ex art. 13 of the European Regulation no. 679/2016 (“GDPR”)
| Categories of data subjects | Data Controller |
| Participants in Custom Masters or Programs and events organized by the Data Controller (hereinafter “Participants”) | “Bologna University Business School” (hereinafter “BBS” or “Data Controller”) Villa Guastavillani, Via degli Scalini 18, Bologna (BO-Italy) Entry in Reg. Legal Persons at the Prefecture of Bologna No. 729, p. 118 vol. 5. VAT No. 02095311201 |
| Data Protection Officer | BBS has appointed its Data Protection Officer, who can be contacted at the following e-mail address: dpo@bbs.unibo.it |
1. INFORMATION ON THE PROCESSING OPERATIONS PERFORMED
SECT. A
Purposes
Establishing and managing the contractual relationship or pre-contractual measures to which you are a party and to enable you to take advantage of the requested service or activity, including participation in classes or events carried out also in streaming or remotely.
We also inform you that BBS will keep a record of the name, surname, date, and place of birth, of its enrollees or former enrollees for the purpose of issuing certificates, diplomas or certifications related to the attendance of Masters or Programs, as provided in the terms and conditions of the contract.
Legal basis
Performance of a contract/service or pre-contractual measures – Art. 6.1 b) GDPR.
| Personal data collected | Data retention period |
| Personal identification, contact and, where provided, educational qualification, curricular and professional data. Required provision: a refusal to provide the above data, as well as a request to obtain their erasure, would make it impossible for BBS to fulfill your request and provide (or continue to provide) the service you requested. |
Data processed: • for the performance of the contractual relationship are retained for the time necessary for the performance of the contract/service; • for the performance of pre-contractual measures are retained for a period not exceeding 6 months. |
SECT. B
Purposes
Management of tax, accounting and administrative obligations required by law.
Legal basis
Fulfillment of legal obligations – art. 6.1 c) GDPR.
| Personal data collected | Data retention period |
| Personal identification and contact data, and contract information. | Data processed for the management of tax, accounting and administrative obligations required by law are retained for the term stipulated by law: the term for the retention of accounting records is 10 years, as stipulated in Article 2220 of the Italian Civil Code. |
SECT. C1
Purposes
Conducting company visits, i.e., company visits to companies/business schools/third-party organisations to carry out training activities in the field (e.g., attending a production process, attending presentations by managers or contact persons of third-party companies or attending training activities): communicating data (name, surname, company the subject works for if any, master, or program attended) to the aforementioned companies/business schools/third-party organisations, in their capacity as autonomous data controllers, to ensure the execution of the Company visit you requested.
Legal basis
Consent – Art. 6.1 a) GDPR. The consent is optional and can be revoked at any time.
| Personal data collected | Data retention period |
| Personal and contact data, curricular and professional data, and information related to the Master or Program you have attended. Without consent you will not be able to participate in Company visits organized by BBS for which the host companies/business schools/third-party organisations necessarily require to know in advance all or some of the above personal data. | The data used to carry out company visits will be retained for the term of one year starting from the end of the Master or Program, coinciding with the final exam, or failing that with the last class of the Master or Program. The data processed by the aforementioned companies/business schools/third-party organisations within the framework of the company visits will be established directly by the aforementioned organizations as data controllers. |
SECT. C2
Purposes
Processing of audio-visual data and images of your participation in Master or Programs taught remotely or partially remotely.
Legal basis
Consent – Art. 6.1 a) GDPR expressed by an unequivocal positive act (webcam and/or microphone enabling).
Streaming or videoconferencing tools are set by default ensuring that your device’s webcam and microphone are disabled.
In the event that you enable webcam and/or microphone, such enabling is equivalent to the provision of an authorization.
| Personal data collected | Data retention period |
| Audio-visual data and Images | Your data will be processed for as long as the Master or Programs lasts. |
SECT. C3
Purposes
For promotional communication activities of BBS activities on the platforms, websites and social channels of/related to BBS.
Legal basis
Consent – Art. 6.1 a) GDPR. The consent is optional and can be revoked at any time.
| Personal data collected | Data retention period |
| Audio-visual data and images of your speeches and participation in Masters / Programs / Events / Workshops. In the absence of consent BBS will not be able to acquire your audio-visual data and images of your speeches and your participation in Masters / Programs / Events / Workshops and will not be able to publish them on the platforms, websites and social channels of/related to BBS. | The data processed for: – audio-visual data and images are retained for the term stipulated in the waiver/transfer of rights signed by you in accordance with the provisions of copyright law. |
SECT. D1
Purposes
Sending e-mail communications for services similar to those already requested ex art. 130, 4th para. of Legislative Decree 30 June 2003, no. 196 as amended (so-called soft spam).
Legal basis
Art. 130, 4th para. of Legislative Decree 30 June 2003, no. 196.
| Personal data collected | Data retention period |
| E-mail address. | Data used for sending soft spam communications are retained until you object to the processing. |
SECT. D2
Purposes
Ascertaining, exercising, or defending the Data Controller’s rights in judicial proceedings.
