Privacy Policy

PRIVACY POLICY FOR CLIENT PERSONAL DATA PROCESSING PURSUANT TO ART. 13 OF THE (EU) 2016/679 REGULATION ("GDPR")

	DATA CONTROLLER	Politecnico di Milano - General Management General Manager on instructions from the pro-tempore Rector. Address: Piazza Leonardo Da Vinci, 32, 20133, Milano dirgen@polimi.it; (“Organization”).
	DATA PROTECTION OFFICER (DPO)	Address (Piazza Leonardo Da Vinci, 32, 20133, Milano), e-mail (privacy@polimi.it).

PROCESSING PURPOSES AND TERMS OF LAWFUL HANDLING		DATA STORAGE PERIOD
Delivery of services requested by you The data you provide will be processed for the following purposes: Registration to the web site www.osservatori.net that enables to access free content (i.e. some Research reports, Business Cases, Infographics, etc.) of the Digital Innovation Observatories of the Department of Management, Economics and Industrial Engineering of the Politecnico di Milano (hereinafter: "Observatories"); Register for free events (Conferences, Workshops, Seminars, etc.) organized by the Observatories. The condition that makes the processing legitimate is the execution of a contract.	The data will be stored: In relation to site registration, up to 10 years following the registration; In relation to registration to events, up to 10 years after each event.
Comply with legislative requirements and applicable National and international regulations. The condition that makes the processing legitimate is the requirement to comply to legal obligations.	The data will be retained as long as the obligations under applicable regulations or national or supranational legislation remain.
If necessary, to verify, exercise or defend the Data subject’s rights in a court of law. Data processing is legitimate when the data subject expresses a justified interest.	In the case of court litigation, the data will be maintained for the duration of the litigation, until the terms for attempting appeal actions are exhausted
Scientific promotion and dissemination The data you provide will be processed with your consent for the following additional purposes of treatment Weekly delivery of the "Osservatori Digital Innovation Update" newsletter with the latest news on research and events of the Observatories; communications regarding events (invitations to Conferences, Workshops, Seminars, etc.) and free/premium Observatory content (publications, research reports, ...) via email and/or SMS [texts] and/or instant messaging; Involvement in Research activities (e.g. surveys, telephone interviews, etc.) of the Observatories. The condition that makes the processing legitimate is your consent (voluntary and revocable at any time). The withdrawal of consent does not affect previously performed data processing activities.	Data will be stored until consent is revoked and/or for a maximum of 10 years
Scientific promotion and dissemination on behalf of the MIP Politecnico di Milano Graduate School of Business – Joint Stock Consortium company. The data you provide will be processed, subject to your consent, to allow the Observatories to conduct scientific promotion and dissemination activities related to events and training courses of the MIP Politecnico di Milano Graduate School of Business. The condition that makes processing legitimate is your consent (voluntary and revocable at any time). The withdrawal of consent does not affect previously performed data processing activities.	Data will be stored until consent is revoked and/or for a maximum of 10 years
Communication of data to third parties and in particular to partners and sponsors of Observatory events/research. The data you provide will be processed, subject to your consent, to allow the Observatories to communicate the data to the aforementioned subjects who will process them for their communications regarding their products, services, newsletters and events as well as to carry out market studies and statistical analyzes. The condition that makes processing legitimate is your consent (voluntary and revocable at any time). The withdrawal of consent does not affect previously performed data processing activities.	Data will be stored until consent is revoked and/or for a maximum of 10 years
Use of images and multimedia materials for information, promotion and scientific dissemination. In the case of participation in the events organized by the Politecnico di Milano (following your enrolment or registration), participants are notified that audio and video recordings may be conducted, possibly incorporating their image and/or voice (for example during training events), through any channel and/or means, to pursue institutional purposes of scientific information, promotion and dissemination. The data being processed, including images, frames, footage and audio/video recordings (hereinafter the "Images"), also in partial form and/or modified or adapted, made during the event will be treated in full compliance with the 2016/679 EU Reg (“GDPR”). By way of example, Images, also in partial and/or modified and/or adapted form, can be used for the following purposes during and on occasion of the event: publication on the websites included in the Politecnico di Milano circuit and ensure live streaming availability, that is, on-demand on the www.osservatori.net website; Publication on Observatories social media platforms, including the social network channels of The Directors and Observatory Researchers; availability to public and media such as the press and television, as part of institutional activities of the Politecnico di Milano; conduct Observatory communication activities for orientation and activity promotion purposes (for example, documents for the presentation of Observatory research presentation and/or delivering to event and Observatory research partners and sponsors advertisements, information materials, brochures, etc. The data will be processed, also with the help of electronic means, by specifically appointed entities, for the data Controller’s communication and dissemination activities. The collected images will be stored, also electronically and on any technology media for the purposes and within the limitations defined above and may be disseminated pursuant to Law 150/2000 on institutional sites as well as through social networks (by way of example but not limited to, Facebook, Twitter, LinkedIn, YouTube). The use of images does not entitle you to any compensation. The Data Controller has the right to access or disclose images of the user without consent, pursuant to Art. 97 of Law 633/1941. Such authorisation implies granting a non-exclusive license, with no duration limit worldwide, that is transferable to third parties, for the use of the materials, and includes rights as per Articles from 12 to 19 of Law April 22, 1941 n. 633, including, but not limited to, the right to publish; right to reproduce in any way or form; right to transcribe, edit, adapt, process and reduce; The right to communicate and distribute to the public, including the right to project, broadcast and spread also in summarized and/or reduced version, by any technical means, the right to store copies of the materials, even in electronic form and on any currently known or invented in the future technology media, for purposes defined above. In any case, pursuant to article 10 of the Civil Code (Italian Law), any use of the Images that may jeopardize the honour, reputation or decorum of the person portrayed, filmed or recorded is excluded If you want to avoid the possibility of any footage of you being recorded, we ask that you not access the area of the event. If available by subscription, you will be able to view the Streamed Web Event by accessing your reserved area on www.osservatori.net. The condition that makes the processing legitimate is the execution of a contract (which occurs with your enrolment or registration).	For the purposes listed herein the images will be processed pursuant to principles in art. 5 of the GDPR, for a period not exceeding 5 years for the attainment of such objectives and in compliance with conservation limitation purposes, without prejudice to previously conducted data treatments.
Profiling The data you provide will be processed with your consent to enable the Observatories to create profiles (individual and/or aggregated) to develop statistical analyses and/or to improve products and services, as well as to send you targeted promotional information and communications that you may enjoy and may be of greater interest to you. The condition that makes treatment legitimate is your consent (voluntary and revocable at any time). The withdrawal of consent does not affect previously performed data processing activities.	Data will be stored until consent is revoked and/or for a maximum of 5 years
Upon expiry of the storage periods indicated above the Data will be destroyed, erased, or rendered anonymous, in accordance with technical erasure and backup procedures.

