Information for students

Specific processing purposes and methods

 
Personal data, including data of a sensitive nature, is processed in the context of managing/monitoring individual pathways, guidance counselling, and individual planning support with regard to university studies of interest, as well as to foster reception activities, illustration of university courses, and inclusion.

Data is processed specifically and/or individually as part of surveys, interviews and initiatives aimed at

• ensuring constant attention is paid to the results of guidance activities in high schools and to the university career of enrolled students, and providing support at “essential” stages (also with a view to reducing the drop-out rate);
• activating direct communication channels (e.g. individual interviews), in the event of specific needs or in cases of risk or of university drop-outs or at the request of the data subject, e.g. by fostering the development of personal, social, civic and entrepreneurial skills (also through the creation of the Skills Portfolio and the administration of targeted questionnaires);
• foster, through specific projects, the inclusion of all students, eliminating - where possible - situations of inequality linked to the social and personal condition of certain students, which can lead to inequalities in access to higher education, in the regular fruition of studies, in the time taken to obtain qualify and/or in employment opportunities after qualifying.

Sensitive data (e.g. relating to the health of the student using the guidance service) may be processed based on the specific needs expressed by the data subject.

Within the scope of the above-mentioned purposes, data may also be processed by means of special software and/or Apps. The following specific data is processed through software and Apps:

• the results of certain guidance activities undertaken by the user (e.g. exercises completed, survey results, pages visited) and their cross-referencing with the results of questionnaires;
• the interest indicated by each user in a particular programme, also for registration purposes with specific information on call deadlines, information on Open Days and other activities strictly related to the course in question;
• QR code necessary to access the University structures, with regard to registration for dedicated guidance events;
• contact details (including private) of the interested party (e.g., email address) so that they may be contacted again to offer them guidance support activities.

The data, in pseudonymised and/or aggregate form, will also be processed for the purposes of studying and disseminating models and practices within the university, exchanging information and experience and activating a process for monitoring and evaluating teaching quality.

Legal basis of the processing and nature of the provision of data

 
The legal basis for the data processing is found in:

• articles 6, paragraph 1, letters c) (processing in order to comply with a legal obligation) and e) (processing carried out in the public interest) and 9, paragraph 2, letter g) (processing for reasons of substantial public interest) of Regulation (EU) 2016/679;

• and the following references: art. 3 Ministerial Decree no. 245 of 21 July 1997; Ministerial Decree 8 May 2001; art. 2, paragraphs 2 and 3 of Ministerial Decree no. 752 of 30 June 2021; art. 1, paragraph 6 of Legislative Decree no. 62 of 13 April 2017; art. 1, paragraph 28 of Law no. 107 of 13 July 2015; Recommendation 2006/962/EC.

In order to participate in guidance initiatives, the following data must be provided:

• personal, address and contact details (including email and mobile tel. no.);
• degree programme undertaken or completed.

Failure to provide the data will make it impossible to use the guidance service.
The provision of data other than those indicated above (including, for example, expressing interest in receiving information on a specific programme through the dedicated App) is optional and if not provided will not have any consequence other than not being able to take advantage of specific career guidance paths.

Recipients

In addition to the recipients mentioned in the general privacy policy, the data may also be sent to:

• high schools with which the University collaborates in relation to the above purposes;
• regional and provincial networks in order to organise further initiatives and monitor the same;
• competent agencies and Ministerial offices in charge of Career Guidance matters in order to comply with specific regulatory requirements.

Privacy policy applicable to users intending to enrol in degree programmes with restricted access at local and national level (in Italian) 

Privacy policy applicable to users intending to enrol in degree programmes with restricted access at local or national level with internal ranking procedure (in Italian) 

Privacy policy applicable to users intending to enrol in degree programmes with restricted access at local or national level with external ranking procedure (in Italian)

Privacy policy applicable to online entrance exams and/or other admission tests (in Italian)

Specific processing purposes and methods

Personal data and special categories of personal data (for example, the data necessary to support students with special needs or specific learning disorders or to support students on maternity) and/or criminal records data (in the case of detained students) that are collected as of matriculation/registration up to the award of the undergraduate or postgraduate degree, or in any case up to the conclusion of the students’ studies, will be processed in order to:

• facilitate the learning and completion of the studies in question;
• allow management and certification of the academic degree or training undertaken by exchange students;
• enter into training agreements in the case of PhD students and medical students;
• enable students to undertake curricular internships, as specified in more detail in the relative privacy policy;
• guarantee the democratic representation and participation of students in University life (for example, the election of student representatives to degree programme, department and school committees and to some centralised academic boards in order to perform functions related to representation in academic bodies).

