PRIVACY NOTICE

1. Data Controller, Data Protection Officer (DPO) and Data Processor

The Data Controller is the University of Milan, represented by the Rector pro tempore, via Festa del Perdono n. 7, 20122 Milano, e-mail infoprivacy@unimi.it.

In accordance with Article 37 et seq. of Regulation EU 2016/679 (the GDPR), the University has appointed Prof. Pierluigi Perri, as DPO, c/o “Cesare Beccaria” Department, via Festa del Perdono 3, 20122 Milan, e-mail dpo@unimi.it.

The data processor for provision of riviste.unimi.it platform is the 4Science S.p.A. society, registered office Viale A. Papa 30, 20149 Milano.

 

1. Types of data processed

During normal operation and using automated systems, the IT systems and application procedures that operate the internet sites referred to above acquire the following types of data:

1. browsing data captured during the visit to the website, the transmission of which is implicit in the use of Internet communication protocols, examples here being: IP address for the device connected to the site, type of browser used, name of the internet service provider or ISP, date and time of the visit and the vitor’s referral and exit web page, etc.;
2. browsing data capured using all appropriated mechanisms to reduce the possibility of connecting users being identified, examples here being: type of device used to connect, town connected from and duration of visit to a site, etc.;
3. browsing data collected by the Web Analytics service platform Matomo. Please note that Matomo cookies cannot be used to identify or profile users; 
4. data relating to the browsing session captured via cookies during user browsing of the site; further information about the cookies used on the web portal or by the sites that make up its system can be found in the cookie policy in full as annexed.

1. Purposes of the processing

The data captured is only used for the University’s institutional activities and in order to:

1. allow browsing on the University’s open access journals platform (riviste.unimi.it);
2. provide the user with the information and services required (specific notices in summary form appear on the pages of the portal that deal with specific on-demand services);
3. gather anonymous statistical information on use of the University’s web portal or the connected services, check that it is working properly, conduct monitoring to ensure its security and identify the steps to be taken to improve it (in terms of the browsing data);
4. discharge obligations pursuant to law, comply with orders issued by public authorities, establish liability in the event of cybercrimes committed against the site or its users.

1. Legal basis for the processing

The legal bases for the processing are the following:

• discharge of duties of public interest;
• processing of data to prevent and put a stop to fraud and any other unlawful activity;
• processing required in order to perform a contract that the data subject is a part to;
• the data subject’s consent in accordance with Article 6 (1) of the GDPR.

Provision of the data, and, therefore, consent to the capture and processing of the data, is optional. Users can withhold consent and can withdraw consent previously provided at any time.

Where consenti s withheld, however, this may mean that certain services cannot be provided and may affect the user’s experience when browsing the platform riviste.unimi.it.

1. Manner of processing

The personal data captured is processed in accordance with the principles of lawfulness, fairness and transparency established in Article 5 GDPR, including with the use of IT and telecommunications tools that can store and manage the said data and, therefore, can guarantee its security and ensure maximum confidentiality for the data subject.

1. Use of cookies

Cookies are small text files that a website sends to the browser used to browse online to be stored and sent back to that site on a subsequent visit.

These cookies capture information about a user visiting a website (e.g. date, time, pages visited, time spent on the site, etc.); some of this information can be classed as personal data and is therefore subject to specific provisions of the law.

Please see the attached notice for further details.

1. Categories of parties authorised to carry out processing and to whom the data might be communicated

Users’ personal data will, in accordance with the relevant legislation in force, be disclosed to and processed by the University’s employees and contract staff, as well as with journals’ board members who have access to their Matomo dashboard, (identified as persons authorised to carry out processing) who operate the portal and are involved in providing the services associated with it. 

The data will only be communicated to: 

1. University departments that ask for it for the University institutional purposes or in accordance with legislative requirements; 
2. not-for-profit public bodies or consortiums that the University has an interest in (e.g. MUIR - the Ministry for Education, Universities and Research) where necessary so that the organisation requesting the data can perform its institutional duties;
3. external parties, identified as processors pursuant to Article 28 of the GDPR, with an up-to-date list of the same available to the data controller at any time;
4. the authorities responsible for public order and safety or other public bodies for the purposes of defence, State security and criminal investigations or the judicial authorities in accordance with obligations pursuant to law, where criminal offences are suspected.

For the purposes of the processing of the data required in order to carry out their duties and responsibilities, the data may come to the attention of the individuals (employees or contract staff) authorised by 4Science, being the data processor.

Other than in the above cases, the personal data will not be communicated or circulated to third parties in any manner or for any reason.

Finally personal data will not be transferred to third countries or international organisations unless strictly relating to specific requests by the user, for which the appropriate consent will be obtained.