DATA RECIPIENTS

The data can be processed by external entities operating as controllers such as, but not limited to, self-employed professionals (e.g. law firms, accountants), supervisory authorities and bodies, and public or private entities in general, entitled to request the data

The information may also be processed, on behalf of the Organization, by external parties designated as controllers that have received adequate operating instructions. Data subjects are essentially included in the following categories:

entities providing e-mail delivery services and/or tax management and billing activities;
Entities providing web site IT maintenance and management services;

Companies providing support for the development of market studies.

DATA SUBMISSION

Submitting data in the registration form is mandatory for the purpose set forth in point 1 above for the provision of the services requested by you. Failure to provide this data will result in the failure to register with the site and consequently the inability to access the content of the Observatories and to register for free events (conferences, workshops, seminars, etc.) organized by the Observatories. Failure to provide the data and your consent for purposes set forth in points 2, 3, 4 and 6 is optional, therefore, will have no effect on registration to the site or events.

AUTHORIZED DATA PROCESSORS

The data may processed by company employees or collaborating staff, in key roles that are in charge of pursuing the goals set forth herein, that have been specifically authorized to process it and have been given adequate operating instructions.

TRASFERS OF PERSONAL DATA TO COUNTRIES OUTSIDE THE EUROPEAN UNION

Personal data may be transferred abroad, in accordance with the Regulation, even to non-EU countries when this is required for one of the purposes set forth in this policy. The transfer to non-EU countries, in addition to cases where this is ensured by the adequacy of the European Commission's decisions, is conducted in a way that provides pertinent and appropriate guarantees under Articles 46 or 47 or 49 of the Regulation.

RIGHTS OF DATA SUBJECT – COMPLAINT TO THE SUPERVISORY AUTHORITY

By contacting the email address (privacy@osservatori.net) data subjects can demand from the Controller, at any time, to:

access the data concerning them, to have it erased, correct incorrect data, integrate incomplete data, as well as restrict its processing;
object to the processing conducted for the performance of a task carried out in the public interest or in the exercise of official authority pursuant to art. 6 let. e);
revoke the consent given at any time, without prejudice to the legitimacy of previously conducted processing.

As regards recorded images, in view of the intrinsic nature of the data processed as real-time images of an event, certain rights cannot, to all effects, be exercised (the right to update or integrate, the right to erasure, the right to rectification as per Article 16 GDPR).

In the event of objection of the data subject, the Controller, in consideration of the available technology and the cost of implementation, where technically possible will adopt reasonable steps, including technical measures, to conceal the image of the participant who has objected for legitimate reasons or has requested erasure.

Data subjects are also entitled to file a complaint with the relevant Supervisory Authority (Article 77 GDPR), as well as seek judicial remedy (Article 79 GDPR).

In addition, if processing is based on consent or on the contract and is conducted through automated tools, data subjects are entitled to receive the data in a structured, commonly used format that can be read by data automated devices, and, if technically feasible, transmit it to another controller without hindrance.

Data subjects concerned have the right to withdraw at any time the consent granted for scientific promotion and dissemination, as well as to object to the data processing for the purpose of sending communications on events, without prejudice to previously conducted processing.