1. Introduction

Pursuant to Articles 13 and 14 of the Regulation (EU) 2016/679 on the “protection of natural persons with regard to the processing of personal data” (hereinafter also “GDPR”), we are providing the information on the processing of your personal data ("Data") performed by Università Cattolica del Sacro Cuore (hereinafter also the “University”) while connecting to the Website https://www.unicatt.it (the “Website”).

2. Identity and contact details for the Data controller

The Controller of the processing of your Data is Università Cattolica del Sacro Cuore (hereinafter also “Controller”), with registered office in Largo Agostino Gemelli 1, 20123 Milan, tel. (+39) 027234.1

3. Browsing data

The IT systems and programs used for the functioning of the Website collect some personal data whose transmission is implicit in the usage of the TCP/IP Internet communication protocol.

Such information is not collected to be associated with identified data subjects, but by its nature could, through processing and association with data held by third parties, allow identification of data subjects.

This category includes the IP addresses or domain names of computers used by users who connect to the Website, URI addresses - Uniform Resource Identifier – of the requested resources, time of the request, method used in submitting the request to the server, file size obtained in response, numerical code about the status of the response made by the server - favourable outcome, error, etc. - and other parameters related to the operating system and the user's IT environment.

4. Data provided by the user

You may be asked to provide your personal information (e.g. contact data) to enable the University to supply the services you requested. Furthermore, the use of some website features, as well as your voluntary sending of e-mail communications may imply the processing of additional Data referring to you. Specific information notices may be provided or displayed within the Website pages dedicated to particular services.

5. Cookies

Cookies are small strings of texts that are sent to your browser and possibly stored on your computer (alternatively on your smartphone or other device used to access the internet), typically whenever you visit a website. The University uses cookies for a variety of reasons, to help provide you with a faster and safer digital experience, for example by keeping active the connection to restricted areas while browsing through the pages of the Website.

Cookies stored on your device cannot be used to retrieve any data from your hard disk, transmit computer viruses or identify and use your email address. Each cookie is unique to the browser and device you use to access the University’s Website. In general, the purpose of cookies is to improve the functional performance and the user experience of a website.

For more information, please refer to the Cookie policy: https://www.unicatt.it/cookies

6. Purposes of processing and legal basis

Data collected will be processed for the following purposes:

1. Allowing you to access and navigate the Website as well as to use the University online services related to the Website itself (e.g. newsletter sign-up, online job applications), as well as responding to information requests and/or forwarding documentation;
2. Issue and management of the access credentials, IT resources, and on-line services to potential students, events participants and users;
3. Ascertaining liability in the event of possible computer-related crimes against the Website or other websites connected or linked to it;
4. Application of European and/or national regulations.

The legal basis of processing is constituted:

1. For purposes under a) and b), by execution of the contract that you are a part of or execution of pre-contractual measures;
2. For purpose under c), by the legitimate interest pursued by the Controller;
3. For purpose under d), by compliance with legal and regulatory obligations.

An eventual refusal to do provide your Data will entail the objective impossibility for the University to pursue the purposes illustrated above.

7. Processing methods

Personal data are processed manually, digitally and electronically applying logics strictly connected to the purposes and, in any case, to guarantee the security and confidentiality of the data pursuant to laws in force.

8. Data retention

The University will process the Data for the time strictly needed to achieve the abovementioned purposes; with no prejudice to any retention terms established by law or regulations, including internal ones.

9. Categories of recipients

Your Data may be communicated to:

• Public and private Bodies or competent Authorities, to comply with legal or regulatory;
• Companies handling maintenance services for IT resources and on-line services made available through the Website.

The subjects belonging to the categories to which the Data may be communicated, will process the Data and use them, as the case may be, as Data Processors specifically appointed by the Controller pursuant to the law, or as autonomous Data Controllers.

The list of appointed Data Processors is continuously updated and available at the University offices.

10. Transfer of personal data outside the EU

Data can be transferred to non-EU countries, in particular for services located outside the territory of the European Union (e.g. cloud storage). In that case, the Controller hereto assures that the transfer of Data will take place pursuant to the applicable legal provisions.

11. Data Protection Officer, D.P.O.

The University has appointed a Data Protection Officer, D.P.O., who can be contacted by email at dpo@unicatt.it

12. Data subject’s rights

As Data subject you have the right to:

1. Ask the Controller to access the Data, their cancellation, the rectification of inaccurate Data, the integration of incomplete Data, as well as the restriction of processing in the cases set forth in Art. 18 of the GDPR;
2. If the conditions for exercising the right to portability pursuant to Art. 20 of the GDPR are met, receive in a structured form, commonly used and machine-readable format the Data provided to the Controller and, if technically feasible, transmit it to another Data Controller without hindrance;
3. Revoke consent given at any time;
4. Lodge a complaint with a supervisory Authority (Garante per la protezione dei dati personali).

Please note that the right to object, which Article 21 of the GDPR grants to the data subject for reasons related to his or her particular situation, in the event that the legal basis is the performance of a task in the public interest or the legitimate interest of the Controller, remains unaffected.

Those rights may be exercised by registered mail, addressed to Università Cattolica del Sacro Cuore, Direzione Generale (Office of the General Manager) – Privacy, Largo Agostino Gemelli 1, 20123, Milan, or by email to dpo@unicatt.it

Updated on: 14 July 2025