DATA PRIVACY POLICY
Updated to EU Reg. 2016/679
(European Data Protection Regulation)

1. Introduction

EUCENTRE Foundation takes your privacy seriously and is committed to respecting it. This privacy policy (“Privacy Policy”) describes the personal data processing activities carried out by the EUCENTRE Foundation through the website www.eucentre.it (hereinafter, the “Site”) and the commitments made in this respect.

The EUCENTRE Foundation may process your personal data when you visit the Site and use its services and functionalities. In the sections of the Site where the user’s personal data are collected, a specific information notice pursuant to art. 13 and/or 15 of EU Reg. 2016/679 is usually published.

Pursuant to Regulation (EU) 2016/679, where required, the user’s consent will be acquired before processing his/her personal data (e.g. for marketing purposes or for the use of certain non-technical cookies). Provide personal data of third parties. You must ensure that the communication of such data to the EUCENTRE Foundation and the subsequent processing for the purposes specified in the applicable privacy policy complies with EU Reg. 2016/679 and applicable law.

2. Identification details of the data controller, data processor and Privacy Officer

The Data Controller is:

EUCENTRE Foundation

Via Adolfo Ferrata 1 – 27100 Pavia (PV) – Italy

PEC: protocollo@pec.eucentre.it

E-mail: privacy@eucentre.it

(Possible Data Processors and the Data Protection Manager – where appointed – are indicated in specific documentation made available by the EUCENTRE Foundation at the request of the data subject).

3. Type of data processed

Visiting and consulting the Site does not generally entail the collection and processing of the user’s personal data, except for navigation data and cookies, as specified below.

In addition to the so-called “surfing data” (see below), personal data voluntarily provided by the user when interacting with the Site’s functionalities or when requesting services (e.g., filling in contact forms, subscribing to newsletters, sending applications, requesting information) may be processed.

In compliance with applicable regulations, the EUCENTRE Foundation may also collect your personal data from third parties in the course of its business (e.g. for administrative, contractual or security checks).

4. Cookies and navigation data

The Site uses “cookies”. The use of technical cookies is necessary for the proper functioning of the Site. The use of cookies other than technical cookies (e.g., third-party analytical or profiling cookies), where present, takes place with the user’s consent, as expressed through the cookie management banner, in accordance with current legislation.

Cookies are small files stored on the user’s device (computer, tablet, smartphone) while the user visits the Site. There are two macro-categories of cookies: technical and profiling cookies.

• Technical cookies are necessary for the proper functioning of a website and to allow the user to navigate; without them, the user may not be able to view pages correctly or use certain services.
• Profiling cookies create user profiles to send advertising messages in line with the preferences expressed during browsing.

Cookies can also be classified as

• session cookies, which are deleted immediately when the browser is closed;
• persistent cookies, which remain in the browser for a defined period of time and are used, for example, to recognise the device connecting to a site by facilitating authentication operations for the user;
• own cookies (first-party), which are generated and managed directly by the operator of the website on which the user is browsing;
• third-party cookies, generated and managed by parties other than the operator of the website on which the user is browsing (e.g. analytics service providers, social networks, external content providers).

The analysis tools used by the Site may include, when activated, Google Analytics 4 (GA4), which collects aggregate statistical information on how the Site is used.

5. Cookies used on the Site

The Site uses the following types of cookies

• own, session and persistent cookies, which are necessary to allow standard navigation on the Site, for internal security and system administration purposes;
• third-party cookies, session and persistent, essential to enable the user to use multimedia elements or embedded content on the Site (e.g. images, videos, maps or embedded content from external platforms such as YouTube, Vimeo or similar services);
• Third-party cookies used for statistical purposes (Google Analytics 4 – GA4):
  the Site may use Google Analytics 4, a web analysis service provided by Google LLC (“Google”), which allows the EUCENTRE Foundation to conduct aggregate statistical analysis of access to and visits to the Site and to understand how users interact with the pages and content. GA4 may operate through cookies and/or similar technologies. The data collected may include, but is not limited to: IP address (usually in an anonymised form through the specific functionality offered by Google, where activated), information on the device and browser used, navigation events (pages visited, clicks, scrolls, session duration) and general information on geographical origin (area/country). The information generated by these cookies about your use of the Site is transmitted to and stored by Google on servers in non-EU countries (e.g. the United States). GA4 is used where required, with the user’s consent expressed via the cookie banner. The user may revoke or modify their consent at any time via the cookie banner functionality. Further information on how Google processes data can be found at: https://policies.google.com/technologies/partner-sites
• Google Fonts:
  the Site uses the “Google Fonts” service to display specific typefaces. The fonts are usually loaded via calls to Google LLC servers, which may be located in non-EU countries (e.g., the USA). On this occasion, specific technical data relating to the user’s device may be transmitted to Google (e.g., IP address, browser information, and the date and time of the request). The use of Google Fonts is required to ensure a consistent and optimised graphical presentation of the Site. Any processing of personal data as a result of the use of Google Fonts is linked to Google’s terms of use and privacy policy: https://policies.google.com/privacy
• third-party, persistent cookies relating to social networks (Facebook, Instagram, X, YouTube, LinkedIn, etc.):
  the Site uses these cookies to enable the inclusion of buttons and widgets from specific social networks on the pages (e.g., share buttons, “Like” buttons, “Follow” buttons, “Subscribe to channel” buttons, etc.). By selecting one of these buttons or interacting with the related widgets, the user can publish the contents of the Site’s web page on their personal page on the relevant social network, or be redirected to the official profiles of the EUCENTRE Foundation on those networks. The installation and use of these cookies may result in social networks collecting information about the user’s navigation on the Site, even in the absence of actual use of the buttons or widgets, in accordance with the policies of the respective managers.

