Privacy notice
Privacy Notice for GARR Audio/Video Services
Privacy notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679, the recognised non-profit association Consortium GARR, with registered office at via dei Tizii, 6 - 00185 - Rome - Italy, is the Data Controller of your personal data. The personal data collected are processed in compliance with the above-mentioned legislation. In relation to such processing, the Data Controller provides the following information:
This notice applies to users of the GARR web conferencing services:
Description of the services
All the services listed allow audio/video streams to be exchanged between the participants of the same session, commonly called a room. The services also support instant messaging, screen sharing and multimedia content sharing.
- BlueMeet: a solution designed for integrated digital learning (DID) and distance learning (DAD) classes and webinars, with federated access. BlueMeet supports session recording.
- BlueMeet salute: a BlueMeet instance dedicated to the Ministry of Health. It is a solution designed for integrated digital learning (DID) and distance learning (DAD) classes and webinars, with federated access. BlueMeet supports session recording.
- EduMeet: a solution for quickly creating rooms with high audio quality that users can control directly. The service is open and supports room moderation through federated authentication.
Contact details
Data Controller:
Consortium GARR
Tel: +39 06 4962 2000
Email:
Data Protection Officer (DPO):
Dr. Davide Vaghetti
Tel: +39 050 2213158
Email:
Place of processing
Consortium GARR, via dei Tizii, 6 - 00185 - Rome - Italy
Types of data processed
For all users
- IP address
For authenticated users
When authenticating via IDEM, the following data are transmitted by the user's home organisation:
- eduPersonPrincipalName (R): unique identifier of the user, used to gain access to the services
- mail (R): email address, used to receive notifications from the systems
- givenName + sn (R): the user's first name and surname, used to personalise the interface
- eduPersonScopedAffiliation (optional): used to authorise the user based on their role within their home organisation
When authenticating via OAuth through social login providers, the data transmitted to the services are:
- id: unique identifier of the user, used to access the services
- email: used to receive notifications from the services
- name + surname: used to personalise the interfaces
Services that support audio/video recording and playback of sessions involve the processing of the images contained in them. The data provided by the user upon registration (first name, last name, username, password, email address, institution/organisation of affiliation) are retained until the user relationship ends. Consortium GARR does not carry out any profiling of users.
Cookies
For information on the use of cookies, please refer to the dedicated notice: Cookie Policy.
Legal basis
Article 6(1)(b) (performance of the service) and (f) (legitimate interests) of Regulation (EU) 2016/679.
Purposes of processing
Provision and management of the service; maintenance and monitoring of the platform, with regard to the technical and system administration of the data and the hardware infrastructure; the personal data of authenticated users are used to determine access permissions and control over each feature of the services. The email address is used to send the user notifications and communications about the status of the services and changes to authorisation levels. GARR may also use personal data, on the basis of its legitimate interests, to ensure the integrity, efficiency and security of the services.
Retention period
The data will be processed for as long as necessary to carry out the relationship in place, and in any case for the period required by the applicable Italian legislation.
Provision of data
The provision of the requested data is necessary in order to use the services. Failure to provide the data may make it impossible for the data subject to receive the service.
Methods of processing
Personal data will be processed by computerised and electronic means and entered into the relevant databases, which may be accessed, and the data thus become known, only by personnel expressly authorised by the Data Controller to process personal data, who are bound by an explicit duty of confidentiality. Such personnel may carry out processing operations in compliance with the provisions of the law, ensuring not only confidentiality but also the integrity, security, accuracy and relevance of the data, in line with the stated purposes.
Scope of disclosure and dissemination of data
Users' personal data are used solely to provide the service or perform the task requested and are disclosed to third parties only where:
- this is necessary to provide the services requested by the user and to fulfil the data subject's requests;
- disclosure is required by legal or regulatory obligations or serves a significant public interest;
- users who share multimedia content are informed that their identifier and the content may be visible to other users, depending on the settings they themselves apply;
- streamed and/or recorded content is processed by the garr.tv service, of which Consortium GARR is the Data Controller.
Safeguards
Your personal data will be protected in accordance with the Code of Conduct for Service Providers, a common standard for the research and education sector designed to protect your privacy.
Rights of data subjects
In relation to the above processing, you may exercise the rights set out in Articles 15 to 22 of the GDPR, including the right to:
- obtain confirmation of whether or not data concerning you exist;
- know the origin of the data, and the logic and purposes of the processing;
- obtain the erasure, anonymisation or blocking of data processed in breach of the law, as well as the updating, rectification or completion of the data;
- object, on legitimate grounds, to the processing of the data, within the limits and under the conditions provided for.
To exercise their rights, data subjects may submit a request to Consortium GARR, Via dei Tizii, 6, 00185 - Rome, by calling +39 0649622000, by fax to +39 0649622044, or by emailing
To rectify data released by your home organisation, please contact your organisation's IT help desk. For more information, contact
Further information on the processing of data may also be provided verbally.
GÉANT Data Protection Code of Conduct
The GARR videoconferencing services with federated access comply with the requirements of the GÉANT Data Protection Code of Conduct.