PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA OF APAs AND APMs

PURSUANT TO ARTICLES 13 AND 14 of Regulation (EU) 2016/679

1 - Scope

This notice describes how the personal data of the Access Port Managers (APMs) and Access Port Administrators (APAs) of the Organisations connected to the GARR network are processed, pursuant to Regulation (EU) 2016/679 (hereinafter the "Regulation").

2 - Contact details

Data Controller:

Consortium GARR, Via dei Tizii, 6 – 00185 Rome.

Tel: +39 4962 2000, email: This email address is being protected from spambots. You need JavaScript enabled to view it. – PEC (certified email): This email address is being protected from spambots. You need JavaScript enabled to view it.

Data Protection Officer (DPO):

Dr. Davide Vaghetti. Tel: +39 050 2213158. Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

3 - Types of data processed

Consortium GARR processes only the minimum personal data of the technical and administrative contacts of the Organisations connected to the GARR network, and only where necessary for the management of the contractual relationship and for the publication provided for in the contract. The data processed are:

• first name and surname
• job title
• institutional contact details (email and/or work telephone number)
• department/office of affiliation, where applicable

No data beyond those necessary for the stated purposes are processed.

4 - Purposes of processing and legal bases

a. Management of the contractual relationship.

The data are processed for purposes connected with the management and performance of the contract between the Parties. Legal basis: Article 6(1)(b) of the Regulation. The processing of personal data is necessary for the performance of a contract to which the data subject is a party and for taking steps, at the data subject's request, prior to entering into a contract.

b. Communication activities concerning services and opportunities for the education and research community

Legal basis: Article 6(1)(f) GDPR, the Data Controller's legitimate interest in informing data subjects about relevant activities and opportunities, subject to a balancing against the data subjects' fundamental rights and freedoms.

c. Publication of the contacts' data.

Consortium GARR publishes the personal data listed in point 3 of the User's technical and administrative contacts on its platforms, information tools or restricted areas, in order to: ensure transparency towards the User community; ensure the proper use of the services; make identifiable the operational contacts involved in the delivery of the service.

Legal basis: Consortium GARR's legitimate interest in ensuring transparency, traceability and the proper functioning of the services provided to the Italian research and education community.

5 - Recipients of the data

The published data will be visible to the community of Users accessing Consortium GARR services through the platforms or information tools used. The data may also be disclosed to: providers of IT and technical support services to Consortium GARR; consultants and professionals assisting Consortium GARR; competent authorities, in the cases provided for by law.

6 - Methods of processing and security measures

Processing is carried out by computerised and electronic means, in compliance with the principles of lawfulness, fairness, transparency, data minimisation and proportionality. Consortium GARR adopts appropriate technical and organisational measures.

7 - Retention period

The data will be retained: for the entire duration of the contractual relationship between the Parties; thereafter, for the time necessary to comply with legal obligations and to protect the Data Controller's rights; published data will be removed within 12 months of the termination of the relationship or the replacement of the contact person.

8 - Rights of data subjects and right to lodge a complaint

Data subjects may exercise at any time the rights set out in Articles 15-22 of the Regulation, including: access to the data; rectification; erasure; restriction of processing; objection to processing based on legitimate interests; data portability, where applicable.

Requests may be sent to: This email address is being protected from spambots. You need JavaScript enabled to view it.. If data subjects consider that their data are being processed in breach of the Regulation, they have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

9 - Source of the data

The personal data are provided to Consortium GARR by the User in the context of the contractual relationship between the Parties.

10 - Nature of the provision of data

The provision of data is necessary for the management of the contractual relationship. The publication of the contacts' data is provided for in the contract and is limited to what is strictly necessary for the stated purposes.

11 - Updates

This notice may be updated in the event of changes in legislation or organisation. The updated version will be made available through the channels habitually used by Consortium GARR.

 Download the notice (PDF)