Privacy Policy pursuant to Articles 13 and 14 of the EU Regulation 2016/679

As Data Controller, Università Commerciale “Luigi Bocconi” will process your personal data only to the extent that they are essential to respond to requests for assistance on the University's services, in compliance with the provisions of current legislation on the protection of personal data.

1. Data Subjects 

Università Commerciale "Luigi Bocconi", with registered office at Via Sarfatti 25, Milan, in the person of its pro tempore legal representative, in the capacity of "Data Controller" (hereinafter "Data Controller" or "University"), hereby informs you that your personal data will be processed in compliance with the legislation on the protection of personal data (EU Regulation 2016/679, "GDPR" and Legislative Decree 196/2003 and subsequent amendments, "Privacy Code"), in order to guarantee the rights, fundamental freedoms, as well as the dignity of individuals, with particular reference to confidentiality and personal identity. 
The Data Protection Officer (hereinafter, "DPO") can be reached at dpo@unibocconi.it.

2. Categories and Types of Personal Data Subject to Processing 

The data processed by the University may include the following information:

  • first name
  • last name
  • email address
  • additional personal data that may be included in the chat conversation for the purpose of describing the request.

3. Purpose and Legal Basis of Data Processing  

In compliance with current legislation on the protection of personal data, your personal data will be processed only to the extent that you intend to request the assistance of a human operator during the interaction with the Virtual Assistant (hereinafter, also "chatbot"). The personal data referred to in the preceding paragraph will be processed exclusively to follow up on the request for assistance received for the purpose of creating a ticket.
Personal data are processed to fulfill a contract in which the interested party is a party or to fulfill pre-contractual measures adopted at the request of the same, pursuant to Article 6, paragraph 1, letter b) of the GDPR. 

4. Personal Data Recipients  

The personal data collected in the course of the project will be shared with the following external parties:

  • third-party companies, such as specifically appointed Data Processors, pursuant to Article 28 of the GDPR (Indigo AI).

The list of recipients of personal data may be requested from the Data Controller, at the address indicated above. 

5. Data Processing Methods 

The personal data referred to in paragraph 2 are collected to follow up on the request for assistance received in the chat conversation with the Virtual Assistant. Your personal data is processed by the Data Controller only in the event that you intend to open a ticket to obtain assistance from a human operator. 

6. Retention Times for Personal Data 

To allow the Data Controller to provide the requested assistance and to carry out all related operations and activities, the data collected will be recorded, processed and stored until the ticket has been closed. 

7. Transfer of Data to Non-EU Countries 

Your personal data will not be transferred to countries outside the EU. 

8. Rights of Data Subjects  

You have the right to access the data concerning you at any time, pursuant to Articles 15-22 of the GDPR. In particular, you have the right to:

  • obtain confirmation as to whether or not personal data concerning you are being processed and, in this case, to obtain access to it (Article 15);
  • obtain the updating and/or correction/integration of your personal data (Article 16);
  • obtain the deletion of your personal data, in cases where this is permitted by the GDPR (Article 17);
  • obtain limitation of the processing of your personal data, if one of the scenarios provided for by current legislation occurs (Article 18);
  • object to processing, except for those contained in documents that must be kept by the University and unless there is a legitimate prevailing reason for the University to continue processing;
  • withdraw consent at any time, without prejudice to the lawfulness of the processing carried out before the withdrawal. In this case, no further data concerning you will be collected, without prejudice to the use of any data already collected to determine the results of the assistance, without altering them, or those that are not attributable to an identified or identifiable person, initially or as a result of processing.

Without prejudice to any other administrative or judicial appeal, you also have the right to lodge a complaint (Article 77 of the GDPR) with the Italian Data Protection Authority (www.garanteprivacy.it), if you believe that the processing that concerns you violates the current legislation on protection of personal data.
To exercise all the rights indicated above, you may contact the DPO in writing at the address indicated above.