This policy covers the public website (greening-energy-market-finance-emjm.eu) and the GrEnFIn intranet (app.greening-energy-market-finance-emjm.eu). It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Data Controller
Alma Mater Studiorum – Università di Bologna, Via Zamboni, 33 – 40126 Bologna, Italy, as coordinator of the GrEnFIn Erasmus Mundus Joint Master consortium.
2. Data Protection Officer
The Data Protection Officer (DPO) of the University of Bologna can be contacted at: dpo@unibo.it.
3. Data We Process
- Website visitors: technical data needed to deliver the pages (IP address, browser, pages requested) and, only if you accept analytics cookies, pseudonymous usage statistics. The website does not collect applications: candidates apply through the University of Bologna's own portal.
- Intranet members (students, alumni, professors, coordinators, staff, partner companies): identity and contact details (name, email, optional phone, photo, biography, LinkedIn profile); academic data (student number, cohort, track, courses, grades, assignments, exams, thesis, internships, certificates); content you create (messages, forum posts, documents, applications to job and internship offers, support requests); account and security data (hashed password, two-factor authentication settings, sign-in history with a truncated IP address and device fingerprint).
- AI assistant (optional): your messages and the profile and academic data listed in the assistant's notice, only after you enable it.
4. Purposes and Legal Bases
- Running the master programme and its intranet (accounts, courses, grades, theses, internships, communication within the consortium): performance of a task carried out in the public interest in higher education (Article 6(1)(e) GDPR).
- Security of the platform (sign-in protection, abuse prevention, audit logs): Article 6(1)(e) and Article 32 GDPR.
- Analytics cookies, the optional AI assistant and the display of your photo in the member gallery: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time without affecting your studies.
5. Recipients
Within the platform, data is visible to other members only according to their role and to your visibility settings. Data may be shared with the partner universities of the GrEnFIn consortium for the management of the programme. Data is never sold or used for advertising.
The platform is operated for the University of Bologna by SDEN (processor, Article 28 GDPR), which relies on the following service providers (sub-processors):
- Cloudflare, Inc. — hosting, content delivery, security and file storage;
- Neon, Inc. — database hosting;
- Resend (Plus Five Five, Inc.) — sending of emails;
- Mistral AI SAS (France) — AI assistant, only if you enable it;
- PostHog, Inc. — audience measurement, only if you accept analytics cookies (EU data region);
- Upstash, Inc. and Functional Software, Inc. (Sentry) — rate limiting and error monitoring, without your name or email;
- GitHub, Inc. — source code and encrypted backups pipeline.
6. Transfers Outside the European Union
Some of these providers are established in the United States. Where personal data is transferred outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework (adequacy decision of 10 July 2023) or on the European Commission's Standard Contractual Clauses. You can obtain information on these safeguards by writing to the DPO.
7. Retention Periods
- Intranet account data: for the duration of your participation in the programme and as an alumnus or alumna; you can ask for your account to be erased at any time (see section 8). Academic records are kept according to the University of Bologna's archiving obligations.
- AI assistant conversations: 180 days, unless you delete them earlier.
- Notifications: 180 days.
- Security and activity logs: 12 months.
- Expired sign-in sessions and one-time links: deleted when they expire.
- Database backups: 30 days.
8. Your Rights
Under Articles 15 to 22 GDPR you have the right to access your data, to rectify it, to have it erased, to restrict or object to its processing, and to data portability. In the intranet, you can download your data and request the erasure of your account from Settings. You can also write to privacy@unibo.it or to the DPO (dpo@unibo.it). We answer within one month.
You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the authority of your country of residence.
9. Security
Data is encrypted in transit (HTTPS), passwords are hashed, two-factor authentication secrets are encrypted, access is restricted by role, and backups are encrypted. Security incidents are handled according to a documented procedure.
10. Changes
This policy may be updated. The date of the last update is shown at the top of this page.