ex art. 13 of the European Regulation no. 679/2016 (“GDPR”)
| Categories of data subjects | Data Controller |
| Students/Participants (hereinafter jointly “Students”) in the Masters or Programs and events organized by the Data Controller | “Bologna University Business School” (hereinafter “BBS” or “Data Controller”) Villa Guastavillani, Via degli Scalini 18, Bologna (BO-Italy) Entry in Reg. Legal Persons at the Prefecture of Bologna No. 729, p. 118 vol. 5. VAT No. 02095311201 |
| Data Protection Officer | BBS has appointed its Data Protection Officer, who can be contacted at the following e-mail address: dpo@bbs.unibo.it |
1. INFORMATION ON THE PROCESSING OPERATIONS PERFORMED
SECT. A1
Purposes
Establishing and managing the contractual relationship or pre-contractual measures to which you are a party and to enable you to take advantage of the requested service or activity, including participation in classes or events carried out also in streaming or remotely.
We also inform you that BBS will keep a record of the name, surname, date, and place of birth, of its enrollees or former enrollees for the purpose of issuing certificates, diplomas or certifications related to the attendance of Masters or Programs, as provided in the terms and conditions of the contract.
Legal basis
Performance of a contract/service or pre-contractual measures – Art. 6.1 b) GDPR.
| Personal data collected | Data retention period |
| Personal identification, contact and, where provided, educational qualification, curricular and professional data. Required provision: a refusal to provide the above data, as well as a request to obtain their erasure, would make it impossible for BBS to fulfill your request and provide (or continue to provide) the service you requested. | Data processed: • for the performance of the contractual relationship are retained for the time necessary for the performance of the contract/service; • for the performance of pre-contractual measures are retained for a period not exceeding 6 months. |
SECT. B
Purposes
Management of tax, accounting and administrative obligations required by law.
Legal basis
Fulfillment of legal obligations – art. 6.1 c) GDPR.
| Personal data collected | Data retention period |
| Personal identification and contact data, and contract information. | Data processed for the management of tax, accounting and administrative obligations required by law are retained for the term stipulated by law: the term for the retention of accounting records is 10 years, as stipulated in Article 2220 of the Italian Civil Code. |
SECT. C1
Purposes
a) Marketing and promotional purposes.
b) Statistical and market research purposes.
To contact you for the above purposes we may use both automated methods such as by way of example, e-mail, mms and sms, instant messaging and social platforms (e.g., WhatsApp), and traditional methods such as paper mail and calls with operator intervention.
Legal basis
Consent – Art. 6.1 a) GDPR. The consent for each of the purposes above is optional and can be revoked at any time.
| Personal data collected | Data retention period |
| Purposes a): personal and contact information. In the absence of your consent BBS will not be able to inform you about its events, services offered, or any commercial and promotional offers dedicated to you.
Purposes b): personal data, contact information, curricular and professional data, and employment status. Without your consent, BBS will not be able to carry out statistical and research activities aimed at improving the services offered and assessing, on an aggregate basis, the efficiency and satisfaction of its Master, Programs, or events. |
The data used for promotional purposes and for statistical and market research purposes shall be retained for a maximum period of five years starting from the issuance of your consent or otherwise from the acquisition of your data unless you withdraw your consent. |
SECT. C2
Purposes
Profiling. Use of profiling with automated tools as part of the processing carried out for the purposes mentioned in the previous Section (marketing and promotional purposes).
Legal basis
Consent – Art. 6.1 a) GDPR. The consent is optional and can be revoked at any time.
| Personal data collected | Data retention period |
| Personal identification information, including curricular and professional data, personal preferences, and interests that you may have provided to BBS. In the absence of your consent, BBS will not be able to organize services and events more specific and tailored to your needs, to your curricular and professional path, and to your interests and will not be able to reserve personalized offers that are more consistent with the educational and curricular path you have undertaken. | Data processed by profiling for marketing purposes will be retained for up to one year from the issuance of your consent. |
SECT. C3
Purposes
Internship and placement activities for those enrolled in Master or Programs, i.e., corporate training or work experience in third-party companies to carry out training or work activities in the field. This activity involves the communication of data (name, surname, company of origin if any, master, or programs attended) to the aforementioned third-party companies.
Legal basis
Consent – Art. 6.1 a) GDPR. The consent is optional and can be revoked at any time.
| Personal data collected | Data retention period |
| Personal identification and contact information, curricular and professional data, and information related to the Master or Program you have taken. Without your consent, BBS will not be able to put you in contact with third-party companies interested in offering internships and placement activities to members. | Data used for internship and placement activities for those enrolled in Masters or Programs. Communication of data to third-party companies will be retained for one year starting from the end of the Master or Program, coinciding with the final exam or, failing that, with the last lesson of the Master or Program. |
SECT. C4
Purposes
Processing of audio-visual data and images of your participation in Master or Programs taught remotely or partially remotely.
