1. Data Controller
The Data Controller for the processing described in this notice is Prof. Grazia Tucci, DICEA — Department of Civil and Environmental Engineering, University of Florence (Università degli Studi di Firenze).
2. Technical management of the website
The public website and its technical components are managed by Damiana Luzzi, DICEA — University of Florence. This statement describes the operational management of the website and does not assign a different data-controller role. The separate learning platform is outside the scope of this notice.
3. Hosting and technical service providers
The public website is hosted by SiteGround. In providing hosting, security, backup and related technical services, the hosting provider may process technical data needed to deliver and protect the website in accordance with the applicable service and data-processing arrangements.
4. Personal data processed
- Email update form: the email address entered by the user, the fact that consent was given, the version of the privacy notice presented and the date/time of submission.
- Browsing and server data: technical information normally generated by communication between a browser and a web server, which may include IP address, date/time, requested resource, browser/device information and security or diagnostic logs.
- Embedded YouTube content: when third-party video players are loaded or used, Google/YouTube may receive technical information concerning the browser, device and connection and may use cookies or similar technologies according to its own service configuration.
The landing-page form does not request a name, postal address, telephone number or special-category personal data.
5. Purposes, legal bases and consequences of not providing data
| Purpose | Legal basis | Is providing the data compulsory? |
|---|---|---|
| CHEDARacademy email updates Information about Academy opening, courses, enrolment and related institutional updates. |
Consent of the data subject — Article 6(1)(a) GDPR. | No. You can browse the website without subscribing. If you do not provide an email address and consent, you simply will not receive the requested updates. |
| Website delivery, security and technical operation | Processing necessary for the legitimate and secure technical operation of the public website and for compliance with applicable technical/security obligations, as relevant to the specific processing. | Technical data are generated as part of normal website communication. Without the minimum technical processing needed to establish the connection, the website cannot be delivered. |
| Embedded multimedia content | Delivery of third-party multimedia functionality; any non-essential tracking technologies are governed by the applicable cookie/tracking rules described in the Cookie Policy. | The videos are an additional website feature. See the Cookie Policy for information about third-party technologies. |
6. The “Notify me” form and consent
Subscription to CHEDARacademy updates is voluntary. When the form is submitted, the website sends the email address entered by the user together with confirmation of consent, the privacy-notice version and the submission timestamp to the CHEDARacademy contact mailbox.
Consent may be withdrawn at any time by writing to info@chedaracademy.org or to the Data Controller. Withdrawal is as easy as giving consent and does not affect the lawfulness of processing carried out before withdrawal.
7. Recipients and categories of recipients
Personal data may be accessed only where necessary by persons authorised to manage CHEDARacademy and by service providers involved in the operation of the website. Depending on the activity, recipients or categories of recipients may include:
- the Data Controller and authorised CHEDARacademy/DICEA personnel involved in administration or communication;
- the technical website manager;
- SiteGround, for hosting and related technical services;
- Google / YouTube, in connection with embedded YouTube video services and the delivery of the Lato web font used for typographic continuity with the CHEDAR project website.
Personal data submitted through the update form are not sold or published on the website.
8. YouTube videos and third-party technologies
CHEDARacademy embeds course teaser videos directly in the landing page. Where technically possible,
the players use YouTube's Privacy-Enhanced Mode through the youtube-nocookie.com domain.
YouTube nevertheless remains a third-party service and may process technical data when the player is loaded or used.
Further information is provided in the Cookie Policy.
9. Data retention
Email addresses collected for CHEDARacademy updates are retained for the period necessary to provide the requested updates and, in any event, no longer than necessary for that purpose, unless the data subject withdraws consent earlier or a longer period is required to demonstrate consent/withdrawal or comply with legal obligations.
Technical server, security and diagnostic logs are retained according to the production hosting/security configuration for the time needed for service operation, security, incident management and any applicable legal requirements.
10. Transfers outside the European Economic Area
Some third-party providers used by the website may operate internationally. If personal data are transferred outside the European Economic Area, the transfer must rely on an applicable mechanism under Chapter V GDPR, such as an adequacy decision or appropriate safeguards, where required.
11. Rights of the data subject
Under Articles 15–22 GDPR, and subject to the conditions laid down by the Regulation, you may exercise the rights that apply to the processing of your personal data.
How to exercise your rights
You may submit a request without special formalities by contacting the Data Controller at grazia.tucci@unifi.it or info@chedaracademy.org. Requests will be handled without undue delay and normally within one month, subject to the extensions permitted by Article 12 GDPR for complex or numerous requests.
12. Right to lodge a complaint
If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority under Article 77 GDPR. In Italy, the competent authority is the Garante per la protezione dei dati personali.
The right to complain to the Garante is without prejudice to any other administrative or judicial remedy available under applicable law.
13. Changes to this notice
This notice applies only to the current public CHEDARacademy landing page. It will be updated if the website, its providers or its processing activities materially change. The revision date at the top of the page identifies the current version.
Privacy contacts
Data Controller: Prof. Grazia Tucci — grazia.tucci@unifi.it
CHEDARacademy enquiries and update-list requests: info@chedaracademy.org