Data controller:

Sapienza University of Rome in the person of its pro tempore legal representative.

Contact details:

Email: rettoresapienza@uniroma1.it

PEC: protocollosapienza@cert.uniroma1.it

Data protection officer:

Contact details:

E -mail: responsabileprotezionedati@uniroma1.it

PEC: rpd@cert.uniroma1.it

Manager/ Structure Representative:

Dr Monica Facchiano – Director of Area Appalti e Approvvigionamenti

Contact details:

E -mail: direzione.apse@uniroma1.it

Legal basis of processing:

Art. 6 (b), European Regulation No. 679/2016 (GDPR)

Purpose and description of processing:

The data is processed, in compliance with the regulatory framework in force, by the Ufficio Economato e gestione Beni e Servizi – Settore Servizi Economali in order to conclude and execute online sale agreements of Sapienza Merchandising products, through the website https://web.uniroma1.it/merchandising, between Sapienza University of Rome and any natural or legal person customer.

In detail, data are collected and processed to acquire and manage purchase orders. For this purpose, data such as name and surname, tax code, email address, telephone number, shipping address (of the purchaser or any recipient of the order other than the purchaser) and payment identification code generated by the PagoPA system are processed.

Nature of personal data strictly necessary for the purposes described:

Common personal data

Disclosure and

consequences of a

possible refusal

Communication of personal data is necessary for the

achievement of the activities described above. Any failure to

communicate such data by the person concerned determines

the impossibility of concluding and executing the sale agreement

with Sapienza University of Rome.

Archiving and storage:

As per national and European legislation, data will be kept for a period not exceeding Sapienza's achievement of the purposes mentioned above.

Specifically, data related to the order of a product will be kept for the duration of the contractual relationship pertaining to the management of the order itself and, after that, for a period not exceeding the statute of limitations provided for by law.

The management and storage of personal data collected for the purposes set out in this information sheet take place on an external server. The supplier learns about the personal data only for the processing. The supplier is qualified as a Data Processor according to Article 28 of the GDPR.

If the purchaser has requested shipment of their products, the shipping data are processed by the company entrusted with the shipping service for Sapienza Merchandising orders to be qualified as Data Processor pursuant to Article 28 of the GDPR.

Data subject rights:

Please note that the interested party may request from the data controller, under specific conditions, access to personal data pursuant to art. 15 of the Regulations, rectification of the same under art. 16 of the Regulations, cancellation of the same according to art. 17 of the Regulations, the cancellation of the data (where this does not conflict with current legislation on data storage and with the need to protect, in the event of legal disputes, Sapienza and the professionals who have processed the data) or the limitation of processing pursuant to art. 18 of the Regulations, or you may object to their processing under art. 21 of the Regulations, as well as being able to exercise the right to data portability pursuant to art. 20 of the Regulations.

In the event of a violation of the Regulation, the data subject may lodge a complaint with the “Garante per la protezione dei dati personali” (Italian Data Protection Authority) following the legislation in force.

Interested parties:

Interested party is the natural or legal person who has concluded an online sale agreement with Sapienza University of Rome through the website https://web.uniroma1.it/merchandising.

Categories of recipients:

Data may be communicated to third parties, in accordance with national and European legislation in force.

In particular, in the event of shipments, the data will be communicated to the Company FDC Services S.r.l. carriers to carry out shipments.

Transfers of personal data to third countries:

Data will not be disclosed abroad, except if the buyer specifically requests for the product to be shipped abroad.