Legal basis
Legitimate interest – Art. 6.1 f) GDPR
| Personal data collected | Data retention period |
| Personal data collected under the other purposes above. | Data used to ascertain, exercise, or defend the Data Controller’s rights in judicial proceedings shall be retained for 10 years from the termination of the relationship, coinciding with the ordinary limitation period, and in any case, in the event of the initiation of litigation, for the entire duration of the litigation itself and in any case until the time limits for the appeal actions are exhausted. |
2. FOCUS: PROCESSING OF PERSONAL DATA UNDER ART. 130, 4TH PARA. OF THE PRIVACY CODE – SECT. D1
If you do not explicitly refuse, either initially or on the occasion of subsequent communications, BBS may use, pursuant to art. 130, 4th para. of the Privacy Code, even without your consent, the e-mail address you provided when requesting a service from BBS, to send you information and promotional communications relating to services similar to those covered by the service you initially requested. In this case, the promotional communications thus transmitted will include a link that will easily allow you to object to the processing (so-called opt-out).
3. PROCESSING METHOD
The processing of personal data is carried out by BBS using paper and computerized methods.
4. AUTOMATED DECISION-MAKING ACTIVITIES
BBS excludes the use of any decision-making activity based on automated processing that produces legal effects or similarly significantly affects you pursuant to Article 22 of the European Regulation 679/2016.
5. FATE OF DATA AT THE END OF THE RETENTION PERIOD
After the above retention periods have elapsed, the Data will be destroyed, erased, or anonymized, consistently with technical procedures for erasure and backup.
6. DATA PROCESSORS. THIRD PARTIES RECIPIENTS OF DATA
The subjects or categories of subjects indicated on the website http://www.bbs.unibo.eu, in the section Privacy are appointed as data processors pursuant to Article 28 of the aforementioned European Regulation No. 679/2016 and may therefore process and become aware of the data you have provided.
Those appointed as data processors by BBS are used to:
a) to manage relations with Participants and more generally with third parties, including for accounting and administrative purposes, including legal defense;
b) to manage communications, including those of a commercial and promotional nature, and to provide information and promotional services;
c) to manage its archives, also in a computerized manner.
Data may also be transmitted to the judicial authorities and other public entities entitled to request them, in cases provided for by law or as a result of the order of a judicial authority.
7. PLACE OF PROCESSING AND DATA TRANSFER TO NON-EU COUNTRIES
BBS carries out the processing of your data in Italy.
Some of the appointed Data Processors are based, or process your personal data, also in countries other than Italy both in and outside of Europe and, in this case, the transfer of personal data outside the EU will take place in accordance with the provisions of the law and, in particular, personal data will not be transferred to third countries that do not comply with the conditions set forth in Article 45 et seq. GDPR.
8. YOUR RIGHTS. LODGING A COMPLAINT WITH THE SUPERVISORY AUTHORITY
You can exercise the rights granted to you by law and, in particular, the right to revoke your consent (art.7 GDPR), the right to obtain from BBS access to your personal data (art. 15 GDPR), rectification and/or supplementation (art. 16 GDPR) and erasure (art. 17 GDPR) of your personal data, restriction of processing (art. 18 GDPR), the right to receive notification of rectification, erasure or restriction of processing carried out (art. 19 GDPR), the right to data portability (art. 20 GDPR), and the right to object to processing (art. 21 GDPR). These rights may be subject to certain exceptions and/or limitations (e.g., revocation of consent does not affect the lawfulness of processing based on consent prior to revocation, the right to erasure cannot be exercised for those data with respect to which BBS demonstrates the existence of overriding legitimate grounds for processing, the right to portability applies with respect to processing based on contract or consent, the right to object applies for processing based on legitimate interest or public interest grounds).
Data subjects also have the right to lodge a complaint with the competent Supervisory Authority (Art. 77 GDPR), which in Italy is the Garante per la protezione dei dati personali (Piazza Venezia, 11 – 00187 Roma – PEC: protocollo@pec.gpdp.it).
9. DATA PROTECTION OFFICER
BBS appointed its data protection officer, who can be contacted at the following address: dpo@bbs.unibo.it
You may contact the Data Protection Officer for all matters related to the processing of your personal data and the exercise of your rights under the European Regulation No. 679/2016 and the Privacy Code.
10. CONTACTS AND DISPUTES
If you have any question or complaint, regarding this Privacy Notice or BBS data processing practices or for requests regarding updating/rectification/erasure of personal data or the exercise of your privacy rights you may contact the Data Controller or Data Protection Officer.
For this purpose you may send a communication to the e-mail address gdpr@bbs.unibo.it, from which you will be answered by the person appointed by BBS to provide feedback to the data subject, that is the Privacy coordinator, or to the Data Protection Officer e-mail address dpo@bbs.unibo.it.
