IMVE – Privacy Policy pursuant to Art. 12 and following Reg. Eu 2016/679 (GDPR), Relating to the processing of Personal Data

The University of Modena and Reggio Emilia (“Unimore“), Fondazione Marco Biagi, Motorvehicle University of Emilia-Romagna, and Victoria Language and Culture as joint Data Controllers provide the information under art. 12 and following EU Regulation 2016/679 (“GDPR“) regarding the processing of personal data required for the registration and participation in the High School Advanced Engineering Summer Program – 2024 Italian Motor Valley Experience (IMVE) hosted by the Engineering Department “Enzo Ferrari” of Unimore (“Summer School“).

The processing of personal data described in this policy will be carried out in full compliance with the principles of fairness, lawfulness, transparency, and confidentiality as set out in the GDPR and the Italian Privacy Code.

1. Categories of personal data processed. The following personal data will be processed for the registration and participation in the Summer School:

• 1. Personal data, in particular name, surname, social security number, contact details of the student’s parents collected through the Registration Form;
  2. Personal data, in particular name, surname, date, and place of birth of the students collected through the Registration Form. The joint Data Controllers, during the pre-selection phase, will also be processed, as well as any images collected during the Summer School activities.
  3. Special categories of personal data essentials for adequate student protection during the Summer School in Italy, as well as information on allergies and/or intolerances, special diet; use of medication, and other pertinent medical information that the parents want to provide. These data will be collected during the registration procedure with the appropriate form prepared by Victoria Language and Culture who supports Unimore in the summer school.

2. Purpose and legal basis of the processing. Personal data will be processed for the following purposes:
   1. to provide the requested service, in particular, to allow registration and to ensure communications and information (by email) for the participation of the students in the Summer School. The legal basis of the processing carried out for this purpose is the exercise of the institutional purposes of the joint Data Controllers (under art. 6, par. 1, lett. e) GDPR). The provision of such data is necessary to participate in the Summer School.
   2. to disseminate the activities of MUNER (Motorvehicle University of Emilia-Romagna) through the collection and publication of images of the activities of the Summer School on the web and social channels of MUNER or Unimore. The legal basis for the processing carried out in pursuit of this purpose is to be identified (under art. 6, par. 1, lett. b) GDPR) in the authorisation given with the release in the Registration Form. Once accepted and signed the release, the provision of personal data is necessary to allow Unimore to pursue its purpose of information and dissemination of activities carried out by the Summer School.
   3. to ensure adequate protection of the student’s health during the Summer School. The organisers of the Summer School must be aware of any intolerances, or allergies; of the need to take regular medication, as well as of any other medical information that parents consider important. This processing is carried out based on your express consent (under art. 9, par. 2, lett. a) GDPR) given in the form at the end of this information sheet. Providing such data is essential for the adequate protection of the student.
3. Processing methods and data retention period. Personal data are collected, processed, and stored mainly on computers and other electronic devices. In particular:

• 1. the data needed for the registration in the Summer School will be collected using a form on the Esse3 Portal of Unimore and they will be stored for the institutional purposes of Unimore in compliance with legal obligations, without any time limit;
  2. images relating to the activities will be collected and stored on appropriate computer media. In particular, personal data may be stored without a time limit, always in compliance with the necessity of their processing for the pursuit of the previously indicated purposes. In any case, without prejudice to the processing operations already carried out, the data subject or parents/legal guardians/exercising parental responsibility for the minor data subject may ask the joint Data Controllers not to subject the data to further processing operations.

4. Communication and dissemination. The personal data collected and processed may be communicated only to subjects duly authorized to the processing or formally appointed as Data Processor. In particular, they could be communicated to the following recipients: a) Teachers and speakers of the Summer School; b) technical staff in charge of assisting with the realization of the activities; c) University staff taking part in the implementation of the Summer School; d) Victoria Language and Culture who supports Unimore in the summer school.

Only images and screenshots collected for information and dissemination purposes can be disseminated by posting on the web and social channels of MUNER and Unimore.

5. Rights of the data subjects. Under and under the conditions set out in Art. 15 and following the GDPR, the interested data subjects can exercise the following rights:

• • Art. 7 – Right of withdrawal of consent: The withdrawal of consent is exercisable at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
  • Art. 15 – Right of access: the right to obtain from the joint Data Controllers confirmation of the existence of data processing and, if that is the case, to obtain access to such personal data and information;
  • Art. 16 – Right of rectification: the right to obtain from the joint Data Controllers the rectification of inaccurate personal data without undue delay and the integration of incomplete personal data, also by requesting to the data subject a supplementary declaration;
  • Art. 17 – Right to erasure: the right to obtain from the joint Data Controllers the erasure of personal data without undue delay, at the conditions provided by law;
  • Art. 18 – Right to restriction of processing: the right to obtain from the joint Data Controllers the limitation of treatment under the hypotheses provided for by the GDPR;
  • Art. 20 – Right to data portability: the right to receive the personal data provided to the Data Controller in a structured, commonly used, and machine-readable format and the right to transmit those data to another controller without hindrance from the first Controller to which the personal data have been provided, at the conditions required by the GDPR;
  • Art. 21 – Right to object: the right to object at any time, for reasons connected with one’s particular situation, to the processing of personal data in the cases and the manner provided in the GDPR;
  • Art. 22 – The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him/her or similarly significantly affects him/her.

The rights can be exercised through a formal request to the Data Protection Officer (DPO) who can be contacted at the e-mail addresses: (ordinary) dpo@unimore.it; (certified) dpo@pec.unimore.it or fmb.dpo@unimore.it; privacy.dev.fmb.unimore.it.

To verify the existence of the conditions and methods for exercising the rights as mentioned above, please refer to the full text of the regulations in force, available on the website: www.garanteprivacy.it.

We inform you that, if you believe the above rights are violated, the current legislation allows you to file a complaint with the competent supervising authority which, for Italy, is the Guarantor for the protection of personal data. Alternatively, you can complain with the supervising Authority of the EU state in which you reside or habitually work or in the place where the alleged violation has occurred.

6. Joint Data Controllers and Data Protection Officer. The joint Data Controllers are:

• • University of Modena and Reggio Emilia and for it the “Enzo Ferrari” Engineering Department, based in Via Pietro Vivarelli n. 10, 41125 – Modena. Under art. 37 and following the GDPR, the Data Controllers have appointed a Data Protection Officer (DPO), who can be contacted at the following e-mail addresses: (ordinary) dpo@unimore.it; (certified) dpo@pec.unimore.it.
  • Fondazione Marco Biagi, headquartered in Largo Marco Biagi, n. 10, 41121 – Modena. Under art. 37 and following the GDPR, the Data Controller has appointed a Data Protection Officer (DPO), who can be contacted at the following e-mail addresses: fmb.dpo@unimore.it; privacy.dev.fmb.unimore.it.
  • Motor vehicle University of Emilia-Romagna, headquartered in Via Vivarelli, n. 10, 41125 – Modena, email: summerschool@motorvehicleuniversity.com
  • Victoria Language and Culture, headquartered in Strada Cognento, n. 92, 41126 – Modena, email: info@associazionevictoria.it