Legal basis
Consent – Art. 6.1 a) GDPR expressed by an unequivocal positive act (webcam and/or microphone enabling).
Streaming or videoconferencing tools are set by default ensuring that your device’s webcam and microphone are disabled.
In the event that you enable webcam and/or microphone, such enabling is equivalent to the provision of an authorization.
| Personal data collected | Data retention period |
| Audio-visual data and Images | Your data will be processed for as long as the Master or Programs lasts. |
SECT. C5
Purposes
For promotional communication activities of BBS activities on the platforms, websites and social channels of/related to BBS.
Legal basis
Consent – Art. 6.1 a) GDPR. The consent is optional and can be revoked at any time.
| Personal data collected | Data retention period |
| Audio-visual data and images of your speeches and participation in Masters / Programs / Events / Workshops. In the absence of consent, BBS will not be able to acquire your audio-visual data and images of your speeches and your participation in Masters / Programs / Events / Workshops and will not be able to publish them on the platforms, websites, and social channels of/related to BBS. | The data processed for: • audio-visual data and images are retained for the term stipulated in the waiver/transfer of rights signed by you in accordance with the provisions of copyright law. |
SECT. D1
Purposes
Sending e-mail communications for services similar to those already requested ex art. 130, 4th para. of Legislative Decree 30 June 2003, no. 196 as amended (so-called soft spam).
Legal basis
Art. 130, 4th para. of Legislative Decree 30 June 2003, no. 196.
| Personal data collected | Data retention period |
| E-mail address. | Data used for sending soft spam communications are retained until you object to the processing. |
SECT. D2
Purposes
Ascertaining, exercising, or defending the Data Controller’s rights in judicial proceedings.
Legal basis
Legitimate interest – Art. 6.1 f) GDPR
| Personal data collected | Data retention period |
| Personal data collected under the other purposes above. | Data used to ascertain, exercise, or defend the Data Controller’s rights in judicial proceedings shall be retained for 10 years from the termination of the relationship, coinciding with the ordinary limitation period, and in any case, in the event of the initiation of litigation, for the entire duration of the litigation itself and in any case until the time limits for the appeal actions are exhausted. |
2. FOCUS: MARKETING AND PROMOTIONALPURPOSES, INCLUDING THROUGH NEWSLETTERS, TO CARRY OUT STATISTICS AND MARKET RESEARCH – SECT C1
If you wish to stay in touch with BBS in order to be informed about BBS events and activities, receiving commercial and promotional offers from BBS, including through newsletters, we ask you to grant your consent, to be understood as optional, to the processing of your personal identification and contact data. You may revoke your consent at any time, including by selecting the appropriate link (so-called opt out) at the end in each e-mail communication.
We also ask you to grant your consent, which is equally optional, to carry out statistics and market research aimed at defining, on an aggregate basis, the preferences of the parties involved, the performance of its Participants and the efficiency and satisfaction of our Masters, Programs, or events, also for the purpose of improving the services provided. The processing of your data for this purpose may involve conducting surveys related to the provision and use of BBS services, compiling statistics relating to the participation in the Master or Program, the professional employment of its Participants after completion of said Master or Program, the careers undertaken, the level of satisfaction with the Master or Program, and verifying any participation, position and role undertaken within the companies through the Chambers of Commerce Business Registers.
For these purposes, we may contact you through the following means of communication: e-mail, paper mail.
The duration of the processing is as indicated in the corresponding section at the beginning of this notice.
3. FOCUS: USE OF PROFILING IN PROCESSING FOR PROMOTIONAL PURPOSES – SECT C2
Profiling means the automated processing of your personal data to assess and examine your personal preferences, interests, and educational, curricular, and professional path. If you wish, you may provide your consent to the processing of your data, including your curricular, professional data, personal preferences, and interests that you may have provided to BBS, by profiling for the following purposes:
– enabling BBS to promote and organize services and events that are more related to your educational and professional paths, as well as to your personal preferences that you may have expressed;
– enabling BBS to understand the characteristics and needs of its users in order to promote and organize services and events that are more related to their educational and professional paths;
– enabling BBS to send you dedicated commercial offers, as well as personalized offers that are more in line with your educational needs and curricular path.
4. FOCUS: INTERNSHIP AND PLACEMENT ACTIVITIES PURPOSES, FOR THOSE ENROLLED IN MASTERS AND PROGRAMS. DISCLOSURE OF DATA TO THIRD-PARTY COMPANIES – SECT. C3
BBS offers enrolled students in Master and Programs the opportunity to be contacted by third-party companies interested in proposing internship and placement activities to enrolled students.
