PRP Digital Ecosystem
register logout myEPIRO submit your application wishlist
Request Access

Privacy notice

This privacy notice is provided pursuant to article 13 of Regulation (EU) no. 2016/679 – General Data Protection Regulation (hereinafter referred to as “GDPR”) by:

Area di Ricerca Scientifica e Tecnologica di Trieste – Area Science Park (hereinafter “Area Science Park”), with its registered office in Località Padriciano 99, Trieste, Italy

and

Consiglio Nazionale delle Ricerche (hereinafter “CNR”), with its registered office in Piazzale Aldo Moro 7, Rome, Italy, through its organisational units involved in the data processing, i.e. the Institute of Crystallography (IC-CNR), with its registered office in Via Giovanni Amendola 122/o, Bari, Italy, and the Institute of Materials (IOM-CNR), with its registered office in S.S. 14 Km 163,5 Basovizza, Trieste, Italy

and

Università degli Studi di Salerno (hereinafter “UNISA”), with its registered office in Via Giovanni Paolo II 132, Fisciano (SA), Italy

and

Università del Salento (hereinafter “UNISALENTO”), with its registered office in Piazza Tancredi 7, Lecce, Italy

and

Università degli Studi di Napoli Federico II (hereinafter “UNINA”), with its registered office in Corso Umberto I 40, Naples, Italy

as well as

Elettra-Sincrotrone Trieste S.C.p.A. (hereinafter “Elettra Sincrotrone Trieste”), with its registered office in Strada Statale 14 - km 163,5 in Area Science Park Basovizza, Trieste, Italy

hereinafter jointly referred to as “Joint Controllers”

in relation to the processing of personal data carried out as part of the management of the Research Infrastructure (RI) “Pathogen Readiness Platform for CERIC-ERIC upgrade” (PRP@CERIC) with particular regard to the submission of a request for information via one of the forms provided for this purpose on the website https://prp-ri.eu/ (hereinafter “the Website”).

1. Joint Controllers

Pursuant to the “Joint Controller agreement for the processing of personal data” entered into on 13 October 2025 in accordance with Article 26 of Regulation (EU) 2016/679, Area Science Park, CNR, UNISA, UNISALENTO, UNINA and Elettra Sincrotrone Trieste, acting as Joint Controllers, jointly determine the purposes and means of the processing of personal data of the users of the Website, carried out in order to reply to requests for information submitted via one of the forms provided for this purpose on the Website itself.

The user of the Website, to whom the personal data being processed refer, in his/her capacity as data subject, may hence exercise his/her rights in respect of and against each of the Joint Controllers, in accordance with Article 26 of the GDPR, by writing to the addresses mentioned above or by sending an e-mail to the e-mail addresses listed in point 2 of this notice.

2. Data Protection Officer (DPO)

  1. Pursuant to article 37 of the GDPR, Area Science Park has appointed a Data Protection Officer, who can be reached at the following e-mail address: rpd@areasciencepark.it.
  2. Pursuant to article 37 of the GDPR, CNR has appointed a Data Protection Officer, who can be reached at the following e-mail addresses: rpd@cnr.it, dpo@cnr.it and rpd@pec.cnr.it.
  3. Pursuant to article 37 of the GDPR, UNISA has appointed a Data Protection Officer, who can be reached at the following e-mail addresses: protezionedati@unisa.it and protezionedati@pec.unisa.it.
  4. Pursuant to article 37 of the GDPR, UNISALENTO has appointed a Data Protection Officer, who can be reached at the following e-mail address: dpo@unisalento.it.
  5. Pursuant to article 37 of the GDPR, UNINA has appointed a Data Protection Officer, who can be reached at the following e-mail addresses: rpd@unina.it and rpd@pec.unina.it.
  6. Pursuant to article 37 of the GDPR, Elettra Sincrotrone Trieste has appointed a Data Protection Officer, who can be reached at the following e-mail address: dpo@elettra.eu.

3. Origin of the personal data

The personal data processed for the purposes described in this privacy notice are provided by the data subject.

Should the data subject disclose personal data relating to third parties, the data subject guarantees that he/she is entitled to do so on the basis of a suitable legal basis for the lawful processing of such data and assumes all related obligations and liabilities in accordance with current legislation, holding the Joint Controllers harmless and indemnifying them against any dispute, claim or request for compensation for damages arising from the processing that such third parties may bring against the Joint Controllers themselves. The data subject also undertakes to bring the information contained in this privacy notice to the attention of any third parties whose personal data is disclosed.

