Privacy policy on images/photos/video/audio footage pursuant to Art. 13 of Legislative Decree no. 196/2003 and Art. 13 and 14 of EU Regulation 2016/679 (GDPR) 

Pursuant to Article 13 of  EU Regulation 2016/679,  with regards to the creation of videos and promotional and multimedia material, The American University of Rome informs students and participants featuring in videos and promotional and multimedia material that the processing of data acquired will be handled in compliance with the general principles of EU Regulation 2016/679 of lawfulness, correctness, transparency, adequacy, relevance and necessity, with appropriate technical and organizational measures so as to protect the confidentiality and rights of users.  

The Data Controller is The American University of Rome based in Rome, Via Pietro Roselli n. 4, e-mail: [email protected]. The Data Protection Officer (DPO) is Loredana Passaretti, Esq., with offices in Rome, Via Appia Nuova n. 59, e-mail: [email protected].  

Purposes of data processing - legal basis: the data will be processed by the University in the pursuit of its institutional, research, cultural, educational and dissemination purposes pursuant to art. 6 lett.  a) and f) of EU Regulation 2016/679, in order to prepare videos and multimedia material to be used as an educational, cultural, promotional and dissemination tool about the activities of the University, publishing and disseminating the images on university platforms (e.g. University website and related sites, official social networks), printed media (e.g. magazines, books, brochures and promotional material of the University) and for display at future events. The provision of data (images) for institutional/educational/research/cultural purposes responds to the University's legitimate interest in pursuing its institutional purposes.  

Providing data for dissemination/promotional purposes is optional. Consent/authorization is expressed: a) on the occasion of the confirmation of participation in the Commencement ceremony through the provision of the names of those graduating and of their attending guests; b) during the event, through the voluntary act of visiting the event spaces in which a photo or video shooting has been activated and where the person concerned can reasonably expect to be, even if only incidentally, the subject of video and photo shoots. These spaces will be identified with appropriate information/posters. No video or audio recordings will be made for other purposes, nor will different data be kept beyond what is necessary. Attendance of the Commencement event therefore implies granting of non-exclusive, unlimited in time and place license, transferable to third parties, for the use of the materials, and includes the rights under Law no.    633 of 22 April 1941, including but not limited to: right of publication; right of reproduction in any way or form; right of transcription, editing, adaptation, processing and reduction; right of communication and distribution to the public, including the rights of projection, transmission and diffusion, even in summary and/or reduced version, by any technical means, the right to keep a copy of the materials, even in electronic form and on any known or future technological support. Any use of the portrait that may cause damage to the honor, reputation or decorum of the person portrayed, filmed or recorded is in any case excluded. Personal data and contact details (telephone, email, etc.) useful for contacting the subjects in order to plan or collect the filming and photographs or IP addresses and email in case of videoconferences may be processed. Minors, are kindly requested to read the information carefully together with their parents or guardians prior to communicating their data to the University.  

Categories of subjects to whom the data may be communicated or who may become aware of the data in their capacity as Data Processors or Persons in Charge. Recipients of the data: The personal data of users may be known and processed, in compliance with current legislation on the subject, by staff and collaborators of the competent offices of the University, authorized and adequately instructed by the Data Controller, or by service providers expressly appointed as external data processors (in accordance with Article 28 of the GDPR). The data may be provided to the judicial authorities in the cases provided for by law.  

Data storage: The determination of the period of storage of personal data responds to the principle of necessity of the treatment.  With regard to personal data entered in the information systems, reference is made to the principles set out in Article 5 of EU Regulation 2016/679, for a period of time not exceeding the achievement of the purposes and with specific regard to the principle of limitation of storage in Article 5, letter "e" of EU Regulation 2016/679. The management and storage of personal data collected by the University takes place both on servers located within the University and on external servers of suppliers of support services for the management and organization of the event in online mode with which the University has agreements in place.  

Rights of the Data Subject: Data subjects have the right to obtain from the Data Controller, in the cases provided for, access to their personal data and the rectification or erasure of the same or the limitation of the processing that concerns them or to object to the processing (Articles 15 et seq. of EU Regulation 679/2016).  The appropriate application may be sent to the contact data indicated above. The data subjects, given the prerequisites, also have the right to lodge a complaint with the supervisory authority according to the procedures provided for in Regulation (EU) 2016/679. 

The data may be provided to the judicial authorities in the cases provided for by law. Conservation: The determination of the period of conservation of personal data responds to the principle of necessity of the treatment.  With regard to personal data entered in the information systems, reference is made to the principles set out in Article 5 of EU Regulation 2016/679, for a period of time not exceeding the achievement of the purposes and with specific regard to the principle of limitation of storage in Article 5, letter "e" of EU Regulation 2016/679. The management and storage of personal data collected by the University takes place both on servers located within the University and on external servers of suppliers of support services for the management and organization of the event in online mode with which the University has agreements in place. Rights of the Data Subject: Data subjects have the right to obtain from the Data Controller, in the cases provided for, access to their personal data and the rectification or erasure of the same or the limitation of the processing that concerns them or to object to the processing (Articles 15 et seq. of EU Regulation 679/2016).  The appropriate application may be sent to the contact data indicated above. The data subjects, given the prerequisites, also have the right to lodge a complaint with the supervisory authority according to the procedures provided for in EU Regulation 2016/679.