PRIVACY POLICY
Learn how your personal data is used and protected
Privacy Policy – DataScientia
This Privacy Policy is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and Legislative Decree no. 196/2003 (Italian Personal Data Protection Code), as amended by Legislative Decree no. 101/2018. It explains how the University of Trento processes the personal data of people who use:
- the DataScientia website at https://datascientia.eu;
- the DataScientia Community portal at https://ds.datascientia.eu/community/;
- the DataScientia Marketplace portal at https://ds.datascientia.eu/marketplace/.
It applies to all users, wherever they are located, and replaces the previous privacy policies of the DataScientia Community and Marketplace portals. The former addresses datascientia.it and datascientia.disi.unitn.it permanently redirect to datascientia.eu. Cookies and similar technologies are described in the separate Cookie Policy.
In this policy, “we”, “us” and “our” refer to the University of Trento, including the KnowDive research group acting on its behalf, and “you” refers to the person whose data is processed (the “data subject”).
1. Data controller
The data controller is the University of Trento (Università degli Studi di Trento), via Calepina 14, 38122 Trento (TN), Italy.
- Email: ateneo@unitn.it
- Certified email (PEC): ateneo@pec.unitn.it
The DataScientia website and portals are developed and managed by the KnowDive research group of the Department of Information Engineering and Computer Science (DISI). The Director of DISI is in charge of this processing on behalf of the University, under the University’s regulations on personal data protection.
2. Data Protection Officer
The University has appointed a Data Protection Officer (DPO), who can be contacted at rpd@unitn.it for any question about the processing of your personal data or to exercise your rights.
3. Categories of personal data processed
3.1 Browsing data
The University of Trento servers that host the website and portals, including the gateway that routes requests to them, automatically acquire some personal data whose transmission is implicit in the use of internet communication protocols: the IP address of the device, the date and time of the request, the resource requested and the method used, the server’s response code and the size of the response, and technical details of the browser and operating system.
This data is not collected to identify you, but by its nature it could allow identification when combined with data held by third parties, such as internet service providers.
3.2 Account and login data
When you create a DataScientia account, which gives access to both the DataScientia Community and the DataScientia Marketplace, we process:
- data you provide: first name, last name, email address and password (stored only in hashed form);
- data received from Google, if you sign up with your Google account (Art. 14 GDPR): first name, last name and email address only. After signing up with Google, you are also asked to set a password, stored only in hashed form, so you can also login with your mail address and password;
- data generated by the system: account ID, registration date, roles, login sessions (start time, last access, IP address and portal used) and account events such as registration, email verification, password changes and failed logins (date and time, account ID, IP address, portal used and, for failed logins, the username or email entered).
3.3 Data provided in the DataScientia Community
After registering, you can provide further data on the Edit profile page, depending on your role:
| Role | Additional data |
|---|---|
| All roles | Optionally, a profile picture |
| Member | None |
| Participant | Gender, date of birth, nationality, education level, university, department or faculty, degree programme, course year and profession. These characteristics are used to match you with research projects that have specific criteria, for example a minimum age, a nationality or a field of study. Only if you receive a monetary incentive: place of birth, address, phone number, tax code and IBAN. |
| Researcher | Occupation, affiliation, website and, optionally, LinkedIn profile URL |
| Staff roles (system manager, study coordinator, financial administrator) | Institution and occupation |
Dashboard statistics. We calculate aggregate statistics on how the platform is used, such as the number of projects created, contributions and incentives earned, and show them as summaries on your dashboard.
Data collected inside research projects. Answers and other data you provide while taking part in a research project (for example in a survey) are not stored or analysed on the DataScientia Community. They are collected by the researchers running the project, under their own privacy notice.
If you subscribe to the newsletter, we also process your consent and the date it was given or withdrawn.
3.4 Data provided in the DataScientia Marketplace
When you request access to a dataset, we process your name, surname, email address, occupation, affiliation and website, and the details of your request (dataset, access period, approval, and your declaration that the data has been deleted). If the licence of a specific dataset requires identity verification, we also process the copy of your identity document that you upload, which Marketplace administrators use to verify the details you provided.
3.5 Data you send us
If you contact us by email or through the contact form on the website, we process the data you provide, such as your name, email address and the content of your message.
3.6 Special categories of data
We do not ask for special categories of personal data (Art. 9 GDPR), such as health data, or data relating to criminal convictions (Art. 10 GDPR). Please do not include such data in your messages.
