PRIVACY POLICY AND DECLARATION OF CONSENT FOR THE PROCESSING OF PERSONAL DATA PURSUANT TO ART. 13 OF REGULATION (EU) 679/2016 OF 27 APRIL 2016

The current information notice is issued in accordance with Article 13 of EU Regulation 679/2016 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and in compliance with the law on the processing of personal data and the free movement of such data.

More specifically, this report relates to the PolimiRun Kids 2024, organised as part of the PolimiRun Spring 2024.

Data controller
Politecnico di Milano in the person of the Director General delegated by the pro-tempore Rector – contact: dirgen@polimi.it.

Internal data processor
Dr. Chiara Bianca Pesenti, Campus Life Division Manager, Piazza Leonardo da Vinci 32, Milan (MI), tel. +39 02.2399.2428, e-mail: chiara.pesenti@polimi.it 
The data shall be processed by other persons authorised and instructed for this purpose in accordance with current legislation.

Data Protection Officer and contact details
E-mail: privacy@polimi.it- telephone: +39 0223999378.

Purpose of the processing, legal basis, categories of data and retention period
In accordance with European and national legislation (Regulation (EU) 679/2016 of 27 April, henceforth Regulation), we hereby inform you that personal data provided directly by you shall be used for the following purposes:

Table 1

The data subject to processing, including images and audio/video recordings taken during the event, even if in partial, modified or adapted form, shall be processed in compliance with the Regulation.
The data will be processed, including with the aid of electronic means, by persons specifically appointed to do so, for dissemination and communication activities on Politecnico di Milano’s social networks.
The images collected shall be stored, including in electronic form and on any media, for the purposes and within the limits outlined above and may be disseminated on institutional websites and via social networks (including but not limited to Facebook, Twitter, YouTube and LinkedIn) pursuant to Italian Law No 150/2000. The use of the images does not entitle the data subject to any compensation.
Politecnico di Milano has the right to access or disseminate the images without any consent, under Art. 97 of Italian Law No 633/1941. With this authorisation, you grant a non-exclusive license to use the materials, with no limit of duration and for the whole world, transferable to third parties. This includes the rights referred to in Articles 12 to 19 of the Italian Law No 633/1941, including but not limited to: right of publication; right of reproduction in any manner or form; right of transcription, editing, adaptation, processing and reduction; right of disclosure and distribution to the public, including the rights of projection, transmission and dissemination even in summarised and/or abridged version, by any technical means; right to keep a copy of the materials, also in electronic form and on any known technological support or future invention for the purposes and within the limits defined above. Pursuant to the aforementioned Article and pursuant to Art. 10 and Art. 320 of the Italian Civil Code, the images shall not be used in any way that could prejudice the honour, reputation or dignity of the person portrayed, filmed or recorded.

The data subject shall be required to sign a Disclaimer for the use of images and audio/video recordings. In the case of minors, the same Disclaimer must be signed by at least one of their parents or by their guardian.

Nature of the data
The provision of data is optional.
Refusal to provide the data corresponding to Purpose no. 1 in Table 1 will lead to exclusion in registering and participating in the PolimiRun Kids 2024 event.

Processing methods
For the purposes indicated in Table 1, personal data may be processed on paper or on digital media, manually and/or using electronic or in any case automated instruments on the hard drive of the data centre at Politecnico di Milano. Data may also be stored in paper archives for the duration foreseen for the conservation of documents relating to administrative procedures and indefinitely in digital format in view of the obligations of transparency and the correct operation of public administration.

The data acquired for the purposes indicated in Table 1 shall be accessed by duly authorised staff who have received adequate operational instructions, relevant departments and the support staff organising the event.

Categories of recipients
With regard to Purpose 1, the data may be disclosed to service providers, including external providers, engaged by the Data Controller to organise and hold the event.
In particular, the data collected may be disclosed to the following third party recipients, insofar as they are engaged in various capacities in the event for their own purposes within the context of the initiative or similar events:

• C.S.A.In. (Corporate and Industrial Sports Centres);
• Avaibook Sports, for the collection of registrations for the sporting event;
• A&C Consulting S.a.s. as Data Processor ex Art. 28.

Finally, your personal data may also be disclosed to other public administrations, including in anonymous form in the event that such administrations are obliged to process this data for any proceedings within their institutional competence, as well as to all public entities to which, under the relevant conditions, disclosure is legally required under the provisions of European system, laws or regulations, as well as insurance bodies for any accident reports.

Transfer of data to non-EU countries or international organisations
Personal data will be processed by the Data Controller within the European Union.
Should it become necessary for technical and/or operational reasons to use entities located outside the European Union, or should it become necessary to transfer some of the collected data to technical systems and services managed in the Cloud and located outside the European Union, the processing shall be regulated in accordance with Chapter 5 of the Regulation and authorised on the basis of specific decisions by the European Union.
All of the necessary precautions shall therefore be taken to ensure the maximum protection of personal data, basing the transfer on:

1. adequacy decisions of recipient third countries expressed by the European Commission;
2. appropriate safeguards expressed by the receiving third party under Art. 46 of the EU Regulation;
3. the adoption of Binding Corporate Rules (BCRs).

Rights of data subjects
As a data subject, you can ask the Data Controller for the following at any time:

• confirmation of any personal data held concerning you;
• access to your personal data and related information; the rectification of inaccurate data or the completion of incomplete data; the erasure of personal data concerning you (where one of the grounds indicated in Art. 17, paragraph 1 of the Regulation applies and in accordance with paragraph 3 of the same article); the restriction of processing of your personal data (where one of the grounds indicated in Art. 18, paragraph 1 of the Regulation applies); the transformation of data into anonymous form or the objection to the unlawful processing of data, including data for which storage is not necessary with regard to the purposes for which it was collected or subsequently processed.

As a data subject, you also have the right to object in whole or in part:

• for legitimate reasons, to the processing of personal data concerning you, even if pertinent to the purpose of the collection;
• to the processing of personal data concerning you for the purpose of sending advertisements on courses and cultural events at Politecnico di Milano.

These rights can be exercised by contacting privacy@polimi.it.

If you believe that your rights have been violated by the Data Controller and/or a third party, you have the right to lodge a complaint with the Personal Data Protection Authority and/or other supervisory authority pursuant to the Regulation.

By ticking the appropriate boxes on the online registration form for the PolimiRun Kids 2024 event, the data subject expressly gives his/her free and full consent to the processing of his/her data for each of the purposes indicated in the information notice and within the limits to which his/her consent is required by law, as well as to the communication of his/her data to the persons indicated in the information notice.
In the case of minors, the consent shall be expressed by their parents or by their guardian.

The data subject has the right to withdraw consent at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. Consent can be withdrawn as easily as it is granted.