entrance privacy information
Information on the processing of personal data - articles 13 and 14 of EU Regulation 2016/679 ("GDPR")
PERSONAL DATA CONTROLLER
John Cabot University ("JCU"), with registered office in Via della Lungara, 233, 00165 Rome, Italy, is the Data Controller, as required by articles 4 and 24 of EU Regulation 679/2016, with reference to the processing of personal data (hereinafter "Data"), including special categories of personal data which may be deductible, even indirectly, from information provided by the data subject or by a third party.
PERSONAL DATA PROCESSORS
John Cabot University uses the following subjects as Data Processors:
| Data Processor | Description |
|---|---|
| ICTS Italia S.r.l., Via di Tor Vergata, 432/434, 00133 Rome - Italy | Security Company |
| Microsoft Ireland Operations Limited (IE8256796U), South County Business Park, Leopardstown, Dublin 18 | Email service provider in Cloud |
| Blackbaud, 65 Fairchild Street Charleston, SC 29492 | Information systems support and maintenance services provider |
| Wedot S.R.L., Via Gaetano Donizetti, 9 - 00198 Rome – Italy | Information systems support and maintenance services provider |
However, it is possible that JCU identifies other subjects designated as Data Processors but not included in the table above, in any case, these subjects will be functional to the processing operated by JCU and bound to the principle of purpose as well as to the respect of the current legislation on the protection of personal data.
1. INFORMATION BEING PROCESSED
Information processed are the following:
1) Identification data (name, surname, place and date of birth, …),
2) Photo (required for the badge),
3) ID card details (including a photocopy of the document).
Information refers to the following categories of data subjects: staff, students, alumni with the "Alumni" badge, library guests, visitors in various capacities.
2. PURPOSE OF DATA PROCESSING
The personal data relating to the data subject are functional to the pursuit of the purpose of protecting JCU buildings for safety reasons in the workplace, to protect the assets of JCU and to protect people who are on business or other reasons within of JCU.
3. LEGAL BASIS FOR THE PROCESSING OF YOUR INFORMATION
The legal basis of the processing is twofold, since it is represented both by the fulfillment of a legal obligation to which the controller is subject (eg.: the legislation on the protection of health and safety in the workplace), and by the legitimate interest of JCU for the protection of personnel, operating, for different reasons, within the buildings of JCU.
4. PROCESS METHODS AND DATA RETENTION
The personal data of the data subject are processed in paper or electronic format.
Adequate security measures are adopted to prevent data breaches, unlawful or incorrect use and unauthorized access and to guarantee the security of data processed under the triple profile of confidentiality, integrity and availability.
The personal data will be retained exclusively for the period and the purposes for which they were collected, after this time, depending on the category of data subjects, data will be deleted as follows:
- Staff and students - 1 year after the end of the contract/courses attended;
- Alumni with the "Alumni" badge - after explicit request by the data subject;
- Library guests and various visitors - 1 year from the day of access/visit.
5. COMMUNICATION AND CIRCULATION OF DATA
The personal data of the data subject can be processed by: JCU staff, who need these data to carry out their duties, as well as other subjects who provide services to which the University has specifically assigned the task of processor or qualified interlocutor (for example, considering that it is an independent data controller) for the processing of the Data.
The processing of data, from simple access, to visualization and data entry, is always bound to the purpose for which the data was collected and conforms to the principles expressed in articles 5 and 25 of GDPR.
Furthermore, Data of the data subject may also be communicated to/received from the data subject himself or by persons in charge of parental responsibility.
Data on the data subjects cannot be disseminated.
6. TRANSFER OF EXTRA EU DATA
The personal data of the data subjects may be transferred to the United States of America; the recipient, Blackbaud, with registered office in 2000 Daniel Island Drive Charleston, SC 29492-7541, designated as Data Processor, is certified pursuant to the Privacy Shield Agreement[1].
7. DATA SUBJECTS RIGHTS
In the case provided, the data subject has the right to obtain access to personal data from JCU and the rectification or erasure of them or the restriction of the processing that concerns him/her or to object to processing (articles 15 to 22 of GDPR).
He/she also has the right to lodge a complaint with the Supervisory Authority.
The data subject can provide his/her requests to JCU by writing to the office of the Referent for the protection of the data subject’s rights (also known as DPO – Data Protection Officer) located in Via della Lungara, 233, 00165 Rome, Italy, or by sending a communication to the address [email protected].
If you believe that we have collected information on an under 14 years old, without the consent of or in contrast with the will of the person that exercises parental responsibility, please contact us at [email protected] so that we can either manage the complaint or delete the information.
8. CHANGES OF INFORMATION MADE ON THIS PAGE/DOCUMENT
JCU reserves the right to modify the information entered on this page/document, by publishing the changes on https://www.johncabot.edu/privacy/entrance.aspx, therefore we advise the data subject to periodically check this information.
[1] The Privacy Shield is an Agreement designed by the US Department of Commerce, the European Commission and the Swiss administration, respectively, to provide a mechanism for the Companies on both sides of the Atlantic to meet data protection requirements during the transfer of personal data from the European Union and Switzerland in the United States in support of transatlantic trade. On 12 July 2016, the European Commission considered that the U.S. Privacy Shield Framework is adequate to allow data transfer based on EU law (adequacy decision).