4. Purposes and legal basis of the processing
| Purpose | Data | Legal basis |
|---|---|---|
| a) Delivering the pages you request and ensuring that the website and portals work correctly | Browsing data | Performance of a task carried out in the public interest (Art. 6(1)(e) GDPR) |
| b) Creating and managing your account, single sign-on to both portals, and checking eligibility for the DataScientia Marketplace (email from a university or research institution) | Account and login data | Art. 6(1)(e) GDPR |
| c) Protecting the security of accounts, the website, the portals and the University’s systems, and preventing misuse | Browsing data, account and login data | Art. 6(1)(e) GDPR, in line with the security obligations of Art. 32 GDPR |
| d) Managing your role in the DataScientia Community: matching participants with research projects that have specific criteria, using pseudonymous IDs, sending instructions for the projects you join, verifying researcher profiles and publishing projects, and giving staff access to their functions | Account data and Community data | Art. 6(1)(e) GDPR |
| e) Paying incentives or assigning training credits to participants | Participant data, including payment data | Art. 6(1)(e) GDPR; for accounting and tax records, compliance with a legal obligation (Art. 6(1)(c) GDPR) |
| f) Showing aggregate statistics on your dashboard | Community data, in aggregate form | Art. 6(1)(e) GDPR |
| g) Assessing dataset requests, verifying the requester’s details and, where required, identity document, granting access, sending messages about your request and access period, and checking that the conditions of use, including deletion of the data, are respected | Marketplace data | Art. 6(1)(e) GDPR |
| h) Sending the DataScientia Community newsletter, which contains only news about the research activities supported by the DataScientia Community and Marketplace portals | Name and email address | Your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time |
| i) Replying to your messages and requests, including requests to exercise your rights | Data you send us | Art. 6(1)(e) GDPR; for requests to exercise your rights, compliance with a legal obligation (Art. 6(1)(c) GDPR) |
| j) Supporting investigations of computer crimes and complying with requests from judicial or public authorities | Browsing data, account and login data | Compliance with a legal obligation (Art. 6(1)(c) GDPR) |
The tasks carried out in the public interest are the University’s institutional activities of scientific research, teaching and the dissemination of their results, laid down by law and by the University’s Statute (Art. 6(3) GDPR and Art. 2-ter of the Italian Personal Data Protection Code).
We will not use your data for purposes other than those listed above. Anonymous, aggregated statistics, for example on the number of members of the DataScientia Community, may be published in scientific or institutional publications; they do not identify anyone.
5. Nature of the provision of data
- Browsing data is necessary for the website and portals to work, so it cannot be refused while using them.
- Account data is necessary to create an account. Without it, you cannot register.
- Community and Marketplace data is optional. However, without it you cannot take part in research projects, receive incentives, use the research support services or access datasets.
- Subscribing to the newsletter is entirely optional. Refusing or withdrawing your consent has no effect on your account or membership.
- Contacting us is voluntary, but without your email address we cannot reply.
6. Processing methods and security
Personal data is processed with electronic tools, by authorised staff only, in accordance with the principles of Art. 5 GDPR. It is stored on University of Trento servers, protected by technical and organisational measures appropriate to the risk (Art. 32 GDPR), including:
- encrypted connections (HTTPS) for all traffic;
- passwords stored only in hashed form, and payment data stored in encrypted form;
- access limited to authorised staff through personal credentials and role-based permissions;
- pseudonymisation of participants towards researchers, who never see participants’ names or contact details.
No decision producing legal or similarly significant effects on you is taken solely by automated means, including profiling (Art. 22 GDPR).
7. Recipients of the data
Your data is processed by staff of the University of Trento, including the KnowDive research group, who are authorised and instructed to process it (Art. 29 GDPR and Art. 2-quaterdecies of the Italian Personal Data Protection Code). Each person sees only the data needed for their role:
| Who | What they can see and do |
|---|---|
| Login service administrators | Account and login data in the DataScientia login service (Keycloak). They manage user accounts, send password reset requests and help users recover access to their account. |
| Community system managers | Account details and roles. They manage user accounts and control who can access the DataScientia Community and Marketplace. |
| Community study coordinators | Personal data of participants including name, email, university, native language to match the participants to a research project. They contact participants directly only when manual communication is strictly necessary. |
| Community researchers | Pseudonymous IDs and, where needed, general characteristics of participants (such as age range or faculty), never names or contact details |
| Community financial administrators | Payment data of participants, to process incentives |
| DataScientia Marketplace administrators | The dataset requests submitted, including the requester’s name, email address, occupation, affiliation, website and, where required, identity document. They verify these details, approve or reject dataset download requests and contact researcher(s) via email when necessary. |
Your data may also be disclosed to:
- the administrative offices of the University of Trento and, where applicable, of a partner university (see below), which receive only the data needed to pay incentives or assign training credits;
- IT service providers that host or maintain our systems or send our emails, acting as data processors under a contract with the University (Art. 28 GDPR);
- judicial or public authorities, where required by law.
