REGISTRATION PRIVACY NOTICE
Learn what data at registration is collected and how it is processed
Registration Privacy Notice – DataScientia
This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and Legislative Decree no. 196/2003 (Italian Personal Data Protection Code), as amended by Legislative Decree no. 101/2018. It explains how the University of Trento processes your personal data when you create a DataScientia account and log in with it.
One account gives access to both the DataScientia Community and the DataScientia Marketplace. You can register by filling in the registration form of the DataScientia login service, or by signing up with your Google account. This notice covers only the data collected at registration and login.
The processing of any additional data you may voluntarily provide while using the Community and/or the Marketplace (for example, to complete your user profile) is covered by the Privacy Policy or by specific privacy notices.
The processing of your personal data through cookies is described in the Cookie Policy. In this notice, “we”, “us” and “our” refer to the University of Trento, including the KnowDive research group acting on its behalf.
1. Data controller
The data controller is the University of Trento (Università degli Studi di Trento), via Calepina 14, 38122 Trento (TN), Italy.
- Email: ateneo@unitn.it
- Certified email (PEC): ateneo@pec.unitn.it
The DataScientia portals are developed and managed by the KnowDive research group of the Department of Information Engineering and Computer Science (DISI). The Director of DISI is in charge of this processing on behalf of the University.
2. Data Protection Officer
The University’s Data Protection Officer (DPO) can be contacted at rpd@unitn.it for any question about the processing of your personal data or to exercise your rights.
3. Categories of personal data processed
| Data | Registration form | Google sign-up |
|---|---|---|
| First name and last name | Provided by you | Received from Google |
| Email address | Provided by you | Received from Google |
| Password | Provided by you, stored only in hashed form | Set by you after signing up with Google, stored only in hashed form |
| Account data generated by the system: account ID, registration date, roles | Yes | Yes |
| Login sessions: start time, last access, IP address and portal used | Yes | Yes |
| Account events (registration, email verification, password changes, failed logins): date and time, account ID, IP address, portal used and, for failed logins, the username or email entered | Yes | Yes |
Source of data received from Google (Art. 14 GDPR). If you sign up with Google, we receive only your first name, last name and email address from Google Ireland Limited. We do not receive your Google password or any other data from your Google account.
We do not collect special categories of data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10 GDPR) at registration.
4. Purposes and legal basis of the processing
| Purpose | Legal basis |
|---|---|
| a) Creating and managing your account, and giving you access to the DataScientia Community and Marketplace through a single login | Performance of a task carried out in the public interest (Art. 6(1)(e) GDPR) |
| b) Checking eligibility for the DataScientia Marketplace, which is open only to users registered with an email address from a university or research institution | Art. 6(1)(e) GDPR |
| c) Sending messages strictly needed for your account, such as email verification, password reset and notices before an inactive account is deleted | Art. 6(1)(e) GDPR |
| d) Protecting the security of your account and of the University’s systems, for example by detecting repeated failed logins | Art. 6(1)(e) GDPR, in line with the security obligations of Art. 32 GDPR |
| e) Complying with requests from judicial or public authorities, and handling requests to exercise your rights | Compliance with a legal obligation (Art. 6(1)(c) GDPR) |
The tasks carried out in the public interest are the University’s institutional activities of scientific research and the dissemination of its results, laid down by law and by the University’s Statute (Art. 6(3) GDPR and Art. 2-ter of the Italian Personal Data Protection Code).
We do not use your registration data for profiling or marketing. We send you the DataScientia Community newsletter only if you subscribe separately in your profile, as explained in the Privacy Policy.
5. Nature of the provision of data
Providing your name, email address and (for the registration form) a password is necessary to create an account. Without them, you cannot register or use the DataScientia Community and Marketplace. Login sessions and account events are recorded automatically when you use your account.
6. Processing methods and security
Personal data is processed with electronic tools, by authorised staff only, in accordance with the principles of Art. 5 GDPR. It is stored on University of Trento servers, protected by technical and organisational measures appropriate to the risk (Art. 32 GDPR), including encrypted connections (HTTPS), passwords stored only in hashed form, and access limited to authorised staff through personal credentials.
No decision producing legal or similarly significant effects on you is taken solely by automated means, including profiling (Art. 22 GDPR).
7. Recipients of the data
Your data is processed by staff of the University of Trento, including the KnowDive research group, who are authorised and instructed to process it (Art. 29 GDPR and Art. 2-quaterdecies of the Italian Personal Data Protection Code):
| Who | What they can see | Why |
|---|---|---|
| Login service administrators | Name, email, account data, login sessions and account events in the DataScientia login service (Keycloak) | To manage accounts, send password reset requests, help you recover access to your account and keep the service secure |
| System managers | Name, email, account data and roles | To manage user accounts and control who can access the DataScientia Community and Marketplace |
Other users of the portals cannot see your email address or other personal data. Some roles see your name or email only if you choose to take part in an activity, as explained in the notices shown at that moment and in the Privacy Policy.
Your data may also be disclosed to IT service providers that host or maintain our systems or send our emails, acting as data processors under a contract with the University (Art. 28 GDPR), and to judicial or public authorities where required by law. We do not sell your data and do not disclose it to third parties for their own purposes.
If you sign up with Google, Google Ireland Limited processes your data as an independent controller under its own privacy policy.
8. Transfers outside the European Union
We do not transfer your registration data outside the European Union. If you choose to sign up with Google, Google may transfer data to Google LLC in the United States under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023). If you do not want this, use the registration form instead.
9. Retention periods
| Data | Retention period |
|---|---|
| Account data (name, email, account ID, roles) | As long as your account is active. If you do not log in for 36 months, we notify you 30 days in advance and then delete your account. |
| Password (hashed) | Until you change it or your account is deleted |
| Login sessions | Until you log out, after 30 minutes without activity, or at most 10 hours |
| Account events | 90 days |
These periods may be extended only where needed to investigate a security incident or a crime, to establish or defend legal claims, or to comply with a legal obligation, and only for as long as that requires.
You can ask us to delete your account at any time (see section 10). We will do so without undue delay and at the latest within one month, together with the data linked to it in the DataScientia Community and Marketplace, except for data we must keep under the paragraph above.
10. Rights of the data subject
Under Articles 15 to 22 GDPR, and within the limits set by those articles, you have the right to:
- access your personal data and obtain a copy of it (Art. 15);
- obtain the rectification of inaccurate data or the completion of incomplete data (Art. 16);
- obtain the erasure of your data, including the deletion of your account, except where we must keep it under Art. 17(3) GDPR (Art. 17);
- obtain the restriction of processing (Art. 18);
- object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) GDPR (Art. 21).
To exercise your rights, write to the Data Protection Officer at rpd@unitn.it or to the data controller at the addresses in section 1. Exercising your rights is free of charge. We will reply without undue delay and at the latest within one month; this period may be extended by two further months for complex or numerous requests, in which case we will tell you within the first month (Art. 12(3) GDPR). We may ask for information to confirm your identity.
You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work (Art. 77 GDPR), or to seek a judicial remedy (Art. 79 GDPR).
11. Minimum age
You must be at least 18 years old to create a DataScientia account.
12. Changes to this notice
We may update this notice to reflect changes in the processing or in the law. The date of the latest update is shown at the top of this page. If a change significantly affects how we process your data, we will inform you through the portals or by email.