Through this activity, BBS intends to act as a facilitator in the process of matching employment supply and demand.
If you provide your consent, BBS is authorized to communicate your personal identification and contact information, curricular and professional data, and information related to the Masters or Program you have taken to third party companies that request it for the aforementioned purpose.
Third-party companies to which data may be disclosed are based in the European Union, if any.
5. FOCUS: PROCESSING OF PERSONAL DATA UNDER ART. 130, 4TH PARA. OF THE PRIVACY CODE – SECT. D1
If you do not explicitly refuse, either initially or on the occasion of subsequent communications, BBS may use, pursuant to art. 130, 4th para. of the Privacy Code, even without your consent, the e-mail address you provided when requesting a service from BBS, to send you information and promotional communications relating to services similar to those covered by the service you initially requested. In this case, the promotional communications thus transmitted will include a link that will easily allow you to object to the processing (so-called opt-out).
6. PROCESSING METHOD
The processing of personal data is carried out by BBS using paper and computerized methods.
7. AUTOMATED DECISION-MAKING ACTIVITIES
BBS excludes the use of any decision-making activity based on automated processing that produces legal effects or similarly significantly affects you pursuant to Article 22 of the European Regulation 679/2016.
8. FATE OF DATA AT THE END OF THE RETENTION PERIOD
After the above retention periods have elapsed, the Data will be destroyed, erased, or anonymized, consistently with technical procedures for erasure and backup.
9. DATA PROCESSORS. THIRD PARTIES RECIPIENTS OF DATA
The subjects or categories of subjects indicated on the website http://www.bbs.unibo.eu, in the section Privacy are appointed as data processors pursuant to Article 28 of the aforementioned European Regulation No. 679/2016 and may therefore process and become aware of the data you have provided.
Those appointed as data processors by BBS are used to:
a) to manage relations with Students and more generally with third parties, including for accounting and administrative purposes, including legal defense;
b) to manage communications, including those of a commercial and promotional nature, and to provide information and promotional services;
c) to manage its archives, also in a computerized manner.
Data may also be transmitted to the judicial authorities and other public entities entitled to request them, in cases provided for by law or as a result of the order of a judicial authority.
10. PLACE OF PROCESSING AND DATA TRANSFER TO NON-EU COUNTRIES
BBS carries out the processing of your data in Italy.
Some of the appointed Data Processors are based, or process your personal data, also in countries other than Italy both in and outside of Europe and, in this case, the transfer of personal data outside the EU will take place in accordance with the provisions of the law and, in particular, personal data will not be transferred to third countries that do not comply with the conditions set forth in Article 45 et seq. GDPR.
11. YOUR RIGHTS. LODGING A COMPLAINT WITH THE SUPERVISORY AUTHORITY
You can exercise the rights granted to you by law and, in particular, the right to revoke your consent (art.7 GDPR), the right to obtain from BBS access to your personal data (art. 15 GDPR), rectification and/or supplementation (art. 16 GDPR) and erasure (art. 17 GDPR) of your personal data, restriction of processing (art. 18 GDPR), the right to receive notification of rectification, erasure or restriction of processing carried out (art. 19 GDPR), the right to data portability (art. 20 GDPR), and the right to object to processing (art. 21 GDPR). These rights may be subject to certain exceptions and/or limitations (e.g., revocation of consent does not affect the lawfulness of processing based on consent prior to revocation, the right to erasure cannot be exercised for those data with respect to which BBS demonstrates the existence of overriding legitimate grounds for processing, the right to portability applies with respect to processing based on contract or consent, the right to object applies for processing based on legitimate interest or public interest grounds).
Data subjects also have the right to lodge a complaint with the competent Supervisory Authority (Art. 77 GDPR), which in Italy is the Garante per la protezione dei dati personali (Piazza Venezia, 11 – 00187 Roma – PEC: protocollo@pec.gpdp.it).
12. DATA PROTECTION OFFICER
BBS appointed its data protection officer, who can be contacted at the following address: dpo@bbs.unibo.it
You may contact the Data Protection Officer for all matters related to the processing of your personal data and the exercise of your rights under the European Regulation No. 679/2016 and the Privacy Code.
13. CONTACTS AND DISPUTES
If you have any question or complaint, regarding this Privacy Notice or BBS data processing practices or for requests regarding updating/rectification/erasure of personal data or the exercise of your privacy rights you may contact the Data Controller or Data Protection Officer.
For this purpose you may send a communication to the e-mail address gdpr@bbs.unibo.it, from which you will be answered by the person appointed by BBS to provide feedback to the data subject, that is the Privacy coordinator, or to the Data Protection Officer e-mail address dpo@bbs.unibo.it