The Site may contain links to other sites (so-called “third-party sites”). The EUCENTRE Foundation has no access to or control over cookies, web beacons and other tracking technologies that may be used by such third party sites that the user may access through the Site; the EUCENTRE Foundation also has no control over the content and materials published by or obtained through third party sites, nor over the manner in which your personal data is processed, and expressly disclaims any responsibility in this regard.

The user is required to review the privacy and cookie policies of third-party sites accessed through the Site and to inform themselves of the conditions applicable to the processing of their personal data by these subjects. This Privacy Policy applies exclusively to the Site as defined above.

6. How to turn off cookies in browsers

You can manage cookies directly through your browser settings. However, if you delete cookies from your browser, the preferences you set for the EUCENTRE Site may be removed, so you should periodically review your settings.

For further information and support, you can visit the specific help pages of the browser you are using, for example:

• Internet Explorer
• Edge
• Firefox
• Safari
• Chrome
• Opera
• Comet
• Atlas

7. Storage of personal data

Personal data are stored and processed through IT systems owned by the EUCENTRE Foundation and/or managed by third-party technical service providers, which may be appointed as Data Processors pursuant to Article 28 of EU Reg. 2016/679. For further details, please refer to the “Scope of communication and access to data” section.

Data shall be processed exclusively by specifically authorised personnel, including those responsible for carrying out extraordinary maintenance operations. Personal data will be retained for the duration of the contractual relationship or the service requested and, subsequently, for the time necessary to fulfil the legal obligations of the EUCENTRE Foundation, including any legal defence requirements, and will then be deleted or anonymised.

Suppose you have given your consent to the processing of your data for direct marketing purposes. In that case, such data will be processed until you revoke your authorisation, without prejudice to the lawfulness of the processing based on your consent until revocation.

8. Purposes and methods of data processing

The EUCENTRE Foundation may process personal data (as well as, where applicable, special categories of data pursuant to Art. 9 of EU Reg. 2016/679, within the limits permitted by law) for the following purposes

• to enable the user to use the services and functionalities on the Site;
• to manage requests and notifications received from users (e.g. requests for information, assistance, contacts)
• manage the subscription and sending of newsletters or informative communications on activities, events, courses and initiatives of the EUCENTRE Foundation
• managing applications received through the Site (e.g. sending CVs, spontaneous applications or responses to advertisements);
• to fulfil legal, regulatory and normative obligations related to the activities of the EUCENTRE Foundation.

With the further and specific optional consent of the user, the EUCENTRE Foundation may process personal data also for marketing purposes, i.e. to send the user promotional material and/or commercial communications about the services and activities of the Foundation, to the addresses indicated, both through traditional methods and/or means of contact (such as paper mail, telephone calls with operator, etc.) and through automated processes (such as mail, telephone calls with operator, etc.).) or by automated means (such as internet communication, e-mail, SMS, mobile applications, social network accounts – e.g. Facebook, Instagram, X, YouTube, LinkedIn -, telephone calls with automated systems, etc.).

Personal data are processed both in paper form and with electronic tools, and entered into the company’s information systems in full compliance with EU Reg. 2016/679, including security and confidentiality profiles, and are inspired by the principles of fairness, lawfulness, transparency, minimisation and limitation of storage. The data are kept and retained for the time necessary to achieve the purposes for which they are collected and processed, and, in any case, for as long as the user decides to be subscribed to the services of the Site, except for any further retention periods required by law or for legal protection.

9. Security and quality of personal data

The EUCENTRE Foundation is committed to protecting the security of the user’s personal data and complies with the security provisions set out in the applicable legislation, to avoid loss of data, illegitimate or unlawful use and unauthorised access, with particular reference to the appropriate technical and organisational measures required by EU Reg. 2016/679.

The information systems and computer programmes used by the EUCENTRE Foundation are configured to minimise the use of personal and identification data; such data are processed only to the extent necessary to achieve the specific purposes pursued from time to time.

EUCENTRE uses appropriate security technologies and procedures to protect your personal data; for example, data is stored on secure servers located in access-controlled locations. Users can help keep their personal data up to date and correct by promptly notifying any changes (address, contact details, qualifications, etc.).

