1. Introduction

Pursuant to Articles 13 and 14 of the Regulation (EU) 2016/679 on the “protection of natural persons with regard to the processing of personal data” (hereinafter also “GDPR”), we are providing the information on the processing of your personal data ("Data") performed by Università Cattolica del Sacro Cuore (hereinafter also the “University”).

2. Identity and contact details for the Data controller

The Controller of the processing of your Data is Università Cattolica del Sacro Cuore (hereinafter also “Controller”), with registered office in Largo Agostino Gemelli 1, 20123 Milan, tel. (+39) 027234.1.

3. Categories of personal data

The Data processed by the University include, but are not limited to, personal data and contact details.

4. Purposes of processing and legal basis

Data collected will be processed for the following purposes:

1. to allow you to obtain information on the activities of Università Cattolica del Sacro Cuore and to help you liaise with the University staff that can provide feedback to the requests for information you have submitted. The channels made available by the University are:
   • Call Centre: phone service;
   • Call Back service: to book a contact with an operator;
   • Web Chat service: to start a web conversation with an operator;
   • e-mail or online form communication services;
2. Customer satisfaction survey;
3. Application of European and/or national regulations;
4. Security and property protection purposes.

The legal basis of processing is constituted:

1. For purposes under a) and b), by your consent;
2. For purpose under c), by compliance with legal and regulatory obligations;
3. For purpose under d) by the legitimate interest of the Controller.

An eventual refusal to provide your Data will entail the objective impossibility to fulfil your requests.

5. Processing methods

Data are processed by manual, digital and electronic means with logics strictly related to the purposes and, nevertheless, in such a way as to guarantee the security and confidentiality of the Data pursuant to current regulations.

6. Data retention

The University will process the Data for the time strictly needed to achieve the abovementioned purposes; with no prejudice to any retention terms established by law or regulations, including internal ones.

For personal data acquired during services provision, the storage time envisaged is 12 months from the first contact and / or from the exhaustion of the purposes for which such data were provided. After this period, Data will be made anonymous.

7. Categories of recipients

Your Data may be communicated to:

• Public and private Bodies to enable the service/supply of the service you requested as well as competent Authorities, to comply with legal or regulatory obligations;
• Companies in charge of the activities necessary for the provision of services, maintenance of IT resources and services made available to students and/or users.

The Subjects belonging to the categories which the Data may be communicated, will process the Data and use them, as the case may be, as Data Processors specifically appointed by the Controller pursuant to the law, or as autonomous Data Controllers.

The list of appointed Data Processors is continuously updated and available at the University offices.

8. Transfer of personal Data outside the EU

Data can be transferred to non-EU countries, in particular for services located outside the territory of the European Union (e.g. cloud storage). In that case, the Controller hereto assures that the transfer of Data will take place pursuant to the applicable legal provisions.

9. Data Protection Officer, D.P.O.

The University has appointed a Data Protection Officer, D.P.O., who can be contacted by email at dpo@unicatt.it

10. Data subject’s rights

As Data subject you have the right to:

1. Ask the Controller to access the Data, their cancellation, the rectification of inaccurate Data, the integration of incomplete Data, and the restriction of processing in the cases set forth in Art. 18 of the GDPR;
2. Object, at any time, in full or partially, to the processing of Data required on behalf of the legitimate interest of the Controller;
3. If the conditions for exercising the right to portability pursuant to Art. 20 of the GDPR are met, receive in a structured form, commonly used and machine-readable the Data provided to the Controller and, if technically feasible, transmit it to another Data Controller without hindrance;
4. Revoke consent given at any time;
5. Lodge a complaint with a supervisory Authority (Garante per la Protezione dei Dati Personali).

Those rights may be exercised by registered mail, addressed to Università Cattolica del Sacro Cuore, Direzione Generale (Office of the General Manager) – Privacy, Largo Agostino Gemelli 1, 20123, Milan, or by email to dpo@unicatt.it

Updated on: 31 July 2025