Processing of Personal Data (Privacy Policy)

Service Name

Identity Provider

Service Description

The federated authentication service allows users to access federated Resources using their institutional credentials. The Resources may be provided through the Italian Federation of Identity of Universities and Research Institutions (IDEM), or directly. The federated authentication Service is responsible for authenticating the user and issuing an authentication token and, if requested, a minimal set of personal data for access to the Resource.

Data Controllers

The data controller is the Politecnico di Bari, with registered office at Via Amendola 126/b, 70126 Bari, represented by the Rector pro tempore.
As of the date of update of this page, the Rector of the Politecnico di Bari is Prof. Umberto Fratino.
Data Controller PEC: politecnico.di.bari@legalmail.it

Data Protection Officer (GDPR Section 4)

The Data Protection Officer monitors compliance with legislation on privacy and data protection, provides advice to the University, cooperates with the Supervisory Authority, and serves as the point of contact for all data subjects who wish to exercise their rights pursuant to Regulation (EU) 2016/679 (GDPR).

• Name: Eng. Carlo GIANSANTE
• Email: rpd@poliba.it
• PEC Email: politecnico.di.bari@legalmail.it
• Telephone: 080 5962518
• Address: Via Amendola 126/b - 70126 Bari (BA)

Jurisdiction and supervisory authority

IT-IT Data Protection Authority https://www.garanteprivacy.it

Categories of direct and indirect personal data processed and legal basis for processing

• one or more unique identifiers;
• recognition credential;
• first and last name;
• email address;
• role within the organization;
• specific rights on resources;
• name of the affiliated organization;
• IdP service log records: user identifier, date and time of use, requested Resource, transmitted attributes;
• Log records of the services necessary for the operation of the IdP service.

The personal data collected are stored in Italy in compliance with the GDPR. Their processing is aimed at providing the authentication service. The legal bases for the processing of the data are the provision of the authentication service (performance of contractual obligations) and the legitimate interest of the controller.

Purposes of personal data processing

To provide the federated authentication service in order to access the Resources requested by the data subject. To verify and monitor the proper functioning of the service and ensure its security (legitimate interest). To comply with any legal obligations or requests from the judicial authority.

Third parties to whom the data are disclosed

The data controller, in order to properly provide the service, communicates to the providers of the Resources to which the User intends to access the proof of successful authentication and only the personal data (attributes) requested, in full compliance with the principle of minimization. Personal data are transmitted only when the data subject requests access to the third party's Resource. For purposes related to the legitimate interest of the Controller or compliance with legal obligations, some log data may be processed by third parties (e.g. CERT, CSIRT, Judicial Authority).

Exercise of data subjects' rights

Contact the data controller at the contact details indicated above to request access to personal data and rectification or erasure of the same or restriction of processing concerning them, or to object to their processing, or to exercise the right to data portability (Articles 15 to 22 of the GDPR).

Withdrawal of the data subject's consent

The only data collected with the data subject's consent are the preferences regarding the display of attributes transmitted to the Resources. Preferences are collected at the time of first access to the Resource and may be modified later by starting the access procedure again.

Data Portability

The data subject may request the portability of their data relating to the federated authentication service, including preferences regarding the display of attributes transmitted to the Resources, which will be provided in open format and pursuant to Art. 20 of the GDPR. The data portability service is free of charge.