ex art. 13 of the European Regulation no. 679/2016 (“GDPR”)
| Categories of data subjects | Data Controller |
| Lecturers, speakers, testimonials (hereinafter “Lecturer/s”) | “Bologna University Business School” (hereinafter “BBS” or “Data Controller”) Villa Guastavillani, Via degli Scalini 18, Bologna (BO-Italy) Entry in Reg. Legal Persons at the Prefecture of Bologna No. 729, p. 118 vol. 5. VAT No. 02095311201 |
| Data Protection Officer | BBS has appointed its Data Protection Officer, who can be contacted at the following e-mail address: dpo@bbs.unibo.it |
1. INFORMATION ON THE PROCESSING OPERATIONS PERFORMED
SECT. A1
Purposes
Establishing and managing the contractual (work/collaboration) relationship with BBS, including participation as a Lecturer / speaker / testimonial in the context of Masters / Programs / Events / Workshops to speeches or collaborations promoted or organized by BBS, including those carried out in streaming or remotely.
This includes processing for the following purposes:
- administrative and educational;
- to assess the Lecturer in the context of the following activities: evaluation of the quality of teaching, research, and other activities of an academic nature;
- for the Lecturer’s biographical presentation on the Internet website and research channels and to users upon request and other scholarly activities;
- for the Lecturer’s biographical presentation on the Internet website and social channels of / related to BBS/ within BBS information-promotional materials (if contractually provided for);
- for dissemination of BBS activities, audio-visual data and images (based on specific waiver / assignment of rights signed under the provisions of copyright law).
Legal basis
Performance of a contract or pre-contractual measures – Art. 6.1 b) GDPR.
| Personal data collected | Data retention period |
| Personal identification, contact data and bank/IBAN details, e-mail exchanges, related to educational qualification, curricular and professional data, publications, fees paid (if applicable), data of Firm or institution of affiliation, audio-visual data and images, evaluation of subjects attending Masters / Programs / Events / Workshops promoted or organized by BBS. BBS may also collect and process the Lecturer’s publications, including by searching and extracting from university databases (IRIS and SCOPUS). Required provision: a refusal to provide the above data would result in the inability to ensure the performance of the contract between BBS and the Lecturer / speaker / testimonial or the corresponding pre-contractual measures. |
Data processed: • for administrative and educational purposes shall be retained for the time necessary for the performance of the contract. For the performance of pre-contractual measures shall be retained for a period not exceeding 6 months; • for the Lecturer evaluation purposes by BBS shall be retained for a term not exceeding 3 years after the end of the contract; • for the Lecturer’s biographical presentation: – as long as the Lecturer continues to be a member of the BBS Faculty category, or – in the case of a Lecturer not belonging to the Faculty, for a term equal to the duration of the Master / Programs / Event / Workshop. • For the dissemination of BBS activity, audio-visual data and images shall be retained for the maximum term of 10 years (depending on the importance of the speech/speaker) as stipulated in the waiver/assignment of rights signed by you in accordance with the provisions of copyright law, if you have provided an appropriate waiver/assignment of rights, in accordance with the provisions of copyright law. |
SECT. A2
Purposes
Purposes of information of events organized by BBS and subscription to BBS institutional newsletter.
Legal basis
Provision of information service of events organized by BBS and newsletter subscription – Performance of a contract or pre-contractual measures Art. 6.1 b) GDPR.
| Personal data collected | Data retention period |
| Name and surname and e-mail. | Data used for information purposes of events organized by BBS including through newsletter subscription are retained until your request to unsubscribe from the corresponding service. You may unsubscribe by clicking on the link in our e-mails (so called opt-out) or by sending a communication to BBS to the contact details indicated in this notice. |
FOCUS: SUBSCRIPTION TO THE INFORMATION SERVICE AND NEWSLETTER
If you wish to stay in touch with BBS to be informed about events organized by BBS, you may request to subscribe to the relevant BBS information service and newsletter until you unsubscribe.
You may unsubscribe from the service by selecting the appropriate link (so-called opt out) at the end in each communication.
For this purpose, we may contact you through the following means of communication: e-mail.
The period of processing is indefinite, until your revocation of the service you have requested, as indicated in the corresponding section at the beginning of the notice.
SECT. B1
Purposes
Management of tax, accounting and administrative obligations required by law.
Legal basis
Fulfillment of legal obligations – art. 6.1 c) GDPR.
| Personal data collected | Data retention period |
| Personal identification and fee-related and billing data (tax regime, bank/IBAN data) | Data processed for the management of tax, accounting and administrative obligations required by law shall be retained for the term stipulated by law: the term for the retention of accounting records is 10 years, as stipulated in Article 2220 of the Italian Civil Code. |
SECT. B2
Purposes
Transparency and corruption prevention.
Legal basis
Fulfillment of legal obligations – art. 6.1 c) GDPR.
| Personal data collected | Data retention period |
| Personal identification, contact, curricular and professional data, data on the firm or entity to which you belong, on the assignment and compensation received. | Data published for purposes of transparency and corruption prevention are obscured once the purposes for which the personal data were made public have been achieved. Notwithstanding this principle, as a general rule, pursuant to Legislative Decree No. 33, March 14, 2013, as amended, they are retained online for 5 years, with the following exceptions: (a) acts that are still producing their effects at the expiration of five years, must remain published until the production of the effects ceases; (b) data concerning, consultants and collaborators must remain published for the 3 years following the expiration of the appointment; (c) data for which a different deadline is set by the regulations. |
SECT. C1
Purposes
Lecturer’s biographical presentation on the Internet website and social channels of / related to BBS/ within BBS information-promotional materials (on a consensual basis, including by an unequivocal positive act, if not already provided for in the contract, in Section A1 or by legal obligations regarding transparency and corruption prevention).
