of the processing

Personal data are processed by the Data Controller for the following purposes:

1. management of application and admission procedures to the study courses offered by the University (e.g. Bachelor, Master, PhD Programmes, Vocational Master Courses, Training Courses);
2. management of the enrolment procedure to the study programmes and related activities (identification of the student through digital photography) and management of the enrolment procedure in single subject courses;
3. university career management until graduation (management of the study plan, registration of exams, detection of the presence for teaching activities when required, registration to language courses at the University's Language Center, applications for final exams and/or suspension of the study, management of the didactic, administrative, accounting, tax and asset relationship between the student and the University, archiving and storage of data relating to the career, surveys for the evaluation of teaching, tutoring activities,…);
4. management of study fees;
5. carrying out curricular and extracurricular internships;
6. use of online services (University e-mail, digital e-learning platform, platform Moodle, participation in online communities, access to other electronic resources, e.g. online journals, digital publications,…);
7. sending institutional communications to students and graduates through a portal and institutional e-mail;
8. use of library services;
9. access to rooms, laboratories and other facilities with protected access;
10. management of the work safety training pursuant to Art. 2, Art. 4 and Art. 37 of G.D. No. 81/2008 and issue of the respective certificate of attendance;
11. participation in election of student representatives to the University bodies and performance of any tasks relating to the elected office;
12. disciplinary proceedings against students;
13. national and international student mobility programmes;
14. entry orientation, tutoring and exit orientation activities, job placement, including communications to private, public and inter-university consortia for exclusive occupational/professional purposes;
15. provision of grants and subsidies, services and activities for the right to study (such as exemptions, benefits, scholarships) and management of activities in support of university structures (activities 120 hours);
16. support for inclusion in the student community for students with specific disabilities, DSA and BES;
17. management of the Alumni of the Free University of Bozen-Bolzano;
18. participation in research projects and/or other activities compatible with the University's institutional aims;
19. video surveillance of the University structures;
20. statistical surveys and internal evaluations of the University, carried out also through questionnaires sent to students and/or graduates and/or applicants for admission procedures, in order to improve teaching activities, services offered, assistance to students, educational offer and/or services offered in the context of admission procedures;
21. publication of the degree data in the catalogue of the degree theses of the University.

The institutional e-mail address assigned to the student at the time of enrolment is the communication tool between the student and the University to which all official communications and information relating to career management, including news and events organized by the University itself, will be sent. For communication with prospective graduates and graduates, or, more generally, persons no longer enrolled, the e-mail address provided by the student at the university prior to enrolment will be used as an alternative.

3. Data types processed

The following data types are processed for the purposes indicated above:

• personal data, such as personal data, contact data, digital photography, student registration number, admission data, registration data, career data, access rights, bank data, income and tax data of the individual and of family members, payments, images (video footage, photographs, images and voice in online and recorded lectures);
• data belonging to "special categories of personal data" ex art. 9 GDPR, such as data on health, sexual orientation (e.g. disability, possible gender transition during the career, use of exemptions/benefits), data revealing racial and ethnic origin (e.g. refugee status), religious or philosophical beliefs, political or other opinions (e.g. electoral procedures for student representing,…).

4. Legal basis of processing

The processing of personal data for the purposes indicated above is carried out by the processor at the basis of at least one of the following conditions of lawfulness.
For personal data pursuant to Art. 6 (1) of the GDPR:

• for the performance of tasks of public interest as defined by law, by the University By-Law and by internal regulations;
• for the compliance with a legal obligation;
• for the pursuit of a legitimate interest;
• on the basis of the explicit consent of the data subject.
  For data belonging to "special types of data" ex art. 9 GDPR (“sensitive data”):
• for reasons of substantial public interest on the basis of Union or Member State law pursuant to Article 9(2)(g) of the GDPR and Article 2-sexies(2)(bb) 'university education' of Legislative Decree No 196/2003 et seq;
• for purposes of archiving in the public interest, scientific or historical research or for statistical purposes pursuant to Art. 9, par. 2, letter j) GDPR and Art. 2-sexies, par. 2, letter cc) of Legislative Decree no. 196/2003 et seq.
• to ascertain, exercise or defend a right in court;
• on the basis of the explicit consent of the data subject (art. 9, par. 2, letter a) GDPR).

5. Compulsory or optional nature of the conferment

The provision of personal data for the above purposes, except in the cases specified below, is essential for the establishment and management of the relationship between the student and the University and for the fulfillment of related legal obligations.
The provision of data, including data belonging to the "special types of data" ex art. 9 GDPR for the purposes indicated in letters n) and s) is optional, but failure to provide such data will make it impossible for the University to guarantee the provision of the service, participation in the activity and/or use of the facilities requested.
For the processing of anonymous and/or aggregated data, the regulations on the protection of personal data do not apply.

6. Data source

Personal data are usually collected directly from the data subject. In some cases they can be obtained from other sources such as public databases (SPID, ISEE), public administrations, criminal records, tax assistance centres.7

7. Methods of data processing

The data are processed by employees of the Free University of Bozen-Bolzano, also with the aid of electronic means and solely for the proper performance of the institutional tasks of the University, in accordance with all the obligations established by GDPR - including those of security and confidentiality – by the D.Lgs. 196/03, by the provisions of the european and national Data Protectoin Authority and by the internal regulations on data protection.
The data may also be processed by persons to whom the right of access is recognized by provisions of law, or secondary legislation.