Legal basis of the processing and nature of the provision of data

The legal basis for the data processing is found in:

• articles 6, paragraph 1, letters c) (processing in order to comply with a legal obligation) and e) (processing carried out in the public interest) and 9, paragraph 2, letter g) (processing for reasons of substantial public interest) of Regulation (EU) 2016/679;
• the sources of law related to the education of students (including: Royal Decree Law 20-06-1935, no. 1071; Law no. 910 of 11 December 1969), PhD students (for example: Law no. 28 of 21 February 1980, Law no. 341 of 19 November 1990; Law no. 210 of 3 July 1998, Ministerial Decree no. 45 of 8 February 2013) and postgraduate students undertaking specialised training (Legislative Decree no. 368/99, Interministerial Decree 68/2015; Interministerial Decree 402/2017).

The provision of personal data is compulsory. Refusal to provide the data will make it impossible to perform the operations necessary to establish the relationship between the student and the University. Refusal would also mean that the administrative and educational management of the students’ studies, which is necessary in order to comply with legal obligations, would be impossible.

Recipients

In addition to the recipients mentioned in the general privacy policy, the data may also be sent to:

• third parties that manage funding and collaborate with regard to the organisation of postgraduate degree programmes. Said parties, appointed as Data Processors in accordance with art. 28 of Regulation (EU) 2016/679, may collaborate directly with the University in performing certain activities that entail the processing of personal data (among which: accessing the list of enrolled students; managing selections for admission; managing the degree programmes; printing the certificates for degrees or other qualifications);
• third parties who, in their capacity as Data Processors pursuant to art. 28 of Regulation (EU) 2016/679, process the data as part of the service to print the degree certificates (Scriptorium Decore S.r.l.);
• Almalaurea, which, in its capacity as a Data Processor pursuant to art. 28 of Regulation (EU) 2016/679, may assist the University with activities performed with a view to improving the quality of teaching;
•  third parties who, in their capacity as Data Processors pursuant to art. 28 of Regulation (EU) 2016/679, assist the University in managing its information systems and services (for example: Cineca, Microsoft, Respondus, Zoom, Panopto, Omnia Card);

• in the case of medical students, to bodies that are part of the education network but outside of the individual school networks, appointed as Data Processors pursuant to art. 28 of Regulation (EU) 2016/679;
• in the case of medical students undertaking training with healthcare service providers, to other public or private bodies and/or universities (insofar as they process the personal data of postgraduate students undertaking specialised training, within the scope of the tasks performed on behalf of the University), appointed as Data Processors pursuant to art. 28 of Regulation (EU) 2016/679;
• public or private bodies that fund specialist training contracts or other training courses;
• local bodies for the purposes of awarding funding for special categories of students; 
• the Ministry of Foreign Affairs and International Cooperation, police stations and embassies in relation to permits of stay, recognition of particular statuses, citizenship and any qualifications of the student;

• Regional Management Bodies (equipped with administrative and managerial autonomy and set up in accordance with the laws in force governing the right to higher education) and other institutions in order to promote the international mobility of students and/or to assess benefits and assign accommodation;  
• MIUR;
• bodies, institutions or associations in order to facilitate the integration of exchange students into their host country and the University as well as to promote intercultural dialogue between young people and the exchange of their experiences;
• foreign universities involved in the degree programmes that award qualifications in collaboration with the University of Bologna;
• prison services in order to guarantee education and training in prison institutions;
• foreign universities or the relative bodies in order to verify the award of the qualifications necessary for admission to the university’s degree programmes;
• the home and host universities/institutions of exchange students in order to manage the exchange programme.

In the case of students enrolled on a PhD programme degree, the data may also be shared with:

• external commissioners with regard to the national selection procedure;
• external commissioners and examiners with regard to admission to the final exam;
• public or private bodies that have adhered to a consortium or an agreement concerning training and research projects;
• the Ministry of Education and Research (in relation to the register of PhD graduates).

Data relating to medical students undertaking specialised training may also be sent to:

• public and private healthcare structures, other universities and public or private bodies in order to facilitate performance of the specialised training activities;
• MIUR in order to manage the ranking of students, assign and monitor study grants and fulfil other institutional duties;
• the Regional Council with regard to the award and monitoring of study grants funded by the Region, within the scope of the competences defined in Legislative Decree 368/99;
• other public and private bodies that provide study grants for medical students.