1. Storage period

Where the various reasons and purposes for which it is collected are concerned, the data will be stored for the period of time established by the relevant legislation or for such period of time as is strictly necessary in order to the purposes to be achieved.

1. Rights of the Data Subject

In the appropriate cases, data subjects have the right to obtain, from the University of Milan, access to their personal data and to have that data rectified or erased or to restrict the processing data concerning them or object to such processing (Article 15 et seq. of the Regulation).

Requests should be submitted to the Data Protection Officer (Data Protection Officer, Via Festa del Perdono 7, 20122 Milan - e-mail: dpo@unimi.it).

10. Right to complain

Data subjects who consider that the processing of their personal data via this site is in breach of the provisions of the Regulation are entitled to lodge a complaint to the Data Protection Authority in accordance with Article 77 of the Regulation or to bring proceedings in the appropriate courts (Article 79 of the Regulation).

1. Third parties

The University’s open access journals platform (riviste.unimi.it) uses 'third parties'' content and services as a result of the incorporation of external resources or the implementation of technologies to increase functionality and improve users' browsing experience.

As a result, while they are browsed, certain technical and/or profiling cookies are sent by third parties to the terminal that the users are on, without the data controller being aware or being able to intervene, such as:

Google Fonts (https://developers.google.com/terms/api-services-user-data-policy) – Google Fonts is a service that allows fonts to be loaded to enhance the appearance of a website through the use of style sheets. The service is managed by Google Inc. The use of Google Fonts does not require authentication.

Data traffic analysis via Matomo (cookies used by Matomo: https://matomo.org/faq/general/faq_146/)

For further information on the services listed above and to understand how to opt-out (erasure), please see the corresponding privacy policies.

1. Changes to the information

This information may be changed over time. You should therefore check that you are looking at the latest version by going to the Privacy section on riviste.unimi.it main page.

 

COOKIES

The open access journals platform of the University of Milan (riviste.unimi.it) does not collect users’ personal data.

No cookies are used to transmit personal information or track users. A persistent cookie is only used following registration and user authentication in the Personal Area, solely to enable the provision of services reserved for registered users.

The use of so-called session cookies (which are not persistently stored on the user’s computer and disappear when the browser is closed) is strictly limited to the transmission of session identifiers (consisting of randomly generated numbers by the server) necessary to ensure secure and efficient navigation of the site.

Cookies are not used for specific profiling purposes or for purposes other than those set out here. Profiling cookies or cookies with purposes other than those mentioned here may, however, be installed when the third-party services listed in paragraph 11 of the Privacy Notice are used.

First-party technical cookies

The websites mentioned above use technical cookies (browsing, functionality, session and/or persistent cookies) or similar in order to operate and be viewed correctly, allow authentication for reserved areas or improve the user experience (e.g. by storing a user's language preference or saving their back-end access credentials for next time).

As no consent is required for their installation, these cookies will always be used and sent to the browser in use unless the user changes their settings (with the result that correct use of the services or the content made available will be hampered).

Name	Domain	Source	Function / Data captured	Expiry
OJSID	riviste.unimi.it	OJS	Cookie used to manage the authenticated user’s session	session

 

Monitoring cookies

The riviste.unimi.it platform uses Matomo to monitor traffic on the sites hosted by the platform. The cookies used by Matomo do not allow user identification or profiling, and users can always choose to enable or disable cookies.

Name	Domain	Source	Function / Data captured	Expiry
_pk_id	riviste.unimi.it	Matomo	It stores the unique visitor ID	13 months
_pk_ses	riviste.unimi.it	Matomo	It stores data for the visit	30 minutes
_pk_ref	riviste.unimi.it	Matomo	It stores attribution information (the referrer that brought the visitor to the website)	30 minutes
_pk_testcookie	riviste.unimi.it	Matomo	Temporary cookie to check if a visitor's browser supports cookies (set only in Internet Explorer)	30 minutes

 

 

Third-party cookies

As referred to in paragraph 10 of the Privacy Notice relating to the University portal's internet sites system, this web application uses certain functionalities provided by other organisations ('third parties') to improve the user's browsing experience.

As a result of specific extensions being installed (modules, plugins or widgets) or content hosted on external platforms being incorporated, third-party cookies might be sent to and from any sites that do not belong to the University.

In order to use this type of cookie, the data subject's consent is required in advance; this consent can be revoked at any time by following the instructions in paragraph 5 of this notice.

The information captured by 'third parties' cannot be accessed by the data controller.  In terms of how this information is handled, please refer to the relevant notices.

Name	Domain	Source	Function / Data captured	Expiry
CookieScriptConsent	riviste.unimi.it	cookie-script.com/	It stores cookie preferences	30 days