PRIVACY POLICY
1. Data Controller, Data Protection Officer (DPO), Data Processor
The Data Controller is the University of Milan (Università degli Studi di Milano), represented by the Rector pro tempore, via Festa del Perdono no. 7, 20122 Milan, e-mail infoprivacy@unimi.it.
Pursuant to Articles 37 et seq. of EU Regulation 2016/679 (GDPR), the University has appointed a Data Protection Officer (DPO), identified as Avv. Prof. Pierluigi Perri,
c/o "Cesare Beccaria" Department, via Festa del Perdono no. 3, 20122 Milan, e-mail: dpo@unimi.it.
The Data Processor responsible for providing the services of the riviste.unimi.it platform is the company Archimede Informatica Società Cooperativa, with registered office in Pisa, via Livia Gereschi 36, 56127.
2. Types of Data Processed
The computer systems and software applications used to operate the aforementioned websites acquire, during their normal operation and in an automated manner, the following types of data:
- browsing data collected during visits to the website, the transmission of which is implicit in the use of Internet communication protocols. For example: IP address of the device connected to the site, type of browser used, name of the Internet Service Provider (ISP), date and time of visit, referring and exit web pages, etc.;
- browsing data collected through the Matomo Web Analytics platform, using every reasonable measure to reduce the possibility of identifying users who connect to it. For example: type of device used to connect, city of connection, duration of the visit to a site, etc. The cookies used by Matomo do not allow identification or profiling of the user.
- data collected through cookies during users' browsing activity on the site. For further details on the cookies used by the website, please refer to the extended cookie policy attached to this document.
4. Purpose of Processing
The data collected is used exclusively within the scope of the University's institutional activities for the following purposes:
- to enable navigation of the University's Open Access journals platform (riviste.unimi.it);
- to provide users with the information and services requested (specific summary notices are provided on the portal pages set up for particular services upon request);
- to obtain anonymous statistical information on the use of the journals platform, to monitor its correct functioning, to carry out monitoring activities in support of its security, and to identify actions aimed at its improvement (for browsing data);
- to fulfill legal obligations, to comply with orders from Public Authorities, and to establish any liability in the event of alleged computer crimes against the site or its users.
5. Legal Bases of Processing
The legal bases for processing may be identified as follows:
- performance of tasks carried out in the public interest;
- processing of data useful for the prevention and suppression of any fraud and any illegal activity;
- processing necessary for the performance of a contract to which the data subject is a party;
- consent of the data subject pursuant to Art. 6(1) GDPR.
Providing data, and therefore consenting to its collection and processing, is optional. Users may withhold consent, and may revoke consent already given at any time.
However, withholding consent may make it impossible to provide certain services, and the browsing experience on the riviste.unimi.it platform could be compromised.
6. Methods of Processing
Personal data collected is processed in compliance with the principles of lawfulness, fairness, and transparency set out in Art. 5 GDPR, including with the aid of IT and telecommunications tools used to store and manage the data, and in any case in such a way as to ensure security and protect the maximum confidentiality of the data subject.
7. Use of Cookies
Cookies are small text files that a website sends to the browser used for browsing the internet, to be stored and retransmitted to the same site on the next visit.
Through cookies it is possible to collect information relating to a user who visits a website (e.g., date, time, pages visited, time spent on the site), some of which may fall within the definition of personal data and therefore be subject to specific legal provisions.
Please refer to the cookie notice attached to this document.
8. Categories of Persons Authorized to Process Data and to Whom Data May Be Disclosed
Users' personal data will be known and processed, in compliance with applicable regulations, by University employees and collaborators (identified as Authorized Processors) responsible for managing the website and involved in providing the associated services.
The data may be disclosed exclusively to:
- University departments that request it, for the University's institutional purposes or in compliance with legal obligations;
- non-economic public bodies or consortia in which the University participates (e.g., MIUR) when disclosure is necessary for the performance of the institutional functions of the requesting body;
- any external parties, identified as Data Processors pursuant to Art. 28 GDPR, an updated list of which is always available from the Controller;
- Public Security Authorities or other public bodies for purposes of national defense, State security, and the investigation of crimes, or to the Judicial Authority in compliance with legal obligations, where there are indications of a crime.
For the purposes of processing data necessary to carry out their duties, the data may be accessed by individuals (employees or collaborators) authorized by the University of Milan, represented by the Rector pro tempore, as Data Processor.
Outside of the aforementioned cases, personal data is in no way and for no reason disclosed or disseminated to third parties. Finally, personal data will not be transferred to third countries or international organizations, unless this is strictly connected to specific requests made by the user, for which specific consent will be obtained.
