Informativa sul trattamento dei dati personali (Raccolta fondi)

Privacy notice on the processing of personal data of donors and supporters of the University of Verona

Article 13 of Regulation (EU) 2016/679

Why this information

Pursuant to Regulation (EU) 2016/679 ("GDPR"), this notice describes how the personal data of natural persons and of representatives of legal entities who make donations or express interest in supporting projects, initiatives and activities of the University of Verona through the dedicated fundraising portal are processed.

Data Controller

The Data Controller is the University of Verona, with registered office at Via dell'Artigliere n. 8, 37129 Verona.

PEC: ufficio.protocollo@pec.univr.it
Tel.: +39 045 8028777

Data Protection Officer

The Data Protection Officer (DPO) can be contacted at: DPO@ateneo.univr.it.

Types of data processed

The following categories of data may be processed:

  • personal and identification data;
  • contact data;
  • tax code;
  • data relating to the donation made;
  • data relating to the preferences expressed by the donor, for example the destination of the donation or the choice of anonymity;
  • data relating to the representatives of donating entities, companies or foundations.

Categories of data subjects

  • natural person donors;
  • alumni;
  • students;
  • employees and collaborators;
  • representatives of public and private entities;
  • representatives of companies, foundations and associations that support the University.

Purposes of processing and legal bases

Personal data are processed by the University of Verona for the following purposes.

A. Management of donation requests

Personal data are processed to receive and manage expressions of interest, acquire donations, establish and manage the relationship with the donor, as well as carry out the activities necessary for the execution of the operations requested by the data subject.

Legal basis: Art. 6(1)(b) GDPR, as the processing is necessary for the performance of pre-contractual measures taken at the request of the data subject and for the management of the relationship arising from the donation.

B. Administrative, accounting and tax obligations

Personal data are processed to comply with the obligations provided for by current legislation on administrative, accounting, tax and documentary retention matters.

Legal basis: Art. 6(1)(c) GDPR, as the processing is necessary to comply with legal obligations to which the Controller is subject.

C. Institutional management of fundraising activities

Personal data may be processed for the planning, management, reporting and enhancement of fundraising activities and institutional initiatives supported through donations, within the framework of the University's institutional activities in the fields of education, research and third mission.

Legal basis: Art. 6(1)(e) GDPR, as the processing is necessary for the performance of tasks carried out in the public interest, in line with the University's institutional purposes and with the functions of promoting and supporting teaching, research, knowledge transfer and third mission activities.

D. Management of the donor's choice of anonymity

If the donor requests that their identity not be disclosed in the context of communication, reporting or enhancement activities of the funded initiatives, the University will process this preference in order to ensure it is respected.

Legal basis: Art. 6(1)(e) GDPR, as an activity connected to the institutional management of the relationship with the donor and of fundraising activities.

E. Communications relating to fundraising activities

With the prior consent of the data subject, contact data may be used to send informational communications, newsletters, updates on supported projects, fundraising campaigns and other institutional initiatives connected to the University's fundraising activities.

Legal basis: Art. 6(1)(a) GDPR.

Consent is optional and may be withdrawn at any time without affecting the lawfulness of the processing carried out before withdrawal. Withdrawal of consent entails the cessation of processing carried out for that purpose and does not affect further processing of the same personal data carried out for other purposes and on the basis of different legal grounds.

Nature of the provision of data

The provision of data necessary for the management of the donation is required to follow up on the data subject's request. Failure to provide such data prevents the University from managing the donation or related requests.

The provision of data for communication and fundraising purposes is, on the other hand, optional.

Recipients of the data

The data will be processed by authorized University personnel and may be communicated to entities that provide administrative, IT, banking or fundraising support services, appointed as data processors pursuant to Art. 28 GDPR where necessary.

Data retention

Data relating to donations will be retained for the time necessary for the management of the donation and, subsequently, for the period provided for by the applicable legislation on administrative, accounting, tax and retention of the University's administrative documentation.

Contact data used to send communications relating to fundraising activities will be used for this purpose until consent is withdrawn. Withdrawal entails the cessation of the use of the data for that specific purpose, without prejudice to the retention of data where necessary for other purposes and on the basis of different legal grounds.

Transfer of data abroad

Any transfers of personal data to third countries will be carried out in compliance with Chapter V of the GDPR.

Rights of data subjects

The data subject may exercise the rights provided for by Articles 15 et seq. of the GDPR, including access, rectification, erasure, restriction of processing, objection and withdrawal of consent.

Requests for the exercise of rights may be addressed to the Controller by writing to privacy@ateneo.univr.it or to the Data Protection Officer at DPO@ateneo.univr.it.

Right to lodge a complaint

The right to lodge a complaint with the Italian Data Protection Authority or to bring proceedings before the competent judicial authorities remains unaffected.

Return to the homepage