8. Communication and dissemination of data

The personal data may be communicated, during students’ study careers, and even after graduation, to other parties, public and private, when this is necessary for the implementation of the institutional goals of the University, including the provision of specific services to students, conducting internships, inter-university exchange programs (such as Erasmus+ and bilateral agreements), the transmission of the data to partner universities in relation to study programmes, which are offered in cooperation with different universities, entering the world of work and in any case for all activities related and instrumental to those purposes. In compliance with regulations and to give an example, the data may be periodically transmitted to the ‘Anagrafe nazionale degli studenti’ in adherence to Art. 1-bis of Lgs. D. no. 105/2003, converted into Law no. 170/2003, and sent to the Ministry of Education periodically for statistical and mandatory purposes. The Free University of Bozen-Bolzano makes the curricula of its students public and freely accessible on www.unibz.it, pursuant to art. 6 of Legislative Decree no. 276/2003, from the date of registration until at least twelve months from the date of obtaining the degree and will forward them also to the Cliclavoro portal (www.cliclavoro.gov.it) of the Ministry of Labour and Social Policy. The data are also made available to the interuniversity Consortium AlmaLaurea, to which the Free University of Bozen-Bolzano belongs, for processing questionnaires relating to the analysis and evaluation of efficiency, in adherence to D.M. no. 544/2007. Your data can be transmitted to the Labour Office of the Autonomous Province of Bolzano (Ripartizione lavoro) for statistical purposes regarding the employment situation of graduates.

The data can also be made available for historical, statistic and scientific use as by law and in full compliance with legal ethics. Your personal data will be communicated to the Cloud Service of Exlibris Europe, with whom the Free University of Bozen-Bolzano has signed a service contract in order to guarantee the best library service for its patrons. Your personal data may be also processed by subjects entitled by law or secondary legislation. Your data may also be transmitted to another public institution in order to verify the declarations in lieu of certificate (see art. 71 of D.P.R: 445/2000). The data could be furthermore transmitted to all the subjects who must/can receive communication about them and to all the subjects who are entitled to access your data.

Personal data can be communicated to external subjects, institutions and student advisory associations, for internship and job initiatives, for postgraduate education and for the assignation of accommodation places. The data can also be transmitted to other public subjects, for example, to public institutions managing funds for research or grants, limited to institutional reasons and their relevance, and only for the duration of the processing they are required for. In order to optimize services for students and to fulfil institutional duties, the University may forward personal data also to outsourcing companies limited to specific activities. After verification of specific requirements, expertise, knowledge and reliability in the matter, these companies are designated as external data processors. In exceptional cases evaluated by the Faculty Secretariat, upon presentation of a reasoned request and for didactic reasons only, your phone number can be provided to professors with regular contract at the University of Bozen-Bolzano.

In order to facilitate student advising, education and job entrance (also in foreign countries), the University, is allowed to communicate or disseminate data regarding students’ exams results (intermediate and final results) and other personal data, not including sensitive data, also to private persons, by digital means.

9. Data transfer to non-EU countries

Within the scope of the above purposes, your personal data may be transferred to countries outside the EU within the limits and under the conditions set out in Articles 44 et seq. of the GDPR and in particular:

• to third countries or international organisations for which the European Commission has issued an adequacy decision pursuant to Art. 45 of the GDPR;
• to third countries or international organisations that have provided adequate safeguards and in which the data subject has enforceable rights and effective remedies, in accordance with Art. 46 GDPR;
• to third countries or international organisations on the basis of derogations in specific situations, pursuant to Art. 49 GDPR

10. Period of conservation

The determination of the period of conservation of personal data will be defined according to the criteria of necessity of the treatment and in compliance with legal obligations and/or regulations on the subject as well as in relation to the maximum time provided for by the applicable provisions of law on the subject of prescription of rights and/or expiry of the action and, in general, for the exercise/defence of the Controller's rights in disputes promoted by public authorities, public subjects/entities and private parties and, in any case, for the entire duration of the judgement in all its phases and degrees.

Your personal data will therefore be kept for the entire period necessary to achieve the purposes indicated above. Your data may be kept for a longer period limited to cases of filing in the public interest, scientific research, historical reasons or for statistical purposes, subject to the adoption of appropriate technical and organizational measures.

In particular

• The personal data, registration, career and achievement of the title will be kept indefinitely, also taking into account the filing obligations provided by current legislation;
• The data collected on the basis of the consent given by the interested party for the use of specific services will be retained as long as the data subject is entitled to the service or the consent is not withdrawn and/or the deactivation of the service is not requested, , except for the existence of a legal obligation to store them.

11. Rights of the data subject

You have the right to request from the data Controller access to and rectification or erasure of personal data, to have incomplete personal data completed, the restriction of processing concerning the data subject and to object to processing as well as the right to data portability and the right to lodge a complaint with a supervisory authority (Garante della Privacy http://www.garanteprivacy.it/), as well as to exercise the other rights recognized by Applicable Law (Art. 15 ff. GDPR). If you have consented to processing of your personal data, you have the right to withdraw such consent at any time. You can exercise your rights by using the form that you can the download from the institutional website, page “Privacy” and sending it to privacy@unibz.it

Before we can provide you with or change any information, it may be necessary to verify your identity.

Last update: 12/10/2023