Marketing Privacy Policy

Information on the processing of personal data - articles 13 and 14 of EU Regulation 2016/679 ("GDPR")

Contact information collection form to update data subject on John Cabot University initiatives

Personal data controller
John Cabot University ("JCU"), with registered office in Via della Lungara, 233, 00165 Rome, Italy, is the Data Controller, as required by articles 4 and 24 of EU Regulation 679/2016, with reference to the use of personal data (hereinafter "Data"), including those called "special categories of personal data" which may be deductible, even indirectly, from information provided by the data subject or by a third party.

Personal data processors
John Cabot University uses the following subjects as Data Processors:

However, it is possible that JCU identifies other subjects designated as Data Processors but not included in the table above, in any case, these subjects will be functional to the processing operated by JCU and bound to the principle of purpose as well as to the respect of the current legislation on the protection of personal data.

1. Information being processed

If you decide to provide us by filling in the information request form, the following information/personal data will be processed:

• Name, contact information such as email address and telephone number and date of birth;
• information relating to training (Ongoing attended school or previously attended, academic interests, ...).

In addition, if the data subject assumes the position of student of the JCU, we will use the information collected here - together with the additional information we will acquire during the application phase - in the documentation relating to his/her interaction with JCU and his/her preferences (relating to the services of assistance required, tutoring and orientation activities, housing, ...).

2. Purpose of data processing

This privacy notice applies as long as the data subject does not develop a further relationship with the University, at the moment in which the data subject obtains the status of student of JCU, we will take care of giving information about this process, even in virtue of the numerous information which, although in compliance with the principles set out in articles 5 and 25 of GDPR, we will request.

Considering the above information, the data will be processed for the following purposes:

1. provide information and/or service requested (due to the completion of the form submitted to you) and proceed with institutional communications;
2. organizational reasons to promote the activity of JCU and inform the data subject about the Orientation initiatives;
3. research and statistical purposes. These data can be processed both on a non-aggregated basis and on an anonymous and aggregated basis.

3. Legal basis for the processing of your information

We may process your personal data because it is necessary for a legal obligation, to respond to a particular request from you, for a legitimate interest of JCU to promote its image and its educational purpose, consistently with the interest expressed by the data subject.

4. Process methods and data retention

The personal data of the data subject are processed in paper or electronic format.

Adequate security measures are adopted to prevent data breaches, unlawful or incorrect use and unauthorized access and to guarantee the security of data processed under the triple profile of confidentiality, integrity and availability.

Data will be retained exclusively for the period and the purposes for which they were collected.

In any case, the deletion will take place within 10 years of collection.

5. Communication and circulation of data

The personal data of the data subject can be processed by JCU staff, teachers and subjects of JCU or who collaborate with JCU, who need these data to carry out their duties, as well as other subjects who provide services to which the University has specifically assigned the task of processor or qualified interlocutor (for example, considering that it is an independent data controller) for the processing of Data.

The processing of data, from simple access, to visualization and data entry, is always bound to the purpose for which Data were collected in conformity with the principles expressed in articles 5 and 25 of GDPR.

Furthermore, Data of the data subject may also be communicated to:

• National and international public bodies, such as Ministries and Offices of the Public Administration, in relation to the performance of the institutional tasks of the University;
• Natural or legal persons, external bodies and associations, including professional firms and companies, always for the purposes illustrated and for the legitimate interests of JCU.

Data on the data subjects cannot be disseminated.

6. Transfer of extra EU data

The personal data of the data subjects may be transferred to (i) Canada for which the European Commission has expressed its Adequacy Decision on December 20, 2001, in compliance with the European Parliament and Council Directive 95/46 / EC and regarding the adequacy of the protection provided by the Canadian Personal Information Protection and Electronic Documents Act;(ii) United States of America through a certified data controller pursuant to the Privacy Shield Agreement[1],;(iii) California (USA), in this case adopting the clauses "EU controller to non-EU or EEA processor" referred to in decision 2010/87/EU with the controller.

7. Data subjects rights

In the case provided, the data subject has the right to obtain access to personal data from JCU and the rectification or erasure of them or the restriction of the processing that concerns him/her or to object to processing (articles 15 to 22 of GDPR).

You also have the right to lodge a complaint with the Supervisory Authority.

If our processing of personal data is based on consent and you have given your consent, you can revoke it or refuse to send information about JCU's initiatives by writing an email to [email protected]. In any case, revocation of consent does not affect the legitimacy of the processing operated before the revocation.

The data subject can provide his/her requests to JCU by writing to the Referent for the protection of the data subject’s rights (also known as DPO – Data Protection Officer) located in Via della Lungara, 233, 00165 Rome, Italy, or by sending a communication to the address [email protected].

If you believe that we have collected information on an under 14 years old, without the consent of or in contrast with the will of the person that exercises parental responsibility, please contact us at [email protected] so that we can either manage the complaint or delete the information.

8. Changes of information made on this page/document

JCU reserves the right to modify the information entered on this page/document, by publishing the changes on the website, therefore we advise the data subject to periodically check this information. 

[1] The Privacy Shield is an Agreement designed by the US Department of Commerce, the European Commission and the Swiss administration, respectively, to provide a mechanism for the Companies on both sides of the Atlantic to meet data protection requirements during the transfer of personal data from the European Union and Switzerland in the United States in support of transatlantic trade. On 12 July 2016, the European Commission considered that the U.S. Privacy Shield Framework is adequate to allow data transfer based on EU law (adequacy decision).