10. Scope of data communication and access

The user’s personal data may be communicated to

• all subjects whose right to access the data is recognised by virtue of provisions of law, regulations or EU legislation
• collaborators and employees of the EUCENTRE Foundation, within the scope of their respective duties and in their capacity as persons authorised to process data in accordance with Art. 29 of EU Reg. 2016/679;
• third parties, natural or legal persons, public or private (e.g. IT service providers, cloud service providers, system maintenance companies, consultants, credit institutions, supervisory and control authorities and bodies), when the communication is necessary or functional to the performance of the activities of the EUCENTRE Foundation, in the manner and for the purposes described above.

These subjects, if they process data on behalf of the EUCENTRE Foundation, are appointed, where required, as Data Processors pursuant to Art. 28 of EU Reg. 2016/679.

The use of services provided by Google LLC (e.g. Google Analytics 4, Google Fonts, YouTube) and other third-party service providers may result in the transfer of specific technical data (such as IP address and other browsing information) to countries outside the EU (such as the USA). Such transfers take place in compliance with Articles 44 et seq. of EU Reg. 2016/679 and, where required, based on the consent expressed by the user via the cookie banner or other suitable mechanisms, without prejudice to the possible use of appropriate legal instruments (such as adequacy decisions, standard contractual clauses, additional security measures).

11. Nature of provision of personal data

The provision of specific personal data by the user is compulsory to allow the EUCENTRE Foundation to manage communications and requests received, as well as to contact the user to respond to their requests. These data are usually marked with an asterisk [*]. If this data is not provided, the EUCENTRE Foundation will not be able to respond to your requests.

The provision of other personal data not marked with an asterisk is optional; failure to provide such data will not usually have any detrimental consequences for the user, although it may limit the completeness of the information provided or the services delivered.

The provision of personal data for marketing purposes (as specified in the section “Purposes and methods of data processing”) is optional, and failure to provide consent will not affect the ability to use the primary services offered by the Site. Any consent given for marketing purposes shall be deemed extended to the sending of communications by both automated and traditional methods and/or means of contact, as exemplified above, without prejudice to the user’s right to object at any time, even selectively.

12. Rights of the interested party

12.1 Articles 15 (right of access) and 16 (right of rectification) of EU Reg. 2016/679

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him or her is being processed and, if so, to obtain access to the personal data and the following information

• the purposes of the processing;
• the categories of personal data concerned
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients in third countries or international organisations
• the period for which the personal data will be retained or, if this is not possible, the criteria used to determine that period
• the existence of the right of the data subject to request from the controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning them, or to object to their processing
• the right to complain to a supervisory authority;
• the existence of an automated decision-making process, including profiling, and, at least in such cases, meaningful information on the logic used, as well as the importance and expected consequences of such processing for the data subject.

12.2 Right under Article 17 of EU Reg. 2016/679 – right to erasure (“right to be forgotten”)

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him/her without undue delay, and the controller shall be obliged to erase the personal data without undue delay if one of the following grounds exists:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• the data subject withdraws the consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2)(a), and if there is no other legal basis for the processing;
• the data subject objects to the processing pursuant to Article 21(1) and there is no overriding legitimate ground for processing, or objects to the processing in accordance with Article 21(2);
• personal data have been unlawfully processed;
• the personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject;
• the personal data has been collected in connection with the provision of information society services as referred to in Article 8(1) of EU Reg. 2016/679.

12.3 Right under Art. 18 – right to restriction of processing

The data subject shall have the right to obtain from the data controller the limitation of processing when one of the following cases occurs:

• the data subject contests the accuracy of personal data, for the period necessary for the controller to verify the accuracy of such data;
• the processing is unlawful, and the data subject objects to the erasure of the personal data and requests that their use be restricted instead;
• although the controller no longer needs the personal data for processing, the personal data are necessary for the establishment, exercise or defence of legal claims by the data subject;
• The data subject has objected to the processing pursuant to Article 21(1) of EU Reg. 2016/679, pending verification of whether the data controller’s legitimate grounds prevail over those of the data subject.

12.4 Right under Article 20 – right to data portability

The data subject shall have the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning him/her provided to a data controller. It shall have the right to transmit such data to another data controller without hindrance from the original data controller, within the limits and under the conditions provided for in Article 20 of EU Reg. 2016/679.

13. Withdrawal of consent to processing

The data subject has the right to withdraw consent to the processing of their personal data at any time, without prejudice to the lawfulness of the processing based on consent before the revocation.

To exercise this right, the data subject may send

• a registered letter with acknowledgement of receipt to the following address:

Fondazione EUCENTRE – Via Adolfo Ferrata 1 – 27100 Pavia (PV) – Italy

accompanying the request with a copy of a valid identity document and specifying in the text: “revocation of consent to the processing of all my personal data

or

• a communication by PEC to protocollo@pec.eucentre.it specifying in the subject line: “revocation of consent to the processing of all my personal data” and attaching, if necessary, a copy of a valid identity document.

For further information on the processing of personal data or to exercise the other rights listed in point 12 above, the data subject may use the exact contact details, clearly indicating the nature of the request (access, rectification, cancellation, restriction, opposition, portability, etc.).

Before providing or modifying any information relating to the data subject, the EUCENTRE Foundation reserves the right to verify the applicant’s identity. A reply will be provided as soon as possible, and in any case within the law.