1. Introduction

Pursuant to Articles 13 and 14 of the Regulation (EU) 2016/679 on the “protection of natural persons with regard to the processing of personal data” (hereinafter also “GDPR”), we are providing the information on the processing of your personal data ("Data") performed by Università Cattolica del Sacro Cuore (hereinafter also the “University”).

2. Identity and contact details for the Data controller

The Controller of the processing of your Data is Università Cattolica del Sacro Cuore (hereinafter also “Controller”), with registered office in Largo Agostino Gemelli 1, 20123 Milan, telephone (+39) 027234.1.

3. Categories of personal data

The Data processed by the University include, but are not limited to:

• Common Data: personal data, contact details, your picture in digital format;
• Special categories of personal data pursuant to Art. 9 of the GDPR (e.g. Data concerning health).

4. Purposes of  processing and legal basis

Data collected will be processed for the following purposes:

1. To allow your participation in the initiative to which you intend to participate (e.g. international mobility projects, internships) and for carrying out all activities related to it;
2. Responding to your information requests to the University;
3. Performance of administrative, accounting, tax and financial activities;
4. If necessary, to exercise and/or defend the University legal rights in civil, criminal and/or administrative litigation.
5. Application of European and/or national regulations.

The legal basis of processing is constituted:

1. For purposes under a) and b):
   • With reference to common data, by execution of the contract that you are a part of or execution of pre-contractual measures;
   • With reference to special categories of personal data, by your explicit consent;
2. For purposes under c) and e), by compliance with legal and regulatory obligations;
3. For purposes under d), by the need to establish, exercise or defend legal claims.

An eventual refusal to provide your Data and/or to give consent to the processing of special categories of personal data will entail the objective impossibility for the University to pursue the purposes illustrated above and, consequently, to allow your participation in the initiative to which you chose to adhere.

5. Processing methods

Data are processed by manual, digital and electronic means with logics strictly related to the purposes and, nevertheless, in such a way as to guarantee the security and confidentiality of the Data pursuant to current regulations.

6. Data retention

The University will process the Data for the time strictly needed to achieve the abovementioned purposes; with no prejudice to any retention terms established by law or regulations, including internal ones.

7. Categories of recipients

Your Data can be communicated to external Companies/Entities to comply with legal or regulatory obligations as well as to allow the performance of the service and/or the provision of the service you requested; in particular:

• Public and private Bodies or competent Authorities;
• Organisations associated with the University;
• Banking institutes;
• Universities/companies involved in the initiatives to which the data subject adheres.

The subjects belonging to the categories to which the Data may be communicated, will process the Data and use them, as the case may be, as Data Processors specifically appointed by the Controller pursuant to the law, or as autonomous Data Controllers.

The list of appointed Data Processors is continuously updated and available at the University offices.

8. Transfer of personal data outside the EU

Data can be transferred to non-EU countries, particularly if you decide to participate in initiatives that are held outside the European Union.

In this case, the transfer of Data will take place upon your specific consent, except in cases in which the Data is transferred to countries that the EU Commission has established will guarantee an adequate level of personal Data protection, pursuant to art. 45 of the GDPR.

In this respect please note that, in the absence of your specific consent for the transfer of Data, you can only participate in initiatives that take place within the European Union or in those non- EU countries that ensure an adequate level of personal data protection.

9. Data Protection Officer, D.P.O.

The University has appointed a Data Protection Officer, D.P.O., who can be contacted by email at dpo@unicatt.it.

10. Data subject’s rights

As Data subject you have the right to:

1. Ask the Controller to access the Data, their cancellation, the rectification of inaccurate Data, the integrationI of incomplete Data, as well as the restriction of processing in the cases set forth in Art. 18 of the GDPR;
2. Object, at any time, in full or partially, to the processing of Data required on behalf of  the legitimate interest of the Controller;
3. If the conditions for exercising the right to portability pursuant to Art. 20 of the GDPR are met, receive in a structured form, commonly used and machine-readable the Data provided to the Controller and, if technically feasible, transmit it to another Data Controller without hindrance;
4. Revoke consent given at any time;
5. Lodge a complaint with a supervisory Authority (e.g. Garante per la Protezione dei Dati Personali).

Those rights may be exercised by registered mail, addressed to Università Cattolica del Sacro Cuore, Direzione Generale (Office of the General Manager) – Privacy, Largo Agostino Gemelli 1, 20123, Milan, or by email to dpo@unicatt.it.

Updated on: 1 october 2025