Transfer of data outside of the EU and the conditions applicable to the transfer

In addition to the cases provided for in the general privacy policy, the personal data collected may be transferred to a country outside of the European Economic Area (EEA, namely the EU + Norway, Liechtenstein and Iceland) in cases where:

• it is specifically requested by the student;
• it concerns incoming or outgoing exchange students enrolled on degree programmes delivered in collaboration with several universities/institutions or who are admitted to degree programmes at the University of Bologna with qualifications gained abroad.

Data relating to the students indicated above may be transferred to: 

• universities or the relative bodies outside of the EU (in the event that it is necessary to verify the student’s qualification for professional reasons or so that they may continue with their studies); 
• foreign embassies or embassies located abroad (also for military service exemption purposes);
• home and/or host universities/institutions outside of the EU in order to manage student exchange programmes, including with regard to degree programmes delivered in collaboration between several universities/institutions;
• foreign authorities for various purposes including the provision of benefits and professional practice. 

The data may be transferred when necessary for reasons of substantial public interest in accordance with art. 96 of Legislative Decree 196/2003, as amended, and art. 49, paragraph 1, letter d) of Regulation (EU) 2016/679.

Data retention period

All documents containing personal data that are necessary in order to have a record of important legal and economic events concerning the student are retained indefinitely. The retention period for the remaining data depends on the administrative documents in which they are contained and/or on the relative legal requirements (for example, ten years in order to comply with statutory tax and accounting requirements).

Specific processing purposes and methods

Personal data (for example: personal details, contact details, information related to the student’s course of study and the duties performed in the organisation or company in which the internship is undertaken) and special categories of data (concerning, for example, persons with disabilities or specific learning disorders) are processed in order to manage:

• curricular internships undertaken in Italy or abroad by students enrolled on an undergraduate or master’s degree programme or by incoming exchange students;
• extracurricular internships undertaken in Italy or abroad by persons who have already completed their studies.

The data are processed under an agreement entered into by the University and the host organisation/company or within the scope of the activities carried out by the University, with the support of a tutor where necessary, or in relation to international mobility programmes (such as, for example, the Erasmus+ Programme).

Legal basis of the processing and nature of the provision of data

The legal basis for the data processing is found in:

• articles 6, paragraph 1, letters c) (processing in order to comply with a legal obligation) and e) (processing carried out in the public interest) and 9, paragraph 2, letter g) (processing for reasons of substantial public interest) of Regulation (EU) 2016/679;
• the sources of law aimed at promoting internships that benefit students (art. 18 of Law 196/1997; Ministerial Decree 142/1998; State - Regions conference of 25 May 2017; Regional Law 1/2019 amending Regional Law 17/2005; Law 56/1989 “Rules Governing the Psychology Profession”; Ministerial Decree 239/1992 “Regulation laying down provisions on post-lauream professional internships for admission to the State exam taken in order to qualify as a professional Psychologist”; Ministerial Decree 240/1992 “Regulation laying down provisions on the State exam taken in order to qualify as a professional Psychologist”; Ministerial Decree 142/1998 “Regulation setting out rules for implementation of the principles and criteria referred to in article 18 of Law no. 196 of 24 June 1997 concerning (non-curricular) training and guidance internships”; Ministerial Decree 509/1999 “Regulation laying down provisions on the curricular autonomy of Universities”; Presidential Decree 328/2001 “Amendments to the provisions on the requirements for admission to the State exam and the relative exams necessary in order to practice each profession, as well as to the provisions of the relative regulatory frameworks”; Law 170/2003 “Conversion into law, with amendments, of Decree Law no. 105 of 9 May 2003 laying down urgent provisions concerning universities, research bodies and professional qualifications”, as amended; Ministerial Decree 270/2004 “Amendments to the regulation laying down provisions on the curricular autonomy of universities”, approved with Decree no. 509 of 3 November 1999 of the Minister for Universities and Scientific and Technological Research.

For curricular internships, the provision of personal data is:

• mandatory in cases where the internship forms an essential part of the curriculum. In these cases, refusal to provide the data will make it impossible to complete the programme of study.
• optional in cases in which the internship is an optional part of the curriculum. However, refusal to provide the data will make it impossible to undertake the internship.

