PRIVACY POLICY IN ACCORDANCE WITH ART. 13 AND 14 OF REGULATION EU NO. 679/2016 OF 27 APRIL 2016

This privacy policy is issued in accordance with Art. 13 and 14 of Regulation EU 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and in respect of the laws on personal data processing and on the free movement of such data.

Politecnico, in the context of its institutional purposes, includes among its duties that of promoting sports activity based upon Art. 3, paragraph 4, letter d of Italian Legislative Decree 68/2012 and Art. 6, paragraph 1, letter c of Italian Law no. 341 allow the promotion, support and advertising of sports activities for students.

Data Controller
Politecnico di Milano - Director General, delegated by the pro-tempore Rector – e-mail: dirgen@polimi.it.

Internal Data Processor
Ms Chiara Pesenti – Piazza Leonardo da Vinci, 32 Milan (MI) e-mail: chiara.pesenti@polimi.it.

The personal data will be processed by other authorised persons who will receive instructions for that purpose in respect of current legislation.

Data protection officer and contact points
Mr Vincenzo Del Core - privacy@polimi.it - tel. 02 23999378.

Purpose of data processing, legal basis, data categories and storage period.
Under the relevant European and national legislation (Reg. EU 679/2016, hereafter Regulation), we inform you that your personal data will be used for the following purposes:

Considering also the institutional nature of sports activity for Universities based upon the legislation cited above, solely for the purposes of joining the sports club, specific authorisation will be required to allow for the transfer of details of the Equivalent Economic Situation Indicator bracket in order for subsidised rates to be applied, as well as data relating only to the Degree Programme attended to allow for participation in tournaments and other University competitions. Those data will be used in respect of principles of lawfulness, fairness, necessity and minimisation. For minors linked to sports clubs and/or associations that operate in the spaces of Politecnico di Milano, specific consent will be required from the parent or guardian, aimed exclusively at issuing badges for accessing the spaces. No further processing operations are planned.

The images collected during the sports activities envisaged in Purpose 2 will be stored, even in electronic form and on any technological medium for the purposes and within the limits defined above, and may be disseminated in accordance with Italian Law no. 150/2000 on institutional websites as well as via social media networks (Facebook, Twitter, YouTube, by way of example but without limitation). There shall be no entitlement to remuneration for the use of the images. Politecnico di Milano has the right to access or disclose the user’s images without obtaining any consent, based upon Art. 97 of Italian Law no. 633/1941. This authorisation implies the granting of a non-exclusive licence, without limitation on time and for the whole world, transferable to third parties, for use of the Materials, and includes the rights referred to in Articles 12 to 19 of Italian Law 22 April 1941, no. 633, including but not limited to: right of publication; right of reproduction in any way or form; right of transcription, editing, adaptation, processing and reduction; right of communication and distribution to the public, including projection, transmission and broadcasting rights even in summary and/or reduced version, using any technical means, the right to keep a copy of the Materials, even in electronic form and on any known or future technological system for the purposes and within the limits defined above. In any case, in accordance with the cited Article and pursuant to Art. 10 of the Italian Civil Code, any use of the images that may cause prejudice to the honour, reputation or decorum of the person portrayed, taken or recorded, is excluded.

Nature of data
The provision of data is optional for purposes 1, 2 and 3.
Any refusal to provide the data for purposes 1 and 2 above involves the impossibility of joining the sports club, participating in the proposed sports activities and initiatives and of communication and registration to newsletters, prejudicing the user’s opportunity to subscribe. Only for data acquired by Politecnico di Milano relating to the Equivalent Economic Situation Indicator class and the relevant degree programme, the lack of consent will prevent the subsidised rate from being applied and possibly the participation in tournaments, as it prevents the student from being identified. In this case, the maximum rate will be applied. Any refusal to provide the data for purpose 3 indicated above involves the impossibility of receiving newsletters for sports initiatives and events.

Data processing methods
The processing operations carried out for the purposes indicated above will take place on both paper and digital media, manually and/or using electronic or automated tools on the hard drive at the Politecnico di Milano data centre. They may also be stored in paper archives for the duration envisaged for storage of documents relating to administrative procedures and in digital format indeterminately based upon obligations of transparency and proper functioning of the public administration.

Duly authorised persons are entitled to access the data acquired for the aforementioned purposes.

Categories of recipients
In relation to the indicated purposes, the data may be communicated to public and/or private entities, or they may be communicated to companies and/or persons who provide services, even external, on behalf of the Controller. In particular, the personal data may also be communicated to other public administrations, even anonymously, if they need to process the data for any procedures under their own institutional remit, as well as to all public entities to which, in the presence of the respective requirements, the communication is mandatorily required by provisions of European law, rules of law or regulations, as well as insurance bodies in relation to any accidents that may occur.

The following are processors in accordance with Art. 28 of Regulation EU:

• Società Polisportiva Politecnico, for the purposes of membership and communication of sports initiatives;
• Azienda Infordata, for the purposes of managing the platform and for web services.

Transfer to non-EU countries or international organisations
The personal data are not transferred to non-EU countries or to international organisations.

Rights of the data subjects
As the data subject, you may at any time request from the Controller:

• confirmation of the existence or otherwise of personal data concerning you;
• access to your personal data and information relating to them; the rectification of inaccurate data or completion of incomplete data; the erasure of personal data relating to you (in the presence of one of the conditions indicated in Art. 17, paragraph 1 of the Regulation and in respect of the exceptions envisaged by paragraph 3 of that Article); the restriction of processing of your personal data (in the presence of one of the circumstances indicated in Art. 18, paragraph 1 of the Regulation), the transformation into anonymous form or block on data processed in violation of the law, including data whose storage is no longer necessary for the purposes for which it was collected or processed.

As the data subject, you also have the right to object in full or in part:

• on legitimate grounds, to the processing of personal data concerning you, even if relevant to the purpose for which the data was collected;
• to the processing of your personal data for the purposes of transmitting promotional material on training initiatives and cultural events of the Politecnico di Milano.

These rights may be exercised by contacting privacy@polimi.it.

If you believe that your rights have been infringed by the Controller and/or by a third party, you are entitled to lodge a complaint with the Italian Data Protection Authority and/or other competent supervisory authority pursuant to the Regulation.

If the user has lost and/or is not in possession of the access credentials, the same may authorise the reception operator to proceed with the signature of a subscription, providing consent in advance