1. INTRODUCTION
UNISER SOCIETA’ COOPERATIVA SOCIALE O.N.L.U.S. («Uniser»), with an address for service in Forlì (FC), Piazzale della Vittoria 17, P.IVA 02622940407, n. FO-282271 in the commercial registry of Forlì-Cesena, that can be contacted via e-mail at privacy@uniser.net, will process personal data provided by the participants in learning mobility projects («Users») in conjunction with a participation contract, included the pre-contractual phase («Contract»), for the participation in the educational activities and/or educational services, unless a different information about the processing of personal data is provided in the same context of those («Services»).

2. TO WHOM AND WHAT DOES THIS PRIVACY INFORMATION APPLY?
Uniser is the processing’s controller with reference to personal data, obtained by the User, that are processed in accordance with the terms of this Information and with the applicable law. Consequently this Information applies to all the Users.

3. WHAT KIND OF CLIENTS’ PERSONAL DATA ARE COLLECTED BY UNISER?
Uniser collects the following categories of personal data:
a) name, surname, gender, contact details (e-mail, phone number, home address);
b) place and date of birth;
c) social security number;
d) identity document (identity card, passport, health card and/or drive license);
e) bank details (credit card or bank account details);
f) resume informations.

4. WHAT ARE USERS’ PERSONAL DATA PROCESSED FOR?
Uniser processes Users’ personal data for the following purposes:
a) the provision of the Services derived from the Contract;
b) the analyses and the improvement of the Services;
c) the compliance with the national and european applicable legislation, including money-laundering and fraud laws.
d) the management of complaints and controversies;
e) asserting and defending our own rights, also within procedures of debt collection and allocation of grants to authorised companies, even through third party;
f) carrying out a possible merger, transfer of assets, transfer of holdings or parts of holdings, disclosing and transferring the User personal data to the involved third party;
g) with the previous consent of the User, sending communication of services provided by Uniser (e.g. by means of promotional materials, implementing market research). Marketing communications can be sent both by traditional communications means such as paper mail or e-mail, chat, SMS, MMS, instant message;
The purposes from a) to e) are jointly defined «Contractual Purposes».
The purpose f) is defined «Purpose of Legitimate Interest».
The purpose g) is moreover defined «Marketing Purpose».
Users personal data will never be subject to dissemination nor any entirely automated decision-making process, including profiling.

5. WHICH ARE THE LEGAL BASES FOR THE PERSONAL DATA PROCESSING CARRIED OUT BY UNISER?

Users personal data processing is necessary with reference to the Contractual Purposes and it’s essential to the aims of:
a) performing the Contract with reference to the provision of requested Services and/or to the participation in educational activities;
b) complying with the dispositions of the applicable legislation in accordance with Section 4, d) and e).
If the User doesn’t provide personal data required for the Contractual Purposes, it will not be possible to proceed to stipulate the Contract with the User on the part of Uniser.
The User personal data processing to the Purposes of Legitimate Interest, Section 3, f) is performed in accordance with article 24, paragraph 1, d) of Legislative Decree 196/2003 («Codice Privacy») and, with effect from 25th May 2018, according to article 6, f) of the general European Regulation on Data Protection 2016/679 (the «Privacy Regulation») for the pursuit of the legitimate interest of Uniser that is equally balanced with the interest of the User, since the activity of personal data processing is limited to what is strictly necessary to perform the required economic operations.
The processing for the Legitimate Interest Purposes is not compulsory and the User could oppose to such processing within the modalities referred to in the following Section 9, but if the User opposes to such processing, his/her data cannot not be used for the Purposes of Legitimate Interest.
Finally, the processing is optional for the Marketing Purposes. If the User denies his/her consent he/she could not receive commercial communications referred to in Section 4, h) and i). At any time, the User will be able to revoke the given consents in accordance to the modalities referred to in the following Section 9 of this Privacy Information.

6. HOW DOES UNISER PROCESS USERS PERSONAL DATA?

Users personal data can be processed with manual and digital tools, liable to guarantee their security, their confidentiality and to avoid not authorised accesses, disclosure, data’s modifications and removals, thanks to the adoption of proper mesures of security that are technical, fisical and organisational.

7. WHO CAN ACCESS TO USERS PERSONAL DATA?
For the Contractual Purposes above specified, Users personal data can be transferred to the following categories of receivers, located inside and, within the limitations referred to in the following Section 8, outside of the European Union:
a) third party providers of assistance and consulting services for Uniser with reference to the activities of technological, accounting, administrative, legal, insurance, IT, educational areas (purely by way of example)
b) Banks and institutions for the emission of credit cards;
c) public and private institutions with educational purposes taking part to the activities that represent the subject of the Contract;
d) companies of Uniser group;
e) Uniser commercial network;
f) subjects and authorities whose right of access to Users personal data is explicitly recognised by the Law, by Regulations or by Measures enacted by competent authorities. Such receivers, depending on the circumstances, will process the personal data as controllers, responsible or in charge of the processing.
For the Purposes of Legitimate Interest above specified, Users personal data can be transferred to the following categories of receivers, located inside and, within the limitations referred to in the following Section 8, outside of the European Union:
a) third party providers of assistance and consulting services for Uniser with reference to the activities of debt collection and allocation of grants;
b) companies of Uniser group;
c) possible buyers of Uniser and subjects deriving from merging, division or any other form of transformation regarding Uniser;
d) competent authorities.
For the Marketing Purposes above specified, Users personal data can be transferred to the following categories of receivers, located inside and, within the limitations referred to in the following Section 8, outside of the European Union:
a) third party providers of assistance and consulting services for Uniser with reference to the activities of sending commercial communications;
b) public and private institutions with educational purposes taking part to the activities that represent the subject of the Contract;
c) companies of Uniser group.
The external responsibles for processing named by Uniser are available, if requested, by means specified in the following Section 9.