For curricular internships, the provision of personal data is optional. However, as above, refusal to provide the data will make it impossible to undertake the internship.

In relation to the provisions governing the various professional internships, provision of the data may be mandatory in order to achieve the professional qualification.

Recipients

In addition to the recipients mentioned in the general privacy policy, the data may also be sent:

• to Regional and National employment offices, in the case of extracurricular internships;
• at the request of the data subject or where the curricular internship is mandatory, to accredited or authorised public and private operators and potential employers, for the purposes of guidance and induction into the world of work (pursuant to Law no. 30/2003 on the reform of the labour market and subsequent implementations);
• to parties hosting the intern who, in their capacity as Data Processors or as authorised persons, process the data in order to attest to the student’s achievement of the learning outcomes (e.g., attendance, activities performed, etc.);
• in the case of professional psychology internships, to the Professional Association of Psychologists of Emilia Romagna;
• parties outside of Italy hosting the intern as part of international mobility programmes and to funding bodies of the same such as, for example, the National Documentation, Innovation and Educational Research Institute (INDIRE).

Transfer of data outside of the EU and the conditions applicable to the transfer

The personal data collected may be transferred to a country outside of the European Economic Area (EEA, namely the EU + Norway, Liechtenstein and Iceland) only in cases where:

• said transfer is specifically requested by the student or where the internship is undertaken abroad;
• the student is participating in an international mobility programme.

The data may be transferred when necessary for reasons of substantial public interest in accordance with art. 96 of Legislative Decree 196/2003, as amended, and art. 49, paragraph 1, letter d) of Regulation (EU) 2016/679.

Specific processing purposes and methods

Personal data (personal details, contact details, data pertaining to the student’s course of study, curriculum vitae, specific knowledge and skills) and any special categories of data are processed in order to provide career guidance to graduating students and to support them in entering the world of work. In particular, the data are processed:

1. in relation to the training of graduating students (managing/monitoring the individual course of study, guidance counselling, supporting individual projects in respect of professional goals, also through specific meetings with the data subject and/or through participation in seminars/career guidance workshops). The data are processed also in order to ensure a specific focus on the outcomes of the career guidance Programmes;
2. in order to provide students and graduates with the tools and support necessary to facilitate their entry into the world of work, also through dedicated web channels (for example, emails or apps) or through participation in events such as career days, recruiting days, company networking events and webinars.

Contact details and data relating to the academic programme undertaken by the student are processed in order to provide students and graduates with useful information concerning job placement and/or career guidance activities and events organised by the University.

The data are also processed for the purposes of researching and promoting models and practices within the university, exchanging information and experience, and monitoring the services provided in order to ensure they are adapted to the changes in the world of work and/or the different needs of students and graduates. For example, data relating to the guidance courses and
activities undertaken by each user (e.g. enrolment data) are documented/stored/processed by the University using its software in order to verify the efficacy of the service provided.

Legal basis of the processing and nature of the provision of data

The legal basis of the processing performed for the purposes indicated in points “1” and “2” is found in:

• art. 6, paragraph 1, letter c) (processing necessary for compliance with a legal obligation) of Regulation (EU) 2016/679;
•  art. 6, paragraph 1, letter e) (processing necessary for the performance of a task carried out in the public interest) of Regulation (EU) 2016/679;
• art. 9, paragraph 2, letter g) (processing necessary for reasons of substantial public interest) of Regulation (EU) 2016/679;
• the sources of law identifying the University as an intermediary between the supply and demand of labour (articles 6 of Legislative Decree 276/2003, the so-called “Biagi Law”; Law no. 183 of 4 November 2010, the so-called “collegato lavoro”).

The provision of data for the purposes referred to in point “1” is optional. However, refusal to provide the data will make it impossible to benefit from the guidance services offered in relation to entering the world of work.

The provision of data for the purposes referred to in point “2” is optional.

If students wish to use the services described in point b), the University may share data relating to the interim and final results of the student’s training as well as other personal data for the purposes of facilitating their entry into the world of work, including abroad. For this purpose, said data may also be shared with private parties using electronic media. Where users wish to use services or take part in events aimed at bringing together prospective employers and job seekers, the provision of data (for example, through the submission of a curriculum vitae), where requested, is mandatory. If students refuse to provide the data, they will not be able to participate in the event and their data will not be sent to prospective employers.