9. Data Retention Period
Depending on the various purposes and objectives for which it was collected, data will be retained for the period provided for by applicable regulations, or for the period strictly necessary to achieve the relevant purposes.
10. Rights of the Data Subject
Data subjects have the right to obtain from the University of Milan, in the cases provided for, access to their personal data, and rectification or erasure of the same, or restriction of the processing concerning them, or to object to the processing.
Requests should be submitted by contacting the Data Protection Officer (Data Protection Officer, via Festa del Perdono, 7, 20122 Milan – e-mail: dpo@unimi.it).
11. Right to Lodge a Complaint
Data subjects who believe that the processing of their personal data carried out through this site violates the provisions of the Regulation have the right to lodge a complaint with the Data Protection Authority (Garante), or to bring the matter before the competent courts.
12. Third Parties
The University's journals platform (riviste.unimi.it) makes use of content and services from "third parties" as a result of incorporating external resources or implementing technologies capable of expanding its functionality and improving the browsing experience of its users.
It is therefore possible that, while browsing the site, some technical and/or profiling cookies may be sent by third parties to the terminal used by users, including:
Google Fonts (https://developers.google.com/terms/api-services-user-data-policy) — Google Fonts is a service that allows fonts to be loaded to improve the site's appearance through the use of style sheets. The service is managed by Google Inc. Use of Google Fonts does not require authentication.
To find out how to opt out (delete), please refer to the corresponding privacy notices.
13. Changes to This Notice
This information may be modified over time. It is therefore recommended to check that you are referring to the most up-to-date version by accessing the Privacy section of the riviste.unimi.it platform.
COOKIES
The University's Open Access journals platform (riviste.unimi.it) does not acquire users' personal data. No cookies are used to transmit personal information, nor to track users. A persistent cookie is used only following registration and user recognition in the Personal Area, solely for the purpose of enabling the provision of services reserved for registered users. The use of so-called session cookies (which are not stored persistently on the user's computer and disappear when the browser is closed) is strictly limited to the transmission of session identifiers (consisting of random numbers generated by the server) necessary to enable safe and efficient browsing of the site.
No cookies are used for explicit profiling purposes or for purposes other than those declared here. However, profiling cookies or cookies with purposes other than those declared here may be installed as a result of the use of the third-party services listed in section 11 of the Privacy Notice.
First-party technical cookies
The aforementioned website uses technical cookies (navigation or functionality cookies, session and/or persistent) or similar technologies to function and be displayed correctly, to enable authentication to restricted areas, or to improve the "user experience" of its users (e.g., by storing their language preferences or saving login credentials used to access the back-end, to avoid re-entering them).
Since consent is not required for their installation, these cookies will always be used and sent to the browser in use, unless the user changes their settings (which would affect the proper use of the services or content made available).
| Name | Domain | Origin | Function / Data Collected | Expiry |
|---|---|---|---|---|
| OJSID | riviste.unimi.it | OJS | Cookie used to manage the authenticated user's session | session |
Monitoring cookies
The University's journals platform riviste.unimi.it also uses Matomo to monitor visitor traffic. The cookies used by Matomo do not allow user identification or profiling, and the user can always choose to enable or disable cookies.
| Name | Domain | Origin | Function / Data Collected | Expiry |
|---|---|---|---|---|
| _pk_id | riviste.unimi.it | Matomo | Records a unique visitor ID | 13 months |
| _pk_ses | riviste.unimi.it | Matomo | Records the date of the visit | 30 minutes |
| _pk_ref | riviste.unimi.it | Matomo | Stores attribution information (the referrer that brought the visitor to the website) | 30 minutes |
| _pk_testcookie | riviste.unimi.it | Matomo | Temporary cookie to check whether a visitor's browser supports cookies (set only in Internet Explorer) | 30 minutes |
Third-party cookies
As indicated in section 11 of the Privacy Notice, this web application uses certain functionalities provided by other organizations ("Third Parties") to improve users' browsing experience.
As a result of the installation of specific extensions (modules, plugins, widgets) or the incorporation of content hosted on external platforms, it may therefore be possible for third-party cookies to be transmitted to and from all sites not owned by the University.
Prior consent from the data subject is required for the use of this type of cookie, and it may be revoked at any time by following the instructions provided in section 5 of this notice.
Please note that information collected by "third parties" is not accessible to the Data Controller, and its management is governed by the relevant privacy notices, to which reference should be made.
| Name | Domain | Origin | Function / Data Collected | Expiry |
|---|---|---|---|---|
| CookieScriptConsent | riviste.unimi.it | cookie-script.com | Stores cookie choice | 30 days |