Other users of the portals cannot see your email address or other personal data. We do not sell your data and do not disclose it to third parties for their own purposes.
Partner universities
Partner universities are universities that carry out research projects with the University of Trento on the basis of a written agreement. If you take part in such a project and are entitled to an incentive or to training credits, the data strictly needed to pay the incentive or assign the credits may be communicated to the administrative offices of the partner university concerned, which process it as an independent controller for its own administrative purposes. The data is sent by email in an encrypted, password-protected file, and the password is sent through a separate channel. You will be informed when you join such a project. No data is communicated to a partner university unless you take part in one of its projects.
If you sign up with Google, Google Ireland Limited processes your data as an independent controller under its own privacy policy.
8. Transfers outside the European Union
We do not transfer the personal data covered by this policy outside the European Union. If you choose to sign up with Google, or accept YouTube cookies on the website, Google may transfer data to Google LLC in the United States under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023). Details on cookies are given in the Cookie Policy.
9. Retention periods
We keep personal data only as long as necessary for the purposes for which it was collected (Art. 5(1)(e) GDPR):
| Data | Retention period |
|---|---|
| Browsing data | As long as needed for the purposes above, and in any case no longer than 6 months |
| Login sessions – stored by login service (Keycloak) | Until you log out, after 30 minutes without activity, or at most 10 hours |
| Account events – logged by login service (Keycloak) | 90 days |
| Community Profile data | As long as your account is active. If you do not log in for 36 months, we notify you 30 days in advance and then delete your account and all personal data associated to it. |
| Payment records held by the administrative offices | For the period required by tax and accounting law |
| Personal data submitted as part of dataset download requests on Marketplace | For the duration of your access, and then for 24 months after data distribution process is closed |
| Messages you send us (inquiry emails or the contact form) | As long as needed to handle your request, unless the law requires us to keep them as part of the University’s records |
The periods above may be extended only where needed to investigate a security incident or a crime, to establish or defend legal claims, or to comply with a legal obligation, and only for as long as that requires.
If you ask us to delete your account, we do so without undue delay and at the latest within one month, together with the data linked to it in the DataScientia Community and Marketplace, except for data we must keep under the paragraph above.
10. Rights of the data subject
Under Articles 15 to 22 GDPR, and within the limits set by those articles, you have the right to:
- access your personal data and obtain a copy of it (Art. 15);
- obtain the rectification of inaccurate data or the completion of incomplete data (Art. 16);
- obtain the erasure of your data, except where we must keep it under Art. 17(3) GDPR (Art. 17);
- obtain the restriction of processing (Art. 18);
- receive the data you provided in a structured, commonly used and machine-readable format, where the processing is based on consent (data portability, Art. 20);
- object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) GDPR (Art. 21);
- withdraw your consent to the newsletter at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3)).
To exercise your rights, write to the Data Protection Officer at rpd@unitn.it or to the data controller at the addresses in section 1. Exercising your rights is free of charge. We will reply without undue delay and at the latest within one month; this period may be extended by two further months for complex or numerous requests, in which case we will tell you within the first month (Art. 12(3) GDPR). We may ask for information to confirm your identity.
If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work (Art. 77 GDPR), or to seek a judicial remedy (Art. 79 GDPR).
11. Related notices
Shorter notices are shown at the moment data is collected. They are consistent with this policy:
| When | Notice |
|---|---|
| Visiting any page | Cookie Policy |
| Creating a DataScientia account | Registration Privacy Notice, linked on the registration form |
| Community Profile page (see section 3.3) | Notice with information on the processing of personal data, shown to user based on role |
12. Changes to this policy
We may update this policy to reflect changes in the processing or in the law. The date of the latest update is shown at the top of this page. If a change significantly affects how we process your data, we will inform you through the portals or by email.