Information on the Processing of Personal Data

Pursuant to Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and Legislative Decree No. 196 of 30 June 2003, as amended by Legislative Decree No. 101 of 10 August 2018.

The Istituto Superiore di Sanità (ISS), with its registered office at Viale Regina Elena 299 – 00161 Rome, Italy, Tax Code (C.F.) 80211730587, VAT No. 03657731000, acting as the Data Controller, hereby informs persons visiting the website www.eduiss.it about the processing of personal data related to website browsing.

This Privacy Notice applies exclusively to the website www.eduiss.it and does not apply to third-party websites that may be accessed through hyperlinks.

Individuals who register on the EDUISS platform and access its training services are provided with a specific Privacy Notice, available during the registration process and within the platform.

1. Subject of the processing

While browsing www.eduiss.it, navigation data and any personal data voluntarily provided through the contact tools available on the website may be processed.

This processing concerns exclusively the data collected in connection with browsing of the website.

2. Purposes of processing

The personal data of persons visiting www.eduiss.it are processed for the following purposes:

• enabling access to and proper operation of the website;
• ensuring the security of systems and networks;
• producing aggregated statistical information on website usage;
• responding to requests voluntarily submitted through the contact channels available on the website.

Processing related to registration on the EDUISS platform, participation in training activities and use of training services is subject to the specific Privacy Notice provided to registered users of the EDUISS platform.

Legal basis

Depending on the purpose pursued, the legal basis for processing is the performance of tasks carried out in the public interest entrusted to the Istituto Superiore di Sanità.

3. Categories of data processed

Navigation data

The IT systems and software procedures used to operate the website automatically acquire certain data during their normal operation, the transmission of which is inherent in the use of Internet communication protocols.

These include, by way of example, IP addresses, the addresses of requested resources (URI), the date and time of requests, the method used to submit requests to the server, the numerical status code of the server response, and other technical information relating to the browser and operating system used.

Such data are processed exclusively to ensure the proper functioning and security of the website, to produce aggregated statistical information on website usage and, where necessary, to ascertain liability in the event of computer-related unlawful acts.

Data voluntarily provided by website visitors

Visitors may voluntarily provide personal data through the contact tools available on the website. Such data are processed exclusively to respond to the requests submitted by the data subject and for purposes related to the provision of the requested service.

4. Provision of data

Without prejudice to the processing of navigation data, visitors are free to provide any personal data requested through the forms or other contact tools available on the website.

Failure to provide such data may make it impossible to process the request or provide the requested service.

Where required by law, the competent authorities may request data and information in accordance with the applicable legislation.

5. Place and methods of processing

Processing activities are carried out at the Istituto Superiore di Sanità by personnel authorised to process personal data and, where applicable, by entities appointed as Data Processors pursuant to Article 28 of Regulation (EU) 2016/679.

Personal data are processed using electronic and IT tools, adopting appropriate technical and organisational measures to ensure their security, integrity and confidentiality, in accordance with Regulation (EU) 2016/679 and the applicable national legislation.

Personal data are retained only for the period necessary to fulfil the purposes described in this Privacy Notice, in compliance with applicable legislation and any statutory retention obligations.

6. Access to personal data

For the purposes described in this Privacy Notice, personal data may be processed by authorised personnel of the Istituto Superiore di Sanità and by entities acting on behalf of ISS as Data Processors, pursuant to Article 28 of Regulation (EU) 2016/679.

Personal data may also be disclosed to public authorities or other entities where required by applicable law.

For processing activities related to participation in EDUISS training activities and to the communication of data to bodies responsible for the accreditation of training events, reference should be made to the specific Privacy Notice provided to registered users of the EDUISS platform.

7. Rights of the data subject

Data subjects may exercise the rights provided for in Articles 15 et seq. of Regulation (EU) 2016/679, including the right of access, rectification, erasure, restriction of processing, objection and, where applicable, the right to data portability.

Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) pursuant to Article 77 of Regulation (EU) 2016/679.

8. How to exercise your rights

Data subjects may exercise their rights under Regulation (EU) 2016/679 at any time by sending a request to the Data Controller.

Data Controller

Data Protection Officer (DPO)