1. Introduction

Pursuant to Articles 13 and 14 of the Regulation (EU) 2016/679 on the “protection of natural persons with regard to the processing of personal data” (hereinafter also “GDPR”), we are providing the information on the processing of your personal data ("Data") performed by Università Cattolica del Sacro Cuore (hereinafter also the “University”).

2. Identity and contact details for the Data controller

The Controller of the processing of your Data is Università Cattolica del Sacro Cuore (hereinafter also “Controller”), with registered office in Largo Agostino Gemelli 1, 20123 Milan, telephone (+39) 027234.1.

3. Categories of personal data

The Data processed by the University include, but is not limited to:

• Common Data: personal data, contact details, your image in digital format, education data;
• Special categories of personal data pursuant to Art. 9 of the GDPR (e.g. data related to health status, such as legal protected status), included in the curriculum or other documentation you have submitted to the University.

 4. Purpose of processing and legal basis

Data provided by you will be processed for purposes related to carrying out recruitment and selection activities.

With reference to common data, the legal basis for processing is constituted by the execution of pre-contractual measures, for example registration in dedicated platform of the University, participation in tests and evaluation questionnaires, including via telematic means.

With reference to special categories of personal data, the legal basis for processing is constituted by your consent, even given through the submission of your application and/or participation in the abovementioned activities.

An eventual refusal to do so and/or to give your consent to the processing of special categories of personal data, will entail the objective impossibility for the University to pursue the purposes illustrated above.

5. Processing methods

Data are processed by manual, digital and electronic means with logics strictly related to the purposes and, nevertheless, in such a way as to guarantee the security and confidentiality of the Data pursuant to current regulations.

6. Data retention

The University will process the data referred to you up to a maximum of 12 months starting from the day of submission of your CV or any other documentation or, alternatively, from the date of the last update made. At the end of the specified period, your CV and any other documentation you may have submitted and, in general, your Data, will be automatically removed from the University systems.

7. Categories of recipients

Your Data can be communicated to external Companies/Bodies for the purposes of carrying out recruitment and selection activities and, in particular:

• Organisations associated with the University;
• Recruitment agencies, headhunters.

 The subjects belonging to the categories to which the Data may be communicated, will process the Data and use them, as the case may be, as Data Processors specifically appointed by the Controller pursuant to the law, or as autonomous Controllers.

The list of appointed Data Processors is continuously updated and available at the University offices.

8. Transfer of personal data outside the EU

Data can be transferred to non-EU countries, in particular for services located outside the territory of the European Union (e.g. cloud storage). In that case, the Controller hereto assures that the transfer of Data  will take place pursuant to the applicable legal provisions.

9. Data Protection Officer, D.P.O.

The University has appointed a Data Protection Officer, D.P.O., who can be contacted by email at dpo@unicatt.it

10. Data subject’s rights

As Data subject you have the right to:

a. Ask the Controller to access the Data, their cancellation, the rectification of inaccurate Data, the integration of incomplete Data, as well as the restriction of processing in the cases set forth in Art. 18 of the GDPR;

 b. If the conditions for exercising the right to portability pursuant to Art. 20 of the GDPR are met, receive in a structured form, commonly used and machine-readable format  the Data provided to the Controller and, if technically feasible, transmit it to another Data Controller without hindrance;

 c. Revoke consent given at any time;

 d. Lodge a complaint with a supervisory Authority (Garante per la Protezione dei dati personali).

Please note that the right to object, which Article 21 of the GDPR grants to the data subject for reasons related to his or her particular situation, in the event that the legal basis is the performance of a task in the public interest or the legitimate interest of the Controller, remains unaffected.

Those rights may be exercised by registered mail, addressed to Università Cattolica del Sacro Cuore, Direzione Generale (Office of the General Manager) – Privacy, Largo Agostino Gemelli 1, 20123, Milan, or by email to dpo@unicatt.it

Updated on: 03 June 2025