Recipients

In addition to the recipients mentioned in the general privacy policy, the data may also be:

• sent to prospective employers in both the public and private sectors (including through employment agencies);
• processed by Almalaurea in its capacity as the Data Processor assisting the University in achieving the aforementioned processing purposes;
• processed by companies specifically appointed as Data Processors (for example, for website maintenance and/or to set up specific digital platforms).

Data retention period

Personal data relating to events and to the studies undertaken by each student are kept only for the time strictly necessary to manage the same and to achieve the purposes described. The data may be retained for up to two years, after which they will only be processed in aggregate form.

Data relating to curricula vitae published or made available on the University’s website are kept for one year as of conclusion of the events for which the data was provided.

Specific processing purposes and methods

Personal data (personal details and data pertaining to the student’s course of study) and special categories of data (relating, for example, to specific disabilities or learning disorders) are processed for the purposes of providing tutorial, support and social inclusion services and to support persons with disabilities or specific learning disorders (SLD). The processing of personal data strictly related to managing the academic programme undertaken by the student is not included.

The data are processed, for example, in relation to:

• services available to support students with disabilities in moving around the University premises;
• the dissemination of information or initiatives to promote social inclusion;
• the provision of support services (e.g., tutorial, interpreting and sign language services, specific front-office services, the loan of assistive aids) throughout the course of study, with a view to identifying and planning the support necessary for each student so that they can successfully complete their degree programme.

Legal basis of the processing and nature of the provision of data

The legal basis for the data processing is found in:

• articles 6, paragraph 1, letters c) (processing in order to comply with a legal obligation) and e) (processing carried out in the public interest) and 9, paragraph 2, letter g) (processing for reasons of substantial public interest) of Regulation (EU) 2016/679;
• the sources of law concerning the right to higher education of students with disabilities and SLD. (Law 104/1992, Law 17/99, Law 170/2010 and Law 4/2004);
• the sources of law concerning the right to higher education (Legislative Decree 68/2012, Decree of the President of the Council of Ministers dated 9 April 2001 and art. 2.1 of the University Regulations issued with Rector’s Decree 1203/2011).

The provision of data for the aforementioned purposes is necessary in order to provide the benefits and services described above.

Recipients

In addition to the recipients mentioned in the general privacy policy, the data may also be sent to:

• ER.GO. in order to coordinate the activities, services and economic benefits under its responsibility aimed at students with disabilities;
• providers of support services, in other words Data Processors that support the University in providing its services to students with SLD and/or disabilities;
• public bodies, organisations or associations with which the University collaborates in order to conduct information and guidance activities and to facilitate identification of useful local resources (for example: local health authorities, foundations that provide consultancy services, specific associations);
• organisations/institutions/companies that can host international exchange students.

Specific processing purposes and methods

Personal data (personal details and data pertaining to the student’s course of study, financial data and banking details for the payment of financial support) and any special categories of data (relating to, for example, students with disabilities and/or the student's participation in political associations) are processed in order to guarantee the right to higher education and the possibility of accessing benefits, grants and services.

In particular, the data are processed in order to satisfy the requirements related to:

• managing competitive procedures for the award of study grants      and benefits to students of the Alma Mater Studiorum - University of      Bologna;
• managing services related to the right to higher education;
• managing the relationships arising from the aforementioned      competitions and services, as well as the related payments, where      required;
• maintenance of the Register of University Associations/Student
  Cooperatives recognised by the Alma Mater Studiorum - University of Bologna and managing the competitive procedures for the award of funding to the
  Associations entered in the aforementioned Register.

Legal basis of the processing and nature of the provision of data

The legal basis for the data processing is found in:

• articles 6, paragraph 1, letters c) (processing in order to comply with a legal obligation) and e) (processing carried out in the public interest) and 9, paragraph 2, letter g) (processing for reasons of substantial public interest) of Regulation (EU) 2016/679;
• Legislative Decree 68/2012, Decree of the President of the Council of Ministers dated 9 April 2001 and art. 2.1 of the University Regulations issued with Rector’s Decree 1203/2011 (provisions on the right to higher education);
• art. 1, paragraphs 252 et seq. of Law 232/2016 and the University Regulations issued with Rector’s Decree 662/2018 (Student tuition fees and relative exemptions);
• art. 1, letter b) of Law 170/2003, art. 2 of Ministerial Decree 198/2003 (tutoring allowances);
• art. 7 of Ministerial Decree 198/03 (fiduciary loans);
• art. 5, paragraph 1, letter a) of Law 240/2010 (valorisation of legally recognised university colleges);
• Decree Law 105 of 2003 converted into Law 170 of 2003 and art. 4 of Ministerial Decree 198/2003 (young people's support fund providing for ad hoc funding by the Ministry in order to incentivise enrolment on degree programmes of particular national interest and to promote student mobility);
• Legislative Decree 33/2013 (publications for transparency purposes);

