Why this Privacy Notice
Pursuant to Regulation (EU) 2016/679 (GDPR) (hereinafter referred to as the Regulation) and Italian Legislative Decree No. 196 of 30 June 2003, as amended, this Privacy Notice describes how the personal data of users who make use of the services provided by the CloudVeneto infrastructure are processed.
The CloudVeneto infrastructure is jointly managed from Italian Institute for Nuclear Physics (hereinafter referred to as INFN) and University of Padua (hereinafter referred to as UNIPD), acting as joint data controllers.
What is CloudVeneto
CloudVeneto is a cloud infrastructure dedicated to scientific research, intended for use by the users of the INFN division of Padova and INFN National Laboratories of Legnaro and the UNIPD.
The two institutions jointly manage the infrastructure on the basis of a collaboration agreement (the “Agreement for the Management of the Scientific Computing Infrastructure named “CloudVeneto”).
Joint Data Controllers
The Joint Data Controllers responsible for the processing of the personal data of users of the CloudVeneto platform are:
- Italian Institute for Nuclear Physics (INFN)
Via Enrico Fermi, 54 – 00044, Frascati (Rome)
padova@pec.infn.it
- University of Padova (UNIPD)
via VIII Febbraio 1848, n. 2 – 35122 Padova
amministrazione.centrale@pec.unipd.it
The roles and responsibilities of the two entities are defined in the Joint Controllership Agreement entered into pursuant to Article 26 of the GDPR , which is available at the following link:
https://cloudveneto.it/Accordo_Unipd_INFN_x_gestione_CloudVeneto_Allegato3.pdf.
The Data Protection Officers (DPOs) of the Joint Data Controllers can be contacted at the following email addresses:
- INFN: dpo@infn.it;
- UNIPD: privacy@unipd.it
Purpose and Legal Basis of the Processing
The processing of personal data of registered users of CloudVeneto is intended to enable the regular use of the scientific computing services provided by the platform.
The legal basis for the processing is the provision of the CloudVeneto platform services requested by authorized users.
Types of personal data processed
Data Provided by the User
This category includes all personal data provided by the user when registering on the CloudVeneto platform, including:
- First and last name
- Email address
- Identifier provided by the authentication system INFN or UNIPD
- Description of the scientific project
The data are collected when the user registers for and uses the service and are necessary for the provision of the requested activities and services.
Data Automatically Generated by the CloudVeneto Services
This category includes personal data that are automatically generated by the CloudVeneto services during the use of the platform. Such data include, for example, records of successful or attempted access, as well as logs relating to the creation, deletion, or modification of instances (e.g., virtual machines) within the CloudVeneto infrastructure.
Data Contained in Email Messages
The optional, explicit, and voluntary sending of email messages to the addresses published on the CloudVeneto website https://cloudveneto.it (e.g., a support request sent to the technical support team) results in the collection of the sender’s email address, which is necessary to respond to the request, as well as any other personal data included in the message.
Browsing Data
The information systems and software procedures used to operate the web portal through which users access CloudVeneto services automatically collect certain personal data during their normal operation. The transmission of such data is inherent in the use of Internet communication protocols.
This category includes, among other things:
- the user’s IP address;
- the type of browser used;
- the addresses of the websites from which access was made;
- the pages visited within the website;
- the date and time of access;
- the numerical status code returned by the server;
- other parameters relating to the user’s operating system and IT environment.
These data are necessary to provide the web services, obtain anonymous statistical information on website usage, and ensure the proper functioning of the systems.
Such data may also be used to establish responsibility in the event of cybercrime or actions that damage the website or third parties.
Cookies Used
Cookies are small text strings stored on the user’s device by the websites they visit or by related third-party websites.
The web portal used to access the CloudVeneto services does not use cookies for user profiling, nor does it employ any other tracking technologies intended to monitor users’ behavior or deliver personalized advertising.
The website uses only technical cookies that are strictly necessary for the proper functioning of the services provided.
Session Cookies
Disabling these cookies may impair the availability or proper functioning of certain online services.
Analytics Cookies
The web portal used to access the CloudVeneto services does not use analytics cookies, which are typically employed to collect information about the number of users and how they visit and use a website.
Functionality Cookies
Functionality cookies are used to enable browsing according to the user’s preferences, such as the selected language (e.g., Italian or English).
Deletion of Stored Cookies
Users may manage or delete cookies at any time through their browser settings, typically by selecting an option such as “Clear browsing data” or an equivalent feature, depending on the browser used.
Methods of Processing Personal Data
The term processing of personal data refers to any operation or set of operations performed on personal data, including their collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, restriction, disclosure, erasure, and destruction.
Personal data are processed, to the extent possible, through IT tools, utilizing electronic procedures and media in a lawful, fair, and transparent manner. Processing is relevant, limited to what is necessary to achieve the purposes of the processing, and restricted to the period required to fulfill the purposes for which the data were collected, in any case in accordance with the principles set forth in Article 5 of EU Regulation 2016/679 (GDPR).
Appropriate technical and organizational security measures are implemented to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, and any other unlawful or improper processing.
Data Retention Period
Personal data are processed for the duration necessary to provide the requested service. They will be retained for a maximum of 12 months after the user ceases to use the service.
Recipients of Personal Data
The processing of personal data relating to the use of the services provided by CloudVeneto takes place at the premises of INFN and UNIPD and is carried out exclusively by members of the CloudVeneto technical team, who operate within the European Union.
Personal data provided by users may, where necessary, be disclosed to other departments or services of INFN or UNIPD solely for the purpose of fulfilling or completing a request submitted by the data subject.
The personal data collected will not be disclosed or communicated to third parties, except where provided for in this Privacy Notice or required by applicable law, and in any event only in the manner permitted by such provisions, for example, in response to a lawful request from a judicial authority.
Personal data are not transferred to countries outside the European Economic Area (EEA).
Data Subjects’ Rights
Data subjects have the right to obtain from the Joint Data Controllers access to their personal data and the rectification or erasure of such data, as well as the restriction of processing concerning them or the right to object to the processing, in accordance with Articles 15 et seq. of Regulation (EU) 2016/679 (GDPR).
Requests to exercise these rights should be submitted to the contact point indicated in this Privacy Notice or to:
- National Institute for Nuclear Physics (INFN): infn@cloudveneto.it
- University of Padova (UNIPD): unipd@cloudveneto.it
The above is without prejudice to the obligations relating to the retention of data for security purposes, the protection of the rights of the Joint Data Controllers, and compliance with applicable legal obligations.
Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (https://garanteprivacy.it), acting as the supervisory authority, or to seek a judicial remedy, in accordance with Articles 77 and 79 of the GDPR.
Updates to this Privacy Notice
This Privacy Notice may be updated from time to time in order to comply with applicable national and European legislation on the protection of personal data. Any such updates will be appropriately communicated to users.
If a user does not accept the changes made to this Privacy Notice within 15 days of their publication, the user will no longer be entitled to use the CloudVeneto services and may request the deletion of their personal data by contacting the points of contact indicated in this Privacy Notice.
It is understood that any processing of personal data carried out by users in the context of their own scientific research activities, using the resources made available by CloudVeneto, is independently determined and governed by those users acting as data controllers, in accordance with the applicable data protection legislation.
