LUISS

Information on the processing of personal data pursuant to art. 13 and 14 of Regulation 2016/679 / EU

Pursuant to art. 13 of EU Regulation 2016/679 (hereinafter "GDPR"), the following information is provided, in compliance with the principle of transparency, to make people aware of the characteristics and methods of processing personal data for the purpose of participation in the survey "The food choices of university populations".                                                                                                                                                  

The survey aims to collect information about the knowledge and food choices of university students and university staff, teachers, and non-teachers, of some Italian universities belonging to the Food Working Group of the RUS (Network of Universities for Sustainable Development), in order to implement, subsequently, interventions aimed at promoting healthy diets from sustainable systems for university populations. Luiss is a member of the Food Working Group. The data collected through the questionnaire administered online will highlight the knowledge possessed by the participants on nutrition, preferences, and food choices, as well as their sustainability.

1) Data controller and contact details

The Data Controller is Luiss - Libera Università Internazionale degli Studi Sociali Guido Carli (hereinafter "Luiss") with registered office in Rome, viale Pola n. 12, C. F. 02508710585 and VAT number 01067231009.

Contact details of the Data Protection Officer

The Data Protection Officer, DPO,(in italian Responsabile Protezione Dati-RPD, can be contacted at the following email adress dpo@luiss.it or privacy@luiss.it

2) Purpose of the processing and legal basis

Luiss is a private institution of high culture that acts in implementation of art. 33 of the Italian Constitution.
Luiss will process personal data for the purposes related to research within the Project "Food choices of "university populations"
Luiss will processes personal data following the acquisition of the explicit and unambiguous consent expressed by the data subject for the processing of personal data, pursuant to art. 6 par. 1 letter a) of the GDPR, in accordance with the provisions contained in the Ethical Rules for processing for statistical purposes or scientific research. The project complies with the provisions of art. 6 of the Deontological Rules for processing for statistical or scientific research purposes. The research shall be carried out based on a draft drawn up in accordance with the methodological standards of the relevant disciplinary fields, also in order to document that the processing of personal data is carried out for appropriate and effective statistical or scientific purposes. In the processing of data relating to health, the subjects involved observe the rules of confidentiality and security to which the operators of the health professions are bound or comparable rules of confidentiality and security

3) Types of data processed

The personal data collected and processed by the Data Controller for the purposes indicated above are as follows:

1. personal data;
2. contact details (e-mail) for participation in the prize draw;
3. data concerning personal information.

For the purposes indicated above, personal data of a particular category are collected and processed by the Data Controller pursuant to art. 9 of the GDPR and precisely:

1. health-related data (weight, height, smoking habit, sports practice and frequency, subjective perception of health status, dietary choice, dietary constraints deriving from diagnosed diseases);
2. data on religious denominations.

To preserve the quality of the data collected and the subsequent analysis, the questions must be answered. The respondent may at any time decide to stop filling in and withdraw from the survey. The results will always be aggregated and for groups of participants of at least 50 units.

4) Provision of data

Adherence to the research is free and voluntary, non-participation does not entail any consequences for the interested party.

Participation in the project by the interested party implies the provision of the personal data requested as described in paragraph 4) of this statement. Failure to provide data and failure to adhere to the research project will not allow the realization of the project itself and the consequent obligations

5) Processing methods

The processing of personal data will take place using IT and telematic tools, suitable to guarantee the security and confidentiality of the data. The survey will be managed through LimeSurvey / Uniquest (VERSION 3.0) application hosted by the CINECA Consortium specifically appointed as Data Processor pursuant to art. 28 of the GDPR.

To achieve the above purposes, the data is processed within Luiss by persons authorized to process data under the responsibility of the Data Controller, who are adequately trained and trained for this purpose

6) External data processors

The data could also be communicated and processed externally by third party suppliers of some services necessary for the execution of the processing, who act on behalf of the Data Controller for the sole purpose of the requested service and who will be duly appointed "Data Processors" pursuant to art. 28 of the GDPR. Data storage will take place on Zenodo, as indicated by the Data Management Plan - Survey 1: Food Knowledge of University Populations approved by the RUS Coordination Committee on 13/12/2021. Zenodo will be appointed external manager pursuant to Article 28. Access to the data will only be granted to research personnel who managed the survey by creating a restricted access community.

7) Categories of recipients of personal data

The Data Controller pays specific attention to the definition of the organization, in the identification of the personnel responsible for collecting data by providing adequate instructions on how to carry out processing activities, to ensure compliance with the rules of ethics and the protection of the rights of the interested parties.

Personal data processed in aggregate form will be communicated exclusively to research partners as defined by the Data Management Plan - Survey 1: Food Knowledge of University Populations approved by the RUS Coordination Committee on 13/12/2021. The Data Management Plan is available at https://reterus.it/mappature-e-indagini-gdl-cibo/

8) Data transfer to third country

The University undertakes, for the sole purpose of scientific collaboration with Universities and Research Institutions, to use methods of transfer of personal data in accordance with the provisions of Articles. 44 and  of EU Regulation 2016/679. In particular, the University ensures that adequate technical and organizational measures are prepared so that the processing meets regulatory requirements, the protection of the rights of the interested parties is ensured, data transfers can be traced, and appropriate security measures can be
 documented.

9) Data retention period

Personal data are kept for the time strictly necessary for the pursuit of the purposes of the processing (in compliance with the principle of necessity and purpose of the processing): and therefore will be deleted at the end of 5 years.

10) Data rights
The interested party can exercise free of charge the rights on personal data provided for by articles 15 et seq. of the GDPR where applicable, by sending a specific request concerning: "Privacy rights" to the e-mail address privacy@luiss.it and for information to the Scientific Manager of the project.
The interested parties pursuant to art. 7 par. 3 of EU Regulation 2016/679 have the right to revoke at any time the consent given previously and at the same time exercise the right to delete their personal data as established by art. 17 of the GDPR.
The withdrawal of consent does not affect the lawfulness of the processing based on the consent obtained before such revocation.

11) Complaint
The interested party has the right to lodge a complaint with the supervisory authority and can contact the Data Protection Authority: https://www.garanteprivacy.it/.

12) Profiling
The Data Controller of personal data does not use automated processes aimed at profiling.
 

Having acquired the above information, it is recalled that joining the survey means:

• having read and understood the information on the processing of personal data and adhering freely and voluntarily to the survey;
• giving one's consent to the processing of one's personal data for the purposes and in the manner described in this notice