• art. 3, paragraph 4, letters d) and g) of Legislative Decree 68/2012, art. 2.1, letter f) of the University Regulations issued with Rector’s Decree 1203/2011 and the regulations establishing the Register of University Associations/Student Cooperatives recognised by the Alma Mater Studiorum - University of Bologna, issued with Rector’s Decree 1157/2007 (registration with the Register of University Associations/Student Cooperatives and granting of financial assistance or other University resources to the same).

The provision of data for the aforementioned purposes is optional but necessary in order to provide the benefits and services described above.

Recipients

In addition to the recipients mentioned in the general privacy policy, the data may also be sent to:

• ER.GO. in order to coordinate the activities, services and economic benefits under its responsibility aimed at students of the University;
• at the request of the data subject, the University’s treasury office for the purposes of offering a fiduciary loan;
• TPER S.p.A. in relation to the financial assistance available to university students to help them purchase travel cards;
• parties appointed as Data Processors who provide services to help incoming exchange students with matters such as finding accommodation and immigration procedures;

• other bodies that provide funding for international mobility programmes such as, for example, INDIRE (national Documentation, Innovation and Educational Research Institute) or MUR (Ministry of Universities and Research) for the Fondo Giovani (Young People’s Fund);
• Withub S.p.A., as the Data Processor for processing carried out in order to maintain the applications used by the University in managing the register of university associations/student cooperatives recognised by the University;
• other parties to whom specific services are outsourced to achieve specific purposes, and public or private partners with whom it is possible to collaborate in order to achieve the same purposes.

Privacy policy applicable to the diffusion of the final results and any connected elements (in Italian)

Specific processing purposes and methods

Personal data, special categories of data and/or criminal records data
(which may be processed in cases where a health condition or other personal convictions/circumstances of the data subject come to light during proceedings initiated and/or in reports of disciplinary offences) are processed for the purposes of conducting investigations and any administrative proceedings against students, PhD students and medical interns.

Legal basis of the processing and nature of the provision of data

The legal basis for the data processing is found in:

• articles 6, paragraph 1, letters c) (processing in order to comply with a legal obligation) and e) (processing carried out in the public interest) and 9, paragraph 2, letter g) (processing for reasons of substantial public interest) of Regulation (EU) 2016/679;
• the sources of law governing disciplinary measures and sanctions that may be applicable (Royal Decree 1592/1933, art. 16 of Royal Decree Law 1071/1935, University Regulations).

The provision of personal data is compulsory. Refusal to provide the data will make it impossible to perform the operations necessary for the purposes of the investigation and any administrative proceedings.

Recipients

With regard to the potential recipients already indicated in the general privacy policy, it should be noted that the data may be processed:

• by the Attorney General and by private lawyers;
• where the investigation concerns an international student or a student enrolled on a joint degree programme, the data may be shared with the student’s home university.

Transfer of data outside of the EU and the conditions applicable to the transfer

If an international student from a university outside of the EU is involved, the data will be shared with said university:

• based on an adequacy decision of the European Commission pursuant to art. 45 of Regulation (EU) 2016/679;
• by adopting one of the safeguards indicated in art. 46 of Regulation (EU) 2016/679 (for example, the clauses adopted by the European Commission on the type of data protection);
• in the absence of the above, by adopting the conditions referred to in art. 49 of Regulation (EU) 2016/679 (for example, where the transfer is necessary for the establishment, exercise or defence of legal claims).

Specific processing purposes and methods

Personal data is processed within the framework of the project entitled “Reducing student drop-out rates and supporting timely student career progression”, envisaged by the University's 2022-2027 Strategic Plan in order to:

• expand, improve and innovate guidance for incoming students so as to prevent drop-outs;
• improve the programme catalogue and global teaching organisation to make career progression easier;
• establish a student career monitoring system to promptly recognise and effectively support students experiencing difficulties, also by means of ad hoc measures and predictive tools;
• expand tutoring activities for students who, from the beginning of their career, experience difficulties in relation to certain subjects or skills.