8. CLIENTS’ PERSONAL DATA ARE TRANSFERRED ABROAD?
Users personal data can be freely transferred out of national territory to Countries located inside the European Union. With reference to transfers outside the EU territory to Countries considered not conform to the European Commission, Uniser adopts conform and proper security measures to protect Users personal data. Consequently the possible transfer of Users data to Countries located outside the EU will take place, anyway, in compliance with the garantees specific to the purpose of the transfer itself, such as the model contractual clauses for data protection, in accordance to the applicable law and in particular to the articles 45 and 46 of Privacy Regulation.
Conseguentemente l’eventuale trasferimento dei dati degli Utenti in Paesi situati al di fuori dell’Unione europea avverrà, in ogni caso, nel rispetto delle garanzie appropriate e opportune ai fini del trasferimento stesso, come le clausole contrattuali tipo di protezione dei dati, ai sensi della normativa applicabile e in particolare degli articoli 45 e 46 del Regolamento Privacy.

9. WHICH ARE THE RIGHTS OF THE USERS REGARDING THEIR PERSONAL DATA?
The User can, at any time and free of charge, by sending an e-mail to privacy@uniser.net, exert the following rights:
a) to obtain from Uniser the confirmation of the existence of data regarding him/herself and to be informed about the content and the source of the data, to verify their accuracy and request their integration, update or modification;
b) to obtain the cancellation, the transformation in anonymous form or to block the data possibly processed in violation of applicable Law;
c) to oppose totally or partially, for legitimate reasons, to the processing;
d) to revoke, at any time, the consent to data processing (in relation to those processings for which such consent is necessary), without this affecting in any way the lawfulness of the processing based on the consent given before the withdrawal;
e) to ask Uniser for the limitation of his/her own personal data processing if: the User contests the accuracy of his/her own personal data, for the duration nedeed by Uniser to verify such accuracy; the processing is illicit and the User opposes to cancellation of his/her own personal data and ask instead for the limitation of use; even though Uniser has no more need for the purpose of processing, the data are necessary to the User to verify, exert or defend a right in court; the User has opposed to processing in accordance to the article 21, paragraph 1, of Privacy Regulation, pending review regarding the possible primacy of the legitimate reasons binding to pursue the processing.
f) to oppose to his/her own personal data processing;
g) to ask for the cancellation of personal data regarding him/herself without unjustified delay;
h) to receive a copy in digital format of his/her own personal data, if the User wants to transfer his/her own personal data to him/herself or to a different provider of services, in the case that Uniser performs the personal data processing based on the User’s consent or based on the circumstance in which the processing is necessary for the provision of the Services and the personal data are processed by automated means;
i) to lodge a complaint with the Data Protection Authority “Garante” (www.garanteprivacy.it)
The responsible for personal data protection has not been named by Uniser since the nomination is not compulsory in the situation described by this information. Here is represented that, according to the article 37 of GDPR, the processing controllers will have to name a person responsible for data protection whenever: a) the processing is performed by an authority, an organisation namely a public institution; b) the main activities of the processing controller and the processing responsible require the regular and systematic large-scale monitoring of the subjects of interest; c) the main activities of the processing controller and the processing responsible consist of the processing, large-scale, of specific categories of personal data referred to in article 9 (Processing of specific categories of personal data) or of data regarding criminal convictions and felonies referred to in article 10 (Processing of personal data regarding criminal convictions and felonies).

10. TERMS OF DATA RETENTION APPLICABLE TO USERS
Users personal data will be retained for the duration of time necessary to pursue the purposes for which such data have been collected, as declared in this Information. In any case the following terms of retention will apply with reference to Users personal data processings for the following purposes:

a) for the Contractual Purposes and the Legitimate Interest Purposes referred to in Section 4, from a) to g), Users personal data are retained for a period of time equivalent to the duration of the Contract (included possible renewals) and for the next ten years after the end, termination or withdrawal of it, except the cases in which the retention for a further period is required for possible litigations, requests of competent authorities or under the applicable legislation;
b) for the Marketing Purposes Users personal data are retained for the duration of the Contract and a period of 24 months after its termination.

11. MODIFICATIONS AND UPDATES
The current Information has been updated on 25th May 2018 and can be subject to modifications and integrations, also as consequence of the applicability of the Privacy Regulation and possible further legislative modifications and/or integrations which will be immediately available on the website www.uniser.net.
Users can view the text of the Information constantly updated on the website www.uniser.net.