1. Introduction

Pursuant to Articles 13 and 14 of the Regulation (EU) 2016/679 on the “protection of natural persons with regard to the processing of personal data” (hereinafter also “GDPR”), we are providing the information on the processing of your personal data ("Data") performed by Università Cattolica del Sacro Cuore (hereinafter also the “University”).

2. Identity and contact details of the Data controller

The Controller of the processing of your Data is Università Cattolica del Sacro Cuore (hereinafter also “Controller”), with registered office in Largo Agostino Gemelli 1, 20123 Milan, telephone (+39) 027234.1.

3. Categories of personal Data

The Data processed by the University include:

• Common Data: personal data and contact details (e.g. address and telephone number), education, payment data, your picture in digital format;
• Special categories of personal data pursuant to Art. 9 of the GDPR (e.g. data on health status and data on religious beliefs).

We would also like to inform you that there are closed circuit video-surveillance systems operating in the University, suitably signalled by proper information notices posted outside the area covered by the surveillance cameras, clearly visible regardless of lighting conditions, as set forth in the General Measure on Video-surveillance, issued by the Personal Data Protection Authority (“Authority”) on 8 April 2010 (“Video-surveillance Measure”). Therefore, Data includes your picture viewed and/or recorded through the closed-circuit video-surveillance systems.

4. Purposes of the processing and legal basis

Data provided by you will be processed for the following purposes:

1. Registration for admission tests / calls for applications, performing the enrolment process and the obligations connected to the position of student/user of the various initiatives, issuing identification tools (e.g. badge), performing the University’s institutional functions- including internship, orientation and placement initiatives, cultural promotion, pastoral missions, scientific and educational information, carrying out electoral procedures provided by the University Regulations -  as well as the use and provision of additional services (e.g. scholarships and financial contributions tutors, library);
2. Sending communications and information through automated and non-automated means related to academic offer and related services, in order for you to take part and enrol in bachelor and master programs, seminars, orientation events (e.g. Open day, Career day, etc.) organised directly by the University and/or in collaboration with the latter, pastoral centre activities, allocation of scholarships as well as to assess your level of satisfaction and learning;
3. Responding to requests for information you may send to the University;
4. Conducting administrative, accounting, fiscal and capital activities;
5. Subject to your specific consent, sending of communications and information material  by automated and non-automated means, concerning: registration to events organised by University partners and/or third parties, promotional activities, surveys linked to research activities;
6. Subject to your specific consent, communication of information related to your administrative/academic position to subjects you indicated during the enrolment process, with no prejudice to the fact that only subjects specifically indicated by you may receive such information;
7. Access to the preventive medicine service;
8. Security and property protection purposes, including the control of physical access to classrooms, laboratories and University premises;
9. Application of European and/or national regulations.

The legal basis of processing is constituted:

1. For purposes under a), b), c) and g):
   • With reference to common data, by execution of the contract that you are a part of or execution of pre-contractual measures, for example participation in admission tests;
   • With reference to special categories of personal data, by the need to comply with obligations deriving from the exercise your social protection rights for purposes connected to the performance of academic support activities, to the benefit from financial contributions or from additional services or to the provision of other specific activities connected to execution of the University’s institutional functions and by the need to fulfil preventive medicine or occupational medicine purposes;
2. For purposes under d) and i), by compliance with legal and regulatory obligations;
3. For purposes under e) and f), by your consent;
4. For purposes under h) by the legitimate interest of the Controller.

An eventual refusal to do so will entail the objective impossibility for you to enrol in the University, to perform the administrative activities connected to your position as student/user of educational initiatives, to comply with legal obligations, and to fulfil your requests and/or allow you to take part in courses, seminars, activities and events.

5. Processing methods

Data are processed manually, digitally and electronically applying logics strictly connected to the purposes and, in any case, to guarantee the security and confidentiality of the Data pursuant to the laws in force.

6. Data retention

The University will process the Data, including those collected by video-surveillance circuits, for the time strictly needed to achieve the abovementioned purposes, with no prejudice to any retention periods provided by laws or regulations, including internal ones.

7. Categories of recipients

Your Data can be communicated to external Companies/Entities to comply with legal or regulatory obligations and/or to enable the service/supply of the service you requested; in particular:

• Public and private entities;
• Banking institutes;
• Subjects, Institutions and various bodies, also ecclesiastic, for purposes connected to the execution of the institutional functions of the University;
• External Companies/Bodies for activities supporting the University in sending communications and information material, also related to promotional activities, as well as surveys linked to research initiatives;
• Companies providing substitute storage services;
• Public administration, public security authorities, judicial authorities and other competent authorities.

The subjects belonging to the categories to which the Data may be communicated, will process the Data and use them, as the case may be, as Data Processors specifically appointed by the Controller pursuant to the law, or as autonomous Controllers.

The list of appointed Data Processors is continuously updated and available at the University offices.

8. Transfer of personal data outside the EU

Data can be transferred to non-EU countries, in particular for services located outside the territory of the European Union (e.g. cloud storage). In this case, the Controller hereto assures that the transfer of Data will take place pursuant to the applicable legal provisions.

9. Data Protection Officer, D.P.O.

The University has appointed a Data Protection Officer, D.P.O., who can be contacted by email at dpo@unicatt.it

10. Data subject’s rights

As Data subject you have the right to:

1. Ask the Controller to access the Data, their cancellation, the rectification of inaccurate Data, the integration of incomplete Data, as well as the restriction of processing in the cases set forth in Art. 18 of the GDPR;
2. If the conditions for exercising the right to portability pursuant to Art. 20 of the GDPR are met, receive in a structured form, commonly used and machine-readable format the Data provided to the Controller and, if technically feasible, transmit it to another Data Controller without hindrance;
3. Revoke consent given at any time;
4. Lodge a complaint with a supervisory Authority (Garante per la Protezione dei dati personali).

Please note that the right to object, which Article 21 of the GDPR grants to the data subject for reasons related to his or her particular situation, in the event that the legal basis is the performance of a task in the public interest, or the legitimate interest of the Controller, as well as for the achievement of the purposes set out in Article 4 letter e) of this notice, remains unaffected.

Those rights may be exercised by registered mail, addressed to Università Cattolica del Sacro Cuore, Direzione Generale (Office of the General Manager) – Privacy, Largo Agostino Gemelli 1, 20123, Milan, or by email to dpo@unicatt.it

Updated on: 18 June 2025