To implement these actions, the following personal data processing steps and operations are envisaged, carried out exclusively by specifically authorised personnel subject to confidentiality and/or professional secrecy obligations:

• Extraction of data already collected by the University for the pursuit of other institutional purposes (e.g. career management), in order to obtain - by means of specific queries and additional survey tools (e.g. online questionnaires) - additional information to that already held by the University, with particular attention to the factors that determine a situation of difficulty, whether temporary or permanent;
• Statistical and aggregate analyses based on the processing of profiles associated with each individual student;
• Contacting students by email and/or telephone to propose customisable plans and pathways (including possible follow-ups).

Data, which may be anonymised and/or aggregated, is also processed for statistical and research purposes.

Legal basis of the processing and nature of the provision of data

The legal basis for the processing is found in art. 6, paragraph 1, letter e) (processing carried out in the public interest) of Regulation (EU) 2016/679 and in art. 2-ter of Italian Legislative Decree no. 196/2003, et seq.
In addition, the following resolutions of the Board of Directors have been adopted: no. 183430 of 28/6/2022 approving the University’s 2022-2027 Strategic Plan; no. 0247544 of 6/9/2023 approving the project entitled “Reducing student drop-out rates and supporting timely student career progression”.
Data acquired by the University is to be considered necessary to pursue the purposes described above, it being understood that data subjects may at any time exercise their right to object to the processing of their data by notifying the contact persons provided by the University.

Recipients

In addition to the recipients mentioned in the general privacy policy, the data may be sent to third parties, appointed as Data Processors in accordance with art. 28 of Regulation (EU) 2016/679, in relation to the management of the University's IT systems or services (e.g. Microsoft services). 

Data storage period

The personal data processed for the aforementioned purposes is stored until the termination of each student's career for whatever reason (graduation, withdrawal from studies or transfer to another university) and, in the sole case of graduation, for a further 12 months.

Specific processing purposes and methods

Personal data, including special data relating to the gender identity of the person concerned, are processed in order to activate and manage the alias career and to allow applicants the widest possible exercise of their right to self-determination with regard to gender identity, as well as to combat forms of discrimination and to create the safest and fairest possible environment for learning and working.

The personal data will specifically be processed for the purposes of:

• allowing the person concerned to keep their personal data as confidential as possible, and to be known in the University with their elected data;
• permitting access to certain services inside and outside the University with the use of the elected data;
• allowing participation in international activities and programmes using their own chosen identity, wherever possible;
• retaining data on personal and chosen identity for use in internal proceedings of external relevance, including storage in the University's files in accordance with the law.

Data may also be processed, in anonymised and/or aggregated form, for statistical and research purposes.

Legal basis of the processing and nature of the provision of data

The legal basis for the data processing is found in: 

• articles 6, paragraph 1, letters e) (processing carried out in the public interest) and 9, paragraph 2, letter g) (processing for reasons of substantial public interest) of Regulation (EU) 2016/679;
• in the following regulatory sources: Articles 2, 3 and 34 of the Constitution; Article 2, paragraphs 1 and 6 of the University Statute; Articles 9 and 10 of the University Code of Ethics and Conduct.

In addition, the guidelines of the National Conference of Equality Bodies of Italian Universities (COUNIPAR) and the resolution of the Board of Directors no. 702 of 28/09/2021, which approved the University guidelines on ALIAS Careers, have been adopted.

Recipients

In addition to the recipients mentioned in the general privacy policy, the data may also be sent to:

• third parties (e.g. Start Romagna, CUSB, Er.go, Polo Bibliotecario Bolognese), in order to enable the provision of further services and benefits to applicants;
• international universities and external organisations hosting interns, to enable career continuity during international mobility and/or internship periods;

third parties appointed as Data Processors pursuant to art. 28 of Regulation (EU) 2016/679 to assist the University in managing its information systems and services (such as Microsoft services). 

Transfer of data outside of the EU and the conditions applicable to the transfer

In addition to the cases provided for in the general notice, the personal data collected may be transferred to a country outside the European Economic Area (EEA, i.e. the EU + Norway, Liechtenstein, Iceland) in the event that students undertake incoming or outgoing mobility, also as part of study courses provided under partnerships between several universities/bodies, or access the University of Bologna's training courses with qualifications obtained abroad.

Data retention period

All documents containing personal data that are necessary in order to have a record of important legal events concerning the student are stored indefinitely. The retention period for the remaining data depends on the administrative documents in which they are contained and/or on the corresponding legal requirements.