University general informationnotice

1. Introduction

Pursuant to Articles 13 and 14 of the Regulation (EU) 2016/679 on the “protection of natural persons with regard to the processing of personal data” (hereinafter also “GDPR”), we are providing the information on the processing of your personal data ("Data") performed by Università Cattolica del Sacro Cuore (hereinafter also the “University”).

2. Identity and contact details for the Data controller

The Controller of the processing of your Data is Università Cattolica del Sacro Cuore (hereinafter also “Controller”), with registered office in Largo Agostino Gemelli 1, 20123 Milan, tel. (+39) 027234.1.

3. Categories of personal data

The Data processed by the University include, but are not limited to, personal data and contact details and payment data.

We would also like to inform you that closed circuit video-surveillance systems are operating in the University, suitably signalled before the relevant range by means of proper information notices, as set forth in the General Measure on Video-surveillance, issued by the Personal Data Protection Authority on 8 April 2010. Therefore, Data includes your image displayed and/or recorded through the closed-circuit video-surveillance systems.

4. Purposes of processing and legal basis

Data collected will be processed for the following purposes:

1. Fulfilment of obligations related to your position of potential student, participant and/or user of the various initiatives and/or services, as well as the execution of the University’s institutional functions;
2. Issue and management of the access credentials, IT resources, and on-line services to potential students, events participants and users;
3. Sending communications and information through automated and non-automated means in order for you to take part and enroll in bachelor and master programs, seminars, orientation events (e.g. Open day, Welcome day, etc.) organised directly by the University and/or in collaboration with the latter, as well as to assess your level of your satisfaction;
4. Answers to requests for information you may send to the University through online form, web chat, e-mail or interaction with the University social media profiles;
5. Subject to your specific consent, sending of communications and information material by automated and non-automated means, related to: registration to events organised by University’s partners and/or third parties, promotional activities, surveys related to research initiatives;
6. Subject to your specific consent, the free-of-charge use by the University, directly or through authorised third parties, of images and/or videos and sound recordings of you recorded during the events organized directly by the University and/or in collaboration with the latter, as well as during interviews and/or videos for research, study, communication and promotional activities of the University (publications, brochures, posters, commercials, advertising etc.);
7. Security and property protection purposes;
8. Managing the obligations arising from donations received;
9. Application of European and/or national regulations.

 The legal basis of processing is constituted:

1. For purposes under a), b), c) and d), by execution of the contract that you are a part of or execution of pre-contractual measures, for example registration for orientation events;
2. For purposes under e) and f), by your consent;
3. For purpose under g), by the legitimate interest of the Controller;
4. For purpose under h), by compliance with legal and regulatory obligations and by the legitimate interest of the Controller;
5. For purpose under i), by compliance with legal and regulatory obligations.

Aan eventual refusal to provide your Data will entail the objective impossibility to fulfil your requests and/or allow you to take part in courses, seminars, activities and events.

5. Processing methods

Data are processed by manual, digital and electronic means with logics strictly related to the purposes and, nevertheless, in such a way to guarantee the security and confidentiality of the Data pursuant to current regulations.

6. Data retention

The University will process the Data, including those collected by video-surveillance circuits, for the time strictly needed to achieve the abovementioned purposes; with no prejudice to any retention period provided by laws or regulations, including internal ones.

7. Categories of recipients

Your Data may be communicated to:

• Public and private Bodies or competent Authorities, to comply with legal or regulatory obligations and to enable the service/supply of the service you requested;
• Companies handling maintenance services for the video-surveillance system, IT resources and on-line services made available to students and/or users.

The subjects belonging to the categories to which the Data may be communicated, will process the Data and use them, as the case may be, as Data Processors specifically appointed by the Controller pursuant to the law, or as autonomous Data Controllers.

The list of appointed Data Processors is continuously updated and available at the University offices.

8. Transfer of personal Data outside the EU

Data can be transferred to non-EU countries, in particular for services located outside the territory of the European Union (e.g. cloud storage). In that case, the Controller hereto assures that the transfer of Data will take place pursuant to the applicable legal provisions.

9. Data Protection Officer, D.P.O.

The University has appointed a Data Protection Officer, D.P.O., who can be contacted by email at dpo@unicatt.it

10. Data subject’s rights

As Data subject you have the right to:

1. Ask the Controller to access the Data, their cancellation, the rectification of inaccurate Data, the integration of incomplete  Data, as well as the restriction of processing in the cases set forth in Art. 18 of the GDPR;
2. If the conditions for exercising the right to portability pursuant to Art. 20 of the GDPR are met, receive in a structured form, commonly used and machine-readable format the Data provided to the Controller and, if technically feasible, transmit it to another Data Controller without hindrance;
3. Revoke consent given at any time;
4. Lodge a complaint with a supervisory Authority (Garante per la protezione dei dati personali).

Please note that the right to object, which Article 21 of the GDPR grants to the data subject for reasons related to his or her particular situation, in the event that the legal basis is the performance of a task in the public interest, or the legitimate interest of the Controller, as well as for the achievement of the purposes set out in Article 4 letter e) of this notice, remains unaffected.

Those rights may be exercised by registered mail, addressed to Università Cattolica del Sacro Cuore, Direzione Generale (Office of the General Manager) – Privacy, Largo Agostino Gemelli 1, 20123, Milan, or by email to dpo@unicatt.it

Updated on: 25 September 2025