Privacy Policy for Opera Services

NOTICE ON THE PROCESSING OF PERSONAL DATA COLLECTED FOR INSTITUTIONAL SERVICES PROVIDED BY OPERA UNIVERSITARIA DI TRENTO

Pursuant to Articles 13 and 14 of EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data (hereinafter, for brevity, the “Regulation” or “EU REG.“) and subsequent amendments, Opera Universitaria di Trento, as Data Controller, provides you with the following information regarding the processing of personal data carried out during the services provided.

1. Object of the processing

The following are the objects of the processing:

personal and contact information (name, surname, date and place of birth, tax code, residence, citizenship), identity document, passport photo, contact information, visas/residence permits for non-EU students;
data relating to university careers, benefits provided by other institutions for the right to education, data relating to admission procedures (e.g., results of selection procedures);
data collected when applying for services, such as bank details, household composition, personal and/or household financial information, data relating to any financial contributions received (scholarships, 150-hour student allowances, etc.), as well as data relating to any rental agreements entered into that demonstrate your status as an “out-of-town” student;
special personal data (Article 9 of Regulation 679/2016), racial and ethnic origin (for non-EU citizens and for refugee or stateless status), health status (for students with disabilities) for access to financial benefits.

2. Purposes and Legal Bases of the Processing of Personal Data

The Purposes and Legal Bases of the processing are as follows:

Contractual purposes: a) Verification of the existence of the requirements for access to benefits for the right to education and for any other purpose provided for by law; b) Determination of scores and rankings; c) Actual provision of services (for scholarships, access to catering services, and the fee due for accommodation); d) Sending communications regarding the services provided; e) disciplinary proceedings against students staying at the facilities. Legal Basis: Fulfillment of a contract/User request/Provision of a service

Purposes required by law: a) Application of workplace safety measures in accordance with the provisions of Legislative Decree 81/2008; b) Archiving and retention of data relating to benefits provided. Legal Basis: Fulfillment of a legal obligation

Purposes based on legitimate interest: a) Surveys for service evaluation and customer satisfaction; b) Statistics, based on aggregate or anonymous data, without the possibility of identifying the user. Legal Basis: Legitimate interest of the data controller

Purposes based on public interest: a) Processing of sensitive data, i.e., data relating to racial or ethnic origin (for non-EU citizens and stateless or refugee status); b) Processing relating to health (for students with disabilities). Legal Basis: Public Interest.

3. Nature of data provision and consequences of failure to provide data

The provision of data is mandatory in order to use the requested services. Refusal to provide personal data will make it impossible for Opera Universitaria di Trento to implement the indicated purposes.

4. Methods of data processing

The processing of your personal data will be based on the principles of lawfulness, fairness, and transparency, protecting your privacy and that of your family members, in compliance with the principles set forth in Article 5 of the EU Regulation. Processing may be carried out manually, using paper documents, and also with the aid of electronic or automated means.

The data is collected and processed at the headquarters of Opera Universitaria di Trento, in dedicated document archives/servers.

Your personal data is processed using appropriate technical and organizational security measures pursuant to Article 32 of the EU Regulation. EU regulations, in order to ensure a level of security appropriate to the risk, minimizing the risk of destruction or loss, unauthorized access, or processing inconsistent with the purposes for which it was collected.

Your personal data is not subject to automated decision-making or profiling.

5. Data Disclosure

Your personal data will not be disclosed.

To fulfill the purposes set out in point 2) of this policy, Opera Universitaria di Trento may need to disclose your personal data to trusted external parties, specifically:

natural or legal persons who provide consultancy or services to Opera for the purpose of providing benefits for the right to education (e.g., provision of canteen cards, banks, companies responsible for the operational management of university residences). These entities and companies will act as data processors pursuant to and for the purposes of Article 28 of the Regulation, or will operate completely independently as separate data controllers. Opera may also disclose the personal data it holds to other public administrations when verifying self-certifications submitted for competitive examinations or when they must process the data for any proceedings under their own institutional jurisdiction, as well as to all public entities to which, where the relevant conditions are met, disclosure is mandatory under EU provisions, laws, or regulations.

No data transfers abroad are envisaged.

6. Period of retention of personal data

Your personal data will be retained for the entire duration of the contractual obligation and also after its termination for the time necessary to fulfill all applicable legal obligations (e.g., tax-related) and/or administrative obligations related to or arising from the contractual obligation itself.

7. Identity and contact details of the Data Controller and the Data Protection Officer (DPO)

The data controller is Opera Universitaria di Trento, with registered office in Trento, Via della Malpensada n. 82/A.

The data controller can be contacted at the email address: operauniversitaria@pec.operauni.tn.it or by telephone at +39 0461 217411 or fax at +39 0461 217444.

The updated list of data processors, upon request, is available at the headquarters of Opera Universitaria di Trento.

The Privacy Officer, whom you may contact to exercise your rights under the EU Regulation, can be contacted at the following address: Opera Universitaria di Trento, Via della Malpensada n. 82/A, 38123 Trento
Fax: +39 0461.217444 – Certified Email: operauniversitaria@pec.operauni.tn.it – Email: referenteprivacy@operauni.tn.it – Telephone +39 0461.217411.

We also inform you that a Data Protection Officer has been appointed, who can be contacted at the following email address: dpo@operauni.tn.it.

8. Data Subject Rights

At any time, where exercisable by you, pursuant to Articles 15 to 22 of the Regulation, you have the right to:

request confirmation of the existence or otherwise of your personal data;
obtain information regarding the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed and, where possible, the retention period;
obtain rectification and erasure of data;
obtain restriction of processing;
(where applicable) obtain data portability, i.e., receive the data from a data controller, in a structured, commonly used and machine-readable format, and transmit the data to another data controller without hindrance;
object to processing at any time, including in the case of direct marketing purposes;
object to a processing Automated decision-making concerning natural persons, including profiling;
Request from the data controller access to personal data and the rectification or erasure of such data, restriction of processing concerning the data subject, or the right to object to such processing, in addition to the right to data portability;
Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
Lodge a complaint with the Italian Data Protection Authority, located in Rome, Piazza Venezia 11, the Authority’s official website is www.garanteprivacy.it.