Legal basis
Consent – Art. 6.1 a) GDPR. The consent can be revoked at any time.
| Personal data collected | Data retention period |
| Personal identification data, contact details, related to educational qualification, curricular and professional data, the Firm or entity to which you belong, publications, assignment, image. In the absence of your consent BBS will not be able to publish the above data and information. | The data used for the Lecturer’s biographical presentation are retained until your consent is revoked. |
SECT. C2
Purposes
Document on the BBS website and/or social channels the BBS event you will be attending.
Legal basis
Consent – Art. 6.1(a) GDPR. Consent for each of the above purposes is optional and revocable at any time.
| Personal data collected | Data retention period |
| Images captured through photographs and audio-video footage taken at the event. | Images remain published on the BBS website and social channels until otherwise requested by the person concerned (opt-out). |
SECT. D
Purposes
Ascertaining, exercising, or defending the Data Controller’s rights in judicial proceedings.
Legal basis
Legitimate interest – art. 6.1 f) GDPR.
| Personal data collected | Data retention period |
| Personal data collected under the other purposes above. | Data used to ascertain, exercise, or defend the Data Controller’s rights in judicial proceedings shall be retained for 10 years from the termination of the relationship, coinciding with the ordinary limitation period and, in the event of litigation being initiated, for the duration of the litigation itself and in any case until the time limits for appeal actions are exhausted. |
2. PROCESSING METHOD
The processing of personal data is carried out by BBS using paper and computerized methods.
3. AUTOMATED DECISION-MAKING ACTIVITIES
BBS excludes the use of any decision-making activity based on automated processing that produces legal effects or similarly significantly affects you pursuant to Article 22 of the European Regulation 679/2016.
4. FATE OF DATA AT THE END OF THE RETENTION PERIOD
After the above retention periods have elapsed, the Data will be destroyed, erased, or anonymized, consistently with technical procedures for erasure and backup.
5. DATA PROCESSORS. THIRD PARTIES RECIPIENTS OF DATA
The subjects or categories of subjects indicated on the website http://www.bbs.unibo.eu, in the section Privacy, are appointed as data processors pursuant to Article 28 of the aforementioned European Regulation No. 679/2016 and may therefore process and become aware of the data you have provided.
Those appointed as data processors by BBS are used to:
a) to manage relations with Lecturers and more generally with third parties, including for accounting and administrative purposes, including legal defense;
b) to manage communications, including those of a commercial and promotional nature, and to provide information and promotional services;
c) to manage its archives, also in a computerized manner.
Data may also be transmitted to the judicial authorities and other public entities entitled to request them, in cases provided for by law or as a result of the order of a judicial authority.
6. PLACE OF PROCESSING AND DATA TRANSFER TO NON-EU COUNTRIES
BBS carries out the processing of your data in Italy.
Some of the appointed Data Processors are based, or process your personal data, also in countries other than Italy both in and outside of Europe and, in this case, the transfer of personal data outside the EU will take place in accordance with the provisions of the law and, in particular, personal data will not be transferred to third countries that do not comply with the conditions set forth in Article 45 et seq. GDPR.
7. YOUR RIGHTS. LODGING A COMPLAINT WITH THE SUPERVISORY AUTHORITY
You can exercise the rights granted to you by law and, in particular, the right to revoke your consent (art.7 GDPR), the right to obtain from BBS access to your personal data (art. 15 GDPR), rectification and/or supplementation (art. 16 GDPR) and erasure (art. 17 GDPR) of your personal data, restriction of processing (art. 18 GDPR), the right to receive notification of rectification, erasure or restriction of processing carried out (art. 19 GDPR), the right to data portability (art. 20 GDPR), and the right to object to processing (art. 21 GDPR). These rights may be subject to certain exceptions and/or limitations (e.g., revocation of consent does not affect the lawfulness of processing based on consent prior to revocation, the right to erasure cannot be exercised for those data with respect to which BBS demonstrates the existence of overriding legitimate grounds for processing, the right to portability applies with respect to processing based on contract or consent, the right to object applies for processing based on legitimate interest or public interest grounds).
Data subjects also have the right to lodge a complaint with the competent Supervisory Authority (Art. 77 GDPR), which in Italy is the Garante per la protezione dei dati personali (Piazza Venezia, 11 – 00187 Roma – PEC: protocollo@pec.gpdp.it).
8. DATA PROTECTION OFFICER
BBS appointed its Data Protection Officer, who can be contacted at the following address: dpo@bbs.unibo.it
You may contact the Data Protection Officer for all matters related to the processing of your personal data and the exercise of your rights under the European Regulation No. 679/2016 and the Privacy Code.
9. CONTACTS AND DISPUTES
If you have any question or complaint, regarding this Privacy Notice or BBS data processing practices or for requests regarding updating/rectification/erasure of personal data or the exercise of your privacy rights you may contact the Data Controller or Data Protection Officer.
For this purpose, you may send a communication to the e-mail address gdpr@bbs.unibo.it, from which you will be answered by the person appointed by BBS to provide feedback to the data subject, that is the Privacy coordinator, or to the Data Protection Officer e-mail address dpo@bbs.unibo.it
