Information on the processing of personal data of PhD candidates, PhD students and PhD graduates

Pursuant to articles 13 and 14 of Regulation (EU) 2016/679 “General Data Protection Regulation” (hereinafter “GDPR”), recognizing the fundamental right of natural persons to the protection of their personal data, the University of Trento provides the present notice to persons who want to participate in the selection procedures to be admitted to PhD programmes, to PhD students and to PhDs (hereinafter “data subjects”).

1. Controller of the data processing and Data protection Officer contacts

The controller of the data processing is the University of Trento (hereinafter “University”), legal headquarters in via Calepina, 14, 38122 Trento (Italy), emails: ateneo [at] pec.unitn.itateneo [at]
The data subjects may contact the Data Protection Officer (DPO or RPD) to have information about processing of their personal data or to exercise their rights writing to: via Verdi n. 8, 38122 Trento, email: rpd [at]

2. Purposes of data processing

Within its institutional activities, the University will process personal data (provided both when entering the selection procedure to be admitted to a PhD programme and, in case of admission to a PhD programme, during the whole PhD educational career), for the following purposes:

  1. to manage the selection procedures to be admitted to University PhD programmes;
  2. to manage registration procedures and related activities (e.g. to identify PhD students by their digital pictures); 
  3. to manage the university career, including the degree award (e.g. managing of the study plan, exams and credits registration, attendance to academic activities, registrations to CLA language courses, registration to Test center courses; applications to final exams and/or career suspension; career data filing and conservation);
  4. to carry out administration, accounting, financial and asset management activities, for example to manage scholarships and/or other financial support forms, to manage services and activities regarding the right to education (e.g. taxes relief, benefits, psychological assistance, students’ job collaborations);
  5. to decide about university taxes and fees, when due;
  6. to use information and communication services (University email address, digital and e-learning platforms, Moodle, online communities, other electronic devices and sources);
  7. to send institutional communications and other useful information using the University email account;
  8. to use the library services;
  9. to enter laboratories and other restricted access buildings;
  10. to check the truthfulness of self-declarations written in accordance with DPR 445/2000;
  11. to participate in PhD students representatives election in the University governing bodies, and to carry out the related tasks;
  12. in case of disciplinary procedures; 
  13. to manage national and international mobility programmes;
  14. to manage orientation services (incoming, during the study career, outgoing), tutoring and international mobility services; to manage activities regarding the job placement, also through data communication to private, public subjects and inter-university consortia only for employment/professional aims;
  15. to manage aids and extra time during admission tests and other kind of exams, and to manage inclusion services into the university community of persons with specific disabilities, learning disabilities and special educational needs;
  16. to manage the data of members of the Alumni UniTrento community;
  17. to participate in research projects and/or other activities in relation with the institutional University purposes;
  18. to manage video surveillance of University facilities;
  19. to manage statistical surveys to support analyses and the improvement of educational and research activities, services and assistance to PhD students;
  20. to manage safety and security issues as per Legislative Decree nr. 81/2008;
  21. to use the University research Registry (IRIS);
  22. to publish data and to upload PhD thesis in the institutional University repository (Unitn-eprints PhD/IRIS) and in the national central libraries of Rome and Florence.

3. Categories of personal data concerned

Within the above mentioned purposes the following categories of personal data are processed:

  • personal data, such as, but not only, name and surname, contact details, digital picture, registration number, registration data, University career related data, even of the previous study path (including publications, participation in conferences/seminars, research periods abroad), access qualifications, bank account, own income and fiscal data and the ones of family members, payments, images (video shooting, photos);
  • special categories of personal data (sensitive data) as per art. 9 of GDPR, such as data concerning health and disabilities (e.g. disability certificates, relief/facilitation usage), data concerning sex life and sexual orientation (e.g. gender changeover during study career), data related to racial and ethnic origin (e.g. refugee status), religious or philosophical beliefs, political opinions (e.g. election procedures of PhD students representatives);
  • judicial data as per art. 10 GDPR (e.g. to manage criminal convictions and offences, disciplinary procedures)

The legislation on personal data protection does not apply to the processing of anonymous or aggregate data.

4. Legal basis of data processing

Within the above mentioned purposes, personal data are necessarily processed by the controller on the basis of at least one of the following lawfulness principles.

Regarding personal data (according to GDPR art. 6, paragraph 1):

  • for the performance of tasks carried out in the public interest, as defined by the University of Trento establishing Law 590 of 14 August 1982, by the Ministerial Decree no.45 of 8 February  2013  and any subsequent amendments and additions, by the University Statute and by the reference internal regulations;
  • for compliance with a legal obligation;
  • to pursue a legitimate interest;
  • for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;on the basis of an explicit consent by the data subject.

Regarding special categories of personal data (sensitive data):

  • for reasons of substantial public interest, on the basis of the EU or national law according to art. 9 paragraph 2, letter g) of GDPR and art. 2-sexies, comma 2, letter bb) “academic education” of Legislative Decree 196/2003 and any subsequent amendments and additions; 
  • for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes (art. 9, paragraph 2, letter j) GDPR and art. 2-sexies, comma 2, letter cc) of Legislative Decree 196/2003 and any subsequent amendments and additions);
  • for the establishment, exercise, or defence of legal claims in court;
  • on the basis of an explicit consent by the data subject (art. 9, par. 2, letter a) GDPR).

