PRIVACY NOTICE GRADUATION AND REUNION
according to the European Regulation no. 679/2016 (“GDPR”)
Categories of data subjects
Subjects who participate in the Graduation and/or the Reunion, events that take place in public spaces or open to the public and which are promoted and organized by the Data Controller
Data Controller
“Bologna University Business School” (hereinafter “BBS” or “Data Controller”)
Villa Guastavillani, Via degli Scalini 18, Bologna (BO-Italy). Entry in Reg. Legal Persons at the Prefecture of Bologna No. 729, p. 118 vol. 5. VAT No. 02095311201
Data Protection Officer
BBS has appointed its Data Protection Officer, who can be contacted at the following e-mail address: dpo@bbs.unibo.it
1. INFORMATION ON THE PROCESSING OPERATIONS PERFORMED
SECT. A
Purposes
Allow participation in the Graduation and the Reunion.
Legal basis
Performance of a contract/service or pre-contractual measures – Art. 6.1 b) GDPR.
Personal data collected
Personal identification and contact data.
Required provision: a refusal to provide the above data, as well as a request to obtain their erasure, would make it impossible for BBS to fulfill your request and provide (or continue to provide) the service you requested.
Data retention period
Data processed for the performance of the contractual relationship are retained for the time necessary for the performance of the contract.
SECT. B
Purposes
Management of tax, accounting and administrative obligations required by law.
Legal basis
Fulfillment of legal obligations – art. 6.1(c) GDPR.
Personal data collected
Personal identification, contact, and contract data.
Data retention period
Data processed for the management of tax, accounting and administrative obligations required by law are retained for the term stipulated by law: the term for the retention of accounting records is 10 years, as stipulated in Article 2220 of the Italian Civil Code.
SECT. C
Purposes
Document the events on the BBS website and social media channels, as well as for archival purposes.
Legal basis
Legitimate interest – Art. 6.1(f) GDPR.
Personal data collected
Images captured through photographs and audio-video footage taken at the event.
Data retention period
The images are kept for archival purposes and documenting the history of BBS for a period of 10 years, unless the interested parties exercise their right of objection, requesting BBS to remove and delete the photo or video portraying them, or have signed an assignment of image rights by means of an appropriate release.
SECT. D
Purposes
Ascertaining, exercising or defending the Data Controller’s rights in judicial proceedings
Legal basis
Legitimate interest – Art. 6.1(f) GDPR
Personal data collected
Personal data collected under the other purposes above.
Data retention period
Data used to ascertain, exercise or defend the rights of the Data Controller in judicial proceedings shall be retained for 10 years from the termination of the relationship, which coincides with the ordinary period of admissibility of the judicial action and, in case of initiation of litigation, for the entire duration of the litigation itself and in any case until the period of admissibility of the appeal actions has been exhausted.
2. FOCUS: DOCUMENT THE EVENTS ON THE BBS WEBSITE AND SOCIAL MEDIA CHANNELS, AS WELL AS FOR ARCHIVAL PURPOSES. – SECT. C
The Graduation and the Reunion are very important events for the BBS Community. Therefore, BBS wishes to document them through photographs and audio-video footage for archival purposes, as well as for publication on BBS website and social media channels.
The legal basis for the aforementioned processing of personal data is the legitimate interest of BBS, as there is an adequate and relevant relationship between BBS and the participants in the events, which will take place in public, with specific notice that photographs and filming will be carried out to document the event, through publication on the BBS website and social channels and storage in the BBS archives.
The images are kept in the BBS archives for a period of 10 years, so that the School can document its history over time and, if they are published on the BBS website and social channels, they remain there for the same period, unless the image rights are assigned by means of a specific release or otherwise requested by the interested party. Data subject, in fact, have the right to object at any time to the processing of personal data considered herein, by requesting BBS to remove and delete the photographs or video portraying them.
3. PROCESSING METHOD
The processing of personal data is carried out by BBS using paper and computerized methods.
4. AUTOMATED DECISION-MAKING ACTIVITIES
BBS excludes the use of any decision-making activity based on automated processing that produces legal effects or similarly significantly affects you pursuant to Article 22 of the European Regulation 679/2016.
5. FATE OF DATA AT THE END OF THE RETENTION PERIOD
After the above retention periods have elapsed, the Data will be destroyed, erased, or anonymized, consistently with technical procedures for erasure and backup.
6. DATA PROCESSORS. THIRD PARTIES RECIPIENTS OF DATA
The subjects or categories of subjects indicated on the website http://www.bbs.unibo.eu, in the section Privacy are appointed as data processors pursuant to Article 28 of the aforementioned European Regulation No. 679/2016 and may therefore process and become aware of the data you have provided.
Those appointed as data processors by BBS are used to:
a) to manage relations with Subjects and more generally with third parties, including for accounting and administrative purposes, including legal defense;
b) to manage communications, and to provide information and promotional services;
c) to manage its archives, also in a computerized manner.
Data may also be transmitted to the judicial authorities and other public entities entitled to request them, in cases provided for by law or as a result of the order of a judicial authority.
7. PLACE OF PROCESSING AND DATA TRANSFER TO NON-EU COUNTRIES
BBS may transfer your personal data to data processors located outside the EU (e.g. WhatsApp), in which case the transfer of personal data will take place in accordance with the provisions of the GDPR, title V, articles 44 et seq. In particular, if the transfer takes place to a third country, the transfer will take place pursuant to Article 46 of the GDPR in accordance with the decision adopted by the Court of Justice of the European Union or in the presence of adequate safeguards and subject to verification that the third country guarantees an adequate level of protection of personal data. For further information on this matter, please send an email to the addresses below.
8. YOUR RIGHTS. LODGING A COMPLAINT WITH THE SUPERVISORY AUTHORITY
You can exercise the rights granted to you by law and, in particular, , the right to obtain from BBS access to your personal data (art. 15 GDPR), rectification and/or supplementation (art. 16 GDPR) and erasure (art. 17 GDPR) of your personal data, restriction of processing (art. 18 GDPR), the right to receive notification of rectification, erasure or restriction of processing carried out (art. 19 GDPR), the right to data portability (art. 20 GDPR), and the right to object to processing (art. 21 GDPR). These rights may be subject to certain exceptions and/or limitations (e.g., the right to erasure cannot be exercised for those data with respect to which BBS demonstrates the existence of overriding legitimate grounds for processing, the right to portability applies with respect to processing based on contract or consent, the right to object applies for processing based on legitimate interest or public interest grounds).
Data subjects also have the right to lodge a complaint with the competent Supervisory Authority (Art. 77 GDPR), which in Italy is the Garante per la protezione dei dati personali (Piazza Venezia, 11 – 00187 Roma – PEC: protocollo@pec.gdpr.it).
9. DATA PROTECTION OFFICER
BBS appointed its data protection officer, who can be contacted at the following address: dpo@bbs.unibo.it
You may contact the Data Protection Officer for all matters related to the processing of your personal data and the exercise of your rights under the European Regulation No. 679/2016 and the Privacy Code.
10. CONTACTS AND DISPUTES
If you have any question or complaint, regarding this Privacy Notice or BBS’s data processing practices or for requests regarding updating/rectification/erasure of personal data or the exercise of your privacy rights you may contact the Data Controller or Data Protection Officer.
For this purpose you may send a communication to the e-mail address gdpr@bbs.unibo.it (from which you will be answered by the person appointed by BBS to provide feedback to the data subject, that is the Privacy coordinator, or to the Data Protection Officer e-mail address dpo@bbs.unibo.it
