Information on the processing of personal data - articles 13 and 14 of EU Regulation 2016/679 ("GDPR")
John Cabot University systematically undertakes to comply with the current legislation on data protection and user privacy protection.
The following information describes the provisions of articles 13 and 14 of GDPR.
If you decide to request information and/or enter the process of selection and admission to JCU, we are committed to using the information entered (i.e. personal and special data concerning you) only for the purposes of carrying out the requested service or for the other purposes illustrated in this notice or in those that will subsequently be performed.
The information we are providing refers to the websites listed below (hereinafter "Website") and not to other websites that may be consulted by the user through links contained in them:
- myjcu.johncabot.edu (limited to the sections accessible without registration, blog)
PERSONAL DATA CONTROLLER
John Cabot University (hereinafter “JCU” or just “University”), with registered office in Via della Lungara, 233, 00165 Rome, Italy, is the Data Controller.
PERSONAL DATA PROCESSORS
John Cabot University uses the following subjects as Data Processors:
|OmniUpdate, 1320 Flynn Road Suite 100 Camarillo, CA 93012||Software as Service provider for content management|
|Higher Education Marketing: 6560 de l'esplanade, suite 204 Montreal, Quebec, H2V 4L5||Partner of OmniUpdate for IT services|
|SiteImprove Italia srl Via Motta Emilio, 10, 20144 Milano||Software as Service provider for website improvement|
|Microsoft Ireland Operations Limited (IE8256796U), South County Business Park, Leopardstown, Dublin 18||Email service provider in Cloud|
|WordPress Automatic Inc. 60 29th Street #343, San Francisco, CA 94110||Software provider for creating and managing websites and blogs|
|Dude Solutions, 11000 Regency Parkway, Suite 110, Cary, NC 27518||Software provider for events management, web calendar|
|HubSpot, 25 First Street, 2nd Floor Cambridge, MA 02141 United States||Software as Service provider in support of marketing activities|
However, it is possible that JCU identifies other subjects designated as Data Processors but not included in the table above, in any case these subjects will be functional to the processing operated by JCU and bound to the principle of purpose as well as to the respect of the current legislation on the protection of personal data.
1. INFORMATION BEING PROCESSED
1.1 BROWSING DATA
The Website for its operation does not collect information that directly identifies the user.
The information collected for browsing the listed websites includes: the IP address of the computer/device used to access, the URL of origin, the pages visited and the time spent on them, the browser used, date and time.
Cookies are small text files that the websites visited by the user send and store on his/her personal computer or any other device, even mobile, to be re-transmitted to the same websites at the next visit. Cookies are used for different purposes: for example, to remember the user's actions and preferences (such as, for example, login data, chosen language, font sizes, other display settings, etc.) in a way that should not be indicated again when the user returns to visit the website or browse from one page to another on the website.
Technical cookies are cookies that are used to browse or provide a service requested by the user. They are not used for other purposes and are normally installed directly by the website owner.
Without such cookies, some operations could not be performed or would be more complex and/or less secure. In other words, these cookies are indispensable for the functioning of the Website or necessary to perform activities requested by the user.
Technical functionality cookies allow the user to navigate according to a series of selected criteria such as, for example, the language, in order to improve the service rendered to the same. It is possible not to allow the activation of these cookies on your device. However, their eventual deactivation would not allow for an easy use of the website.
First-party analytical cookies are used to collect information, in aggregate form, on the number of users and how they visit the website.
Third-party analytical cookies are cookies from other websites that can be sent to the user's device after browsing this website. These cookies are not strictly necessary for browsing, but by denying consent to send third-party cookies some advanced features such as sharing pages on social networks or participating in discussions could be prevented. Since this website is not able to govern cookies issued by other websites, in order to obtain information on these cookies, their characteristics and how they work and to give or deny the specific consent, the user shall contact the websites that directly emit these cookies.
Below are the cookies that are downloaded by interacting with the websites to which this information relates.
1.3 DATA PROVIDED VOLUNTARILY BY THE USER/DATA SUBJECT
Information processed by JCU can be obtained through the forms made available on the Website and filled in voluntarily by users but also through social channels and, in particular, the official Facebook page; this information is, for example: name and surname, address, e-mail, telephone number.
The action of sending, for any reason, of emails to the addresses indicated on this Website entails the subsequent acquisition of the sender's address, necessary to reply to communications via email, as well as any other data entered in the email.
If, for whatever reason, the communications forwarded by the user/data subject are in surplus or not necessary with respect to the processing that JCU carries out/intends to carry out, JCU reserves the right to proceed with the immediate deletion of data or otherwise processing the data so as not to create organizational and legal repercussions that are deemed to be in conflict with the JCU's personal data management system.
Specific information for data protection (articles 13 and 14 of GDPR), where deemed necessary, will be prepared and will be viewable in the individual sections of the website that contain requests for personal data not attributable to this information.
Once the user acquires the JCU student status, the University will use this information to communicate with the student.