Regarding judicial data (art. 10 of GDPR), these will be processed only as strictly necessary to carry out the purposes mentioned in previous point 2.

5. Mandatory or optional data provision 

The personal data provision for the above mentioned purposes is a mandatory requirement for admission and registration to PhD programmes, the management of the academic career and to fulfil the related administrative, accounting and fiscal duties.
The provision of data, including the “special categories” ones, for purposes as per letters m) to q) in previous point 2, is not mandatory, but failure in providing entails the impossibility for the University to grant the access to services, the participation in activities and/or to obtain the requested support.

6. Data source

As a rule personal data are collected from the data subjects. In some cases, they can be obtained from other sources, i.e. public data bases (SPID, ISEE), public administrations, register of convictions, tax assistance offices.

7. Data processing methods

Personal data are processed wholly or partly in paper forms and/or by automated means by the University of Trento personnel, who is authorized to data treatment according to their tasks, in respect of lawfulness, fairness, transparency, accuracy, relevance and necessity as per art. 5, paragraph 1 of GDPR.

8. Categories of recipients

In addition to all the University personnel acting for the above mentioned purposes, personal data can be disclosed to third parties (public and private) in order to correctly fulfil the mentioned purposes, within academic relationships, in performance of law, regulations and contract obligations.
Third parties may be: MIUR, ANVUR, ISTAT, Civil Service Department; MEF, CUN, CINECA, Opera Universitaria, Treasurer, Trentino Trasporti, CUS Trento, insurance companies, Revenue Agency (Agenzia delle Entrate), CAF, examination boards, administrations certifying self-declarations in accordance with DPR 445/2000, Embassies, Consulates, Police (Questura); Legal Council of State (Avvocatura dello Stato), judicial authorities, Information Centre on Academic Mobility and Equivalence – CIMEA; foreign Universities and academic institutions, within agreements including the setting up of PhD programmes with joint, double, multiple degrees, and for co-tutelle PhD programmes, public and private funding bodies -based on agreements signed as per Law no. 240/2010, private entities (Italian or foreign, i.e. companies, societies, Almalaurea) on request by the data subjects and in any case with their prior consent, to confirm possible qualifications or requirements and/or to facilitate orientation, training and integration into the labour market. 
While providing services necessary to the fulfilment of the above mentioned purposes, any body/entity processing personal data on behalf of the University will be appointed as Processor as per art. 28 of GDPR. 
In any case, personal data must be disclosed in compliance with a provision of the Authority of Public Security and/or the Judicial Authorities.
Personal data may be published on the University websites in the cases provided for by law or regulations.

9. Transfer of personal data to non-EU countries

Within the above mentioned purposes personal data can be transferred to non-EU countries, e.g. to universities, research institutes, public and private subjects within international mobility programmes, internships, research projects and other activities which have to be carried on out of the EU territory. 
This transfer will be performed within the limits and under the terms as per art. 44 and seq. of GDPR, that is when there is an adequacy decision by the EU Commission and /or appropriate safeguards or, when not applicable, on the basis of an explicit consent by the data subject.

10. Data retention period (storage limitation)

The data retention period shall be decided based on the processing necessity and in compliance with legal obligations and/or regulations on the matter. Personal data will be stored as long as necessary to fulfil the purposes as mentioned in previous point 2. Data can be stored for a longer period only for archiving in the public interest, scientific or historical research, or statistical purposes; in these cases appropriate technical and organizational measures will be taken.
In detail: 

  • biographical data, registration data, career data and final exam data will be stored indefinitely, taken into account of the archiving obligations required by the existing legislation;
  • data related to call for selection procedures (i.e. rankings, minutes, etc.) will be stored indefinitely;
  • digital identities necessary to use ICT services will be stored indefinitely to technically manage the digital University identities;
  • data related to web usage (e.g. time and duration of connection) and to usage of information systems (email) will be stored for a maximum period of 6 months, unless otherwise provided by law; 
  • data related to possible disciplinary procedures will be stored indefinitely;
  • data collected on the basis of consent provided by the data subject to access specific services will be stored till the same withdraws his/her consent and/or asks for the service deactivation, without prejudice to the compliance of a legal obligation to their retention.

11. Rights of the data subjects

 In accordance with art. 15 and seq. of GDPR, at any time the data subjects can obtain from the controller the following:

  • right of access to his/her own personal data and to other information as mentioned in art. 15 of GDPR; 
  • right to rectification of his/her own personal data when inaccurate and/or their integration when incomplete; 
  • right to erasure (‘right to be forgotten’) of his/her own personal data, except when the University is obliged to data storage to comply with legal obligations or to perform a task in the public interest; 
  • right to restriction of processing as per art. 18 of GDPR.

Moreover data subjects have the right to:

  • object to processing of personal data concerning him or her when allowed;
  • withdraw their consent without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise their rights, data subjects can use the form available on the University web page “Information on the processing of personal data” and send it to the Data Protection Officer: rpd [at] 
This is without prejudice to the right to lodge a complaint with the Supervisory Authority in accordance with art. 77 of GDPR. 

This privacy notice, version 13 March 2019, might vary or be updated.
Data subjects are advised to regularly check it and to refer to the up-to-date version