a) Data controller and contact details

The Data Controller is the University of Turin, in person of the legal representative (the Rector pro tempore) with registered office in Via Verdi 8, 10123, Torino (contacts: pec certified mail: ateneo@pec.unito.it - email: rettore@unito.it - phone: 011 6706111).

b) Data Protection Officer (DPO)

The University's Data Protection Officer (DPO) can be contacted at the following e-mail address: rpd@unito.it.

c) Purposes of the processing and legal basis

The processing of data requested from the data subject shall be carried out for the performance of a task in the public interest or related to the exercise of official authority pursuant to art. 6 paragraph 1 letter e) of EU Regulation 2016/679 for teaching and research purposes. The legal basis for the pursuit of the purposes of this processing, pursuant to art. 2 b of Legislative Decree n. 101 of 2018, is constituted by the law n. 168/1989 and subsequent ammendments and addictions. The processing of personal data will be carried out by the University of Turin pursuant to EU Regulation - 2016/679.

d) Types of processed data

The personal data collected and processed by the Data Controller for the purposes indicated above are the following:

• personal data (Name, Surname)
• contact data (Email)
• data required for certification (Place and date of Birth, Social security number)
• Profile picture
• Participants interaction with the system (log)
• Test results
• Questionnaire replies
• Participants feedback

e) Provision of data

The provision of personal data such as name, surname, email is mandatory. Failure to provide such personal data will not allow access to the service.
The provision of data such as Place and Date of birth, Social security number and failure to provide such personal data, will not prevent the provision of the service and will not preclude access to the INVITE platform, but will not allow to obtain the certification issued by the system of completion of online courses provided by the service.

f) Methods of processing

The processing of personal data will be carried out using IT and telematic tools and is suitable to ensure the security and confidentiality of the data.
For the achievement of the aforementioned purposes, the data are processed inside the University of Turin by persons authorised to process data under the responsibility of the Data Controller, who for this purpose are adequately trained.

g) External Data Processors

The data could also be communicated and processed externally by third parties providing certain services necessary for the execution of the processing, acting on behalf of the Data controller for the sole purpose of the requested performance and who will be duly appointed "Data Processors" pursuant to art. 28 of EU Regulation 2016/679.

h) Categories of recipients of personal data

Personal data will not be disclosed to categories of external recipients. Data transfer to third Country For the improvement of the provision of services and for teaching and research activities, the University makes use, of any suppliers designated as External Managers, Google services for the Educational sector for which appropriate safeguards measures have been adopted (for more information see the Privacy and Security section of Google named within the Privacy section of the University Portal); these services involve the transfer of personal data to non-European Countries ("in cloud" solutions by Google LLC).

i) Data retention period

Personal data are kept for the time strictly necessary to pursue the purposes of processing (in compliance with the principle of necessity and purpose of processing): therefore they will be cancelled at the end of 5 years from the moment of the registration of the user to the portal.

j) Data rights

Your rights relating to your personal data include:

• Your right to be informed (via this privacy notice and other communications).
• Your right to request access to Personal Data (art. 15 - GDPR), and to have any incorrect Personal Data rectified (art. 16 - GDPR).
• Your right to the restriction (art. 18 - GDPR) of processing concerning you or to object (art. 21 - GDPR) to processing (where appropriate).
• Your right to have Personal Data erased (art. 17 - GDPR)(where appropriate).

About the right to have personal data erased, the collection of personal data relating to the interested parties will stop after the presentation of the specific request to exercise the right and all personal data already stored (collected before the aforementioned request) relating to the interested parties will be eliminated.
The interested parties (subjects to whom the data refer) can assert, in the cases provided, their rights on personal data pursuant to art. 15-21 of EU Regulation 2016/679, where applicable, towards the University of Turin, by sending a specific request with object: "data rights" to the coordination of the project: deltarg@unito.it or at the following address: University of Turin – Department of Molecular Biotechnology and Health Sciences - Piazza Nizza 44, 10126 Torino.

k) Complaints

The interested party is informed that he/she has the right to lodge a complaint with the supervisory authority and can contact the Guarantor Authority for the protection of personal data (website: www.garanteprivacy.it)

l) Profiling

The Data Controller does not use automated processes aimed at profiling.