1.4 DATA OF MINORS
Our websites are aimed at students of all ages, but we do not collect information on minors under 14 years without the authorization of those who exercise parental responsibility.
2. PURPOSE OF DATA PROCESSING
Data collected, subject of the processing, are processed and used exclusively for the purpose of:
- website management and maintenance;
- supply of the services requested by the users themselves through the Website or through the contacts present on the Website.
3. LEGAL BASIS FOR THE PROCESSING OF YOUR INFORMATION
We may process the personal data of the data subject because the processing is strictly correlated with the browsing activity or, in reference to the services requested through the forms on the Website or the contact details present therein, for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, or, more generally, to reply to a request of the data subject.
Data collected on this occasion are not subject to your consent as it is your free choice to provide them to receive the information and/or services object of your request.
4. PROCESS METHODS AND DATA RETENTION
The personal data of the data subject are processed in paper or electronic format.
Once the status of JCU student is obtained, the data subject and his/her personal information will also be protected in compliance with the Family Educational Rights and Privacy Act (FERPA). To learn more about the execution of FERPA in JCU, you can visit the website (https://www.johncabot.edu/registrar/ferpa/default.aspx).
To protect the personal data processed, JCU has adopted adequate organizational, technical and physical measures - in accordance with the provisions of article 32 of GDPR - in order to maintain the confidentiality, availability, and integrity of the information collected.
All information provided within the Website is encrypted using the 128-bit Secure Sockets Layer (SSL) system and public-key encryption.
The Website is certified as "Comodo secure site". To learn more about the safety certification program, we recommend that you visit the www.comodo.com sites.
Notwithstanding the foregoing, users and visitors of JCU Website shall keep in mind that the Website and all associated services are managed on software, hardware and networks systems, whose components may, from time to time, require maintenance or be subject to inefficiencies (which JCU will try to resolve promptly).
The browsing data will be anonymous at the end of the session, unless legal obligations or other legitimate reasons do not induce the Data Controller to behave differently (for example following a request by the Judicial Authority or in case of activities carried out against JCU or of the Website).
Other processed data are kept for the time necessary to make the service requested by the user, after which they are aggregated and made anonymous. In particular:
- if the data subject obtains the status of "student" the personal data are retained for the entire duration of the course of study and for 10 years after the student has left John Cabot University;
- if the data subject does not obtain the status of "student", personal data is retained for 10 years after the first contact.
5. COMMUNICATION AND CIRCULATION OF DATA
JCU will communicate personal information to third parties always in accordance with the legitimate aims pursued and in any case in compliance with articles 5 and 25 of GDPR.
The recipients of the communication from/to JCU belong to the following categories:
- Universities/partners with which the University has agreements in relation to projects/events to which the user registers through the forms on the Website;
- Participants in project initiatives in which the user registers through the forms on the Website;
- Web Community for the contents published on the Website (interviews, photos, videos, etc.).
Information about the user cannot be disseminated.
6. TRANSFER OF EXTRA EU DATA
The personal data of the data subjects may be transferred to (i) Canada for which the European Commission has expressed its Adequacy Decision on December 20, 2001, in compliance with the European Parliament and Council Directive 95/46/EC and regarding adequacy of the protection provided by the Canadian Personal Information Protection and Electronic Documents Act, to (ii) the United States of America through a certified data controller pursuant to the Privacy Shield Agreement, as well as (iii) to California (USA) in this case adopting the clauses "EU controller to non-EU or EEA processor" referred to in decision 2010/87 / EU with the controller.
7. DATA SUBJECTS’ RIGHTS
In the case provided, the data subject has the right to obtain access to personal data from JCU and the rectification or erasure of them or the restriction of the processing that concerns him/her or to object to processing (articles 15 to 22 of GDPR).
Data subjects have the right to lodge a complaint with the Supervisory Authority.
The data subject can provide his/her requests to JCU by writing to the Referent for the protection of the data subject’s rights (also known as DPO – Data Protection Officer) located in Via della Lungara, 233, 00165 Rome, Italy, or by sending a communication to the address [email protected].
If you believe that we have collected information on an under 14 years old, without the consent of or in contrast with the will of the person that exercises parental responsibility, please contact us at priva[email protected] so that we can either manage the complaint or delete the information.
8. CHANGES OF INFORMATION MADE ON THIS PAGE/DOCUMENT
JCU reserves the right to modify the information entered on this page/document, by publishing the changes on the website https://www.johncabot.edu/privacy/default.aspx, therefore we advise the data subject to periodically check this information.
1 The Privacy Shield is an Agreement designed by the US Department of Commerce, the European Commission and the Swiss administration, respectively, to provide a mechanism for the Companies on both sides of the Atlantic to meet data protection requirements during the transfer of personal data from the European Union and Switzerland in the United States in support of transatlantic trade. On 12 July 2016, the European Commission considered that the U.S. Privacy Shield Framework is adequate to allow data transfer based on EU law (adequacy decision).