4. Categories of personal data concerned

The personal data processed for the purposes described in this privacy notice are “standard” personal data, such as the data subject’s name, surname, e-mail address and affiliation.

5. Purposes and legal basis of the processing

Subject to the provisions of article 4, paragraph 3 of the joint controller agreement referred to in point 1 of this privacy notice, whereby “the processing described under this Agreement will be aimed at executing the activities needed to implement the project “Pathogen Readiness Platform for CERIC-ERIC upgrade” (PRP@CERIC) and any other activities related and instrumental to such implementation”, the personal data of the data subject referred to in this privacy notice are processed by the Joint Controllers for the purposes set out in the table below, alongside which the legal basis for the processing is also indicated.

 

Purpose of the processing

Legal basis for the processing

Replying to requests for information submitted by the data subjects
  • If the request for information is made in preparation for a request for free access to the services offered by the RI “PRP@CERIC”, the legal basis for the processing is the performance of a task carried out in the public interest or in the exercise of official authority vested in the Joint Controllers (article 6, paragraph 1, letter e) of the GDPR), consisting of facilitating and promoting scientific research;
  • if the request for information is made in preparation for a request for fee-based access to the services offered by the RI “PRP@CERIC”, the legal basis for the processing is the performance of a contract to which the data subject is party or the taking of steps at the request of the data subject prior to entering into a contract (article 6, paragraph 1, letter b) of the GDPR).

Sending the data subject informative or promotional materials or other notices by the Joint Controllers

Consent of the data subject (article 6, paragraph 1, letter a) of the GDPR

 

6. Recipients or categories of recipients of the personal data

Without prejudice to any disclosure and further dissemination of the data under legal obligations or by orders of the authorities, the data will be known by the staff of the Joint Controllers, as well as by the staff of any data processors appointed by the Joint Controllers themselves, all of whom are authorised to process the data and specially trained to do so. A detailed and constantly updated list of the data processors is available to the data subject at the offices of each Joint Controller.

7. Transfer of the data to countries outside the EU

Submitting a request for information via one of the forms provided for this purpose on the Website entails the transfer of the data subject’s personal data to the United States of America, given the involvement of Microsoft Corporation and ClickDimensions LLC as providers of the services necessary for the proper functioning of the Website and the operation of its features; both of the aforementioned entities adhere to the “EU-US Data Privacy Framework” referred to in Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework.

8. Data storage period

  • Data processed for the purpose of replying to a request for information submitted by the data subject will be retained until the data subject objects to the processing;
  • data processed for the purpose of sending informative or promotional materials or other notices by the Joint Controllers will be retained for a period of 2 years from the date on which the data subject gives his/her consent.

9. Rights of the data subject

With reference to his/her personal data, the data subject has the following rights:

  1. right of access (article 15 of the GDPR);
  2. right to rectification (article 16 of the GDPR);
  3. right to erasure (article 17 of the GDPR);
  4. right to restriction of processing (article 18 of the GDPR);
  5. right to data portability (article 20 of the GDPR), if the processing is based on the performance of a contract or on the data subject’s consent and is carried out through IT tools;
  6. right to object to the processing of the data (article 21 of the GDPR);
  7. right to withdraw his/her consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (article 7, paragraph 3 of the GDPR);
  8. right to lodge a complaint with the competent supervisory authority (article 77 of the GDPR).

To exercise the rights referred to in letters a) to g), data subjects may send an e-mail to the following addresses:

The Joint Controllers shall provide a reply within one month of receipt of the request; that period may be extended to up to three months if the request is particularly complex. When applicable, the Joint Controllers shall communicate the exercise of the rights by the data subject to each recipient to whom the personal data have been disclosed, except for specific cases (for example where this proves impossible or involves a manifestly disproportionate use of means compared to the right protected).

10. Compulsory or optional nature of providing data and consequences of failure to provide data

The provision of the personal data referred to in this privacy notice and marked with an asterisk is mandatory for the purpose of replying to the request for information submitted by the data subject; therefore, any failure to provide such data shall preclude the activity in question. The provision of the personal data referred to in this privacy notice that are not marked with an asterisk is optional; therefore, failure to provide such data has no impact on the ability to reply to the request for information submitted by the data subject.

11. Absence of automated decision-making

In the processing of the personal data referred to in this privacy notice, the Joint Controllers do not use any automated decision-making under article 22 of the GDPR.