Privacy Policy Statement

Data controller

Prof. Maurizio Canavari (maurizio.canavari@unibo.it - Tel. +39 051 2096108), of which the Rector of the Alma Mater Studiorum - University of Bologna - Via Zamboni, 33 - 40126 Bologna (BO), is the legal representative.

Data Protection Officer

Purposes of processing personal data

The primary purposes pursued by FARE-Lab (from now on referred to as the "Laboratory") are strictly related to the organisation and implementation of statistical surveys and market and marketing research commissioned to the Laboratory.

The personal data of those who register are processed for evaluating and selecting the profiles required for each specific research (e.g. focus groups, individual interviews, telephone interviews, online interviews, experimental auctions). Further data processing, in aggregate form, may be carried out for statistical purposes and, more generally, within the scope of the objectives pursued by the Department of Agro-Food Sciences and Technologies (from now on referred to as the "Department").

In cases where the company commissioning the research needs access to specific user profiles, the data of Interested Parties will be anonymised by stripping them of all identifying elements.

Legal basis

The legal basis for the data processing performed by the Laboratory is found in:

art. 6 of Regulation (EU) 2016/679, paragraph 1, letter c) (processing to comply with a legal obligation), letter e) (processing carried out in the public interest), letter b) (processing necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject before entering into a contract);
- art. 9, paragraph 2, letter g) (processing necessary for reasons of substantial public interest) and letter j) (processing necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes) of Regulation (EU) 2016/679;
- art. 2-sexies, paragraph 2, letter bb) (University education) of Legislative Decree 196/2003, as amended;
- article 9, paragraph 2, letter j) (processing necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes) of Regulation (EU) 2016/679 and article 2-sexies, paragraph 2, letter cc) (processing necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes) of Legislative Decree 196/2003, as amended

In the event of processing based on different and/or ulterior provisions regarding those indicated above, relative information will be provided.

Recipients of personal data

The processing of personal data by the Laboratory's internal staff in charge of the processing takes place exclusively to pursue the Laboratory's research functions and in compliance with the instructions provided by the Data Controller.

The data may also be processed by public and private entities (e.g. Foundations and Associations) appointed as "Data Processors" according to and for Article 28 of Regulation (EU) 2016/679 for the management of activities of an institutional nature belonging to the University or the Department and for the outsourcing of services of their competence.

The communication of personal data to other public and private entities is envisaged:

to carry out duties and/or functions specified by law (for example, in the case of data transfers required by law to the Ministry of Universities and Research or inspections and assessments carried out by the Italian Inland Revenue Agency) or to fulfil legal obligations;
to manage the human resources involved in funded research projects;
to assess, manage and settle the claims of data subjects or related third parties by insurance companies and/or brokers and to monitor and analyse claims concerning the Laboratory;
to ensure that data subjects or related third parties are covered by the insurance provided by the insurance companies and/or brokers;
to cooperate with investigations and/or inspections performed by the judicial authorities;
to protect the Laboratory’s interests in court proceedings and extrajudicial settings;
to perform the functions attributed according to Legislative Decree 81/2008 to the Competent Physician and by Legislative Decree 230/1995 to the Authorised Physician for health monitoring purposes.

Data will be shared with the aforementioned recipients to perform tasks in the public interest or to the exercise of public powers only where provided for by law or, if necessary, to carry out tasks in the public interest or to perform institutional tasks following the provisions set out in Legislative Decree 196/2003, as amended.

Where services or systems allow personal data to be processed or where a complete and updated list of the Data Processors involved in specific processing activities is required, the names of the Processors and the System Administrators can be obtained by writing to the Data Protection Officer indicated above.

Transfer abroad of personal data

The data will be shared outside the European Economic Area:

Or based on an adequacy decision of the European Commission according to art. 45 of Regulation (EU) 2016/679;
or by adopting one of the safeguards indicated in art. 46 of Regulation (EU) 2016/679 (for example, the clauses adopted by the European Commission on the type of data protection);
or by adopting one of the safeguards indicated in art. 46 of Regulation (EU) 2016/679 (for example, the clauses adopted by the European Commission on the type of data protection);

- or by adopting one of the safeguards indicated in art. 46 of Regulation (EU) 2016/679 (for example, the clauses adopted by the European Commission on the type of data protection);

- the transfer is necessary to execute a contract between the data subject and the University or to carry out pre-contractual work requested by the data subject;

- the transfer is necessary to complete or execute an agreement, concluded or to be concluded in the interests of the data subject, between the Data Controller and a third party;

- the transfer is necessary or required by law to safeguard a significant public interest or to establish, exercise or defend a right via court action;

- the transfer is necessary to safeguard the vital interests of the data subject;

- the transfer is activated from a public register (subject to the general access conditions applicable to the registers).

Data retention period

Data is retained by the Laboratory for the period strictly necessary to pursue the purposes described above, without prejudice to the minimum period of ten years required for compliance with the tax, accounting and administrative obligations specified by law or to any more extended retention periods, not determinable in advance, that may be necessary under other conditions governing the lawfulness of processing (for example, legal actions that may make processing required for more than 10 years). It should also be noted that specific personal data must be kept for historical purposes, such as documents stored in University archives that have been declared a significant historical interest.

Rights of the data subject

To the extent applicable, data subjects have the right to obtain from the Laboratory: access to their data and its rectification or erasure, the restriction of processing related to them or the blockage of such processing (art. 15 et seq. of the Regulation). Data subjects may make the appropriate requests to the Laboratory by contacting the Data Protection Officer mentioned above.

Persons who believe that their data has been processed in violation of the requirements of Regulation (EU) 2016/679 or decree 196/2003 and subsequent amendments and additions are entitled to complain to the Italian Data Protection Authority according to Art. 77 of the above Regulation or seek an effective judicial remedy (art. 79 of the Regulation).

Additional purposes for processing personal data

In addition to the purposes not expressly indicated above, the Laboratory may process data if the processing is necessary for performing a task in the public interest. In anonymous or pseudonymised form, data may be processed for archiving purposes in the public interest, scientific or historical research, or statistical purposes.