Privacy Policy
This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 («GDPR») and to Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018. It describes how personal data of visitors to www.ibsbc.cnr.it are processed.
Controller and Data Protection Officer
Data Controller
National Research Council of Italy (CNR)
Piazzale Aldo Moro, 7 — 00185 Rome, Italy
Tax code 80054330586 · VAT 02118311006
Competent unit
Institute of Bioimaging and Complex Biological Systems (IBSBC)
LITA Building, Via F.lli Cervi 93 — 20054 Segrate (MI), Italy
Acting Director: Gloria Rita Bertoli — direzione.ibsbc@cnr.it
IBSBC privacy contact point
Dr Francesca Gallivanone — privacy.ibsbc@cnr.it
Data Protection Officer (DPO)
Dr Raffaele Conte — rpd@cnr.it
Scope
This notice applies only to www.ibsbc.cnr.it. It does not apply to other websites, subdomains, portals or platforms reachable through links on these pages, even where operated by the same organisation: those resources are governed by their own notices.
The website links to external resources, including the Council’s document platforms, bibliographic databases, social media channels and third-party institutional sites. The Controller exercises no control over processing carried out by those parties: once an external link is followed, the notices of the relevant operators apply.
For processing of administrative data and of data related to the Institute’s scientific research activities, please refer to the Privacy section published under Transparent Administration.
Data processed
Browsing data
The systems and software procedures used to operate this website acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols:
- IP address and domain name of the device used
- browser and operating system type and version
- date, time and duration of the request
- URI of the requested resources and response status code
These data are used solely to obtain anonymous statistical information on the use of the website and to monitor its correct operation and security. They are not associated with identified users and are not used for profiling.
Data provided voluntarily
The website does not host contact forms or any data collection forms. Published email addresses are made available so that users may contact the Institute: sending a message is entirely optional and entails the acquisition of the sender’s address and of any data contained in the communication, processed solely in order to reply.
Restricted area
The website includes a restricted area reserved for internal Institute staff for content management. Access involves the processing of credentials and authentication data of authorised users only. The area is not intended for the public or for external parties.
Purposes and legal basis
Processing related to the website is carried out in the performance of tasks in the public interest and in the exercise of official authority vested in the Controller, pursuant to Article 6(1)(e) GDPR, in relation to the institutional aims set out in Article 2 of the CNR Statute.
| Purpose | Legal basis |
|---|---|
| Operating the website and disseminating information on institutional and research activities | Art. 6(1)(e) — public interest task |
| Website security, prevention of misuse and ascertainment of liability in the event of computer crime | Art. 6(1)(e); Art. 6(1)(c) for legal obligations |
| Replying to communications sent to published addresses | Art. 6(1)(e) — public interest task |
| Management of the restricted area and of content by authorised staff | Art. 6(1)(e) — public interest task |
Provision of browsing data is necessary for the website to function. Sending messages to published addresses is optional; not doing so simply means no reply can be given.
Third-party services
Following a technical review of the website, no third-party services are present that would involve transmission of data to external parties. In particular, the website:
- uses no analytics or traffic measurement tools
- uses no tag management or advertising systems
- embeds no videos, maps or content hosted on external platforms
- loads no fonts, libraries or resources from external content delivery networks: all resources are served from the website’s own domain
- uses no social buttons or sharing widgets: references to institutional channels are plain hyperlinks
The only party processing data on behalf of the Controller in connection with the website is the supplier responsible for technical management, identified in section 01, operating within the Council’s own infrastructure.
Retention
| Category | Retention period |
|---|---|
| Web server technical logs | For the time strictly necessary for security purposes and in any case no longer than the periods provided for by applicable law |
| Technical session cookies | Until the browser is closed |
| Technical preference cookies | See the Cookie Policy |
| Communications received at published addresses | For as long as needed to reply and, where applicable, in accordance with the rules on document retention for public administrations |
Transfers outside the EU
Data are processed on infrastructure of the National Research Council located within the European Union. No personal data are transferred to third countries or international organisations.
Your rights
Data subjects have the rights set out in Articles 15 and following of the GDPR:
Requests may be addressed to the Institute’s privacy contact point at privacy.ibsbc@cnr.it or to the CNR Data Protection Officer at rpd@cnr.it.
The right to data portability (Art. 20) does not apply to processing based on Article 6(1)(e). Without prejudice to any other administrative or judicial remedy, data subjects may lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement. In Italy the competent authority is the Garante per la protezione dei dati personali (garanteprivacy.it).
Changes
This notice may be updated following changes to the website or developments in applicable law. The date of the latest revision is shown at the top of this document; previous versions are retained by the Controller.