Privacy Policy under art. 13 of EU Regulation no. 679/2016 of 27 April 2016 for services and supplies

This notice is issued under art. 13 of EU Regulation GDPR 2016/679 of 27 April 2016 and legislation on the protection of individuals during personal data processing, and the free movement of that data.

Data Controller – Identity and Contact

The Data controller of Politecnico di Milano is the General Director upon authorization of the pro-tempore Rector – contact: dirgen(at)

Data Protection Officer – Identity and Contact

Dr. Vincenzo Del Core - privacy(at) tel.: 02.2399.9378

Purposes of data processing

Under European and national legislation (EU Regulation 679/2016, hereafter Regulation), we inform you that your personal data will be used for the following purposes:

Purposes of the processing for which personal data are intendedLegal basis Categories of personal data
Purpose 1: registration in the Lists and Suppliers Register, verification and compliance with tender procedure, purchase and supply requirements. Legal obligation (Article 6 paragraph 1, letter c of the EU Regulation).  
  • Identifying data
  • Personal data
  • Tax data
  • Bank data
  • Career data
Purpose 2: verification of legal requirements needed for Public Administration contracts. Legal obligation (Article 6 paragraph 1, letter c of the EU Regulation).  
  • Personal data
  • Judicial data
  • Tax data
  • Career data
Purpose 3: fee and invoice payments for services and supplies provided to Politecnico di Milano. Legal obligation (Article 6 paragraph 1, letter c of the EU Regulation).  
  • Identifying data
  • Personal data
  • Tax data
  • Bank data

Nature of data

The provision of requested data for the above purposes is mandatory. Failure to provide the requested data will mean that the service provision cannot be guaranteed.

Special categories of data

Personal data relating to criminal convictions and offences (art. 10) will be processed for the purposes set out in the TABLE, specifically for purposes 1 and 2, to allow the data subject to participate in tender procedures, assignments and contracts with Politecnico di Milano.

Data processing method

The processing for the above purposes (1, 2 and 3) may be carried out using digital media, manually and/or with electronic, or automated tools, using in-house and external databases, necessary for telematic procedures [e.g. SINTELMEPA]. This data is stored in digital format for an indefinite time because of transparency obligations and proper public administration functioning.

To comply with publication obligations under Legislative Decree 33/2013 and subsequent amendments and additions, some of the identifying data collected may be made public.

Under the law, data will be processed for the above purposes by additional authorised and instructed parties. Personnel, who has been authorised before, can process and collect the requested data.

Recipient categories

Data may be disclosed to the following public entities, companies or persons that provide services on behalf of the Data Controller, including external services. Your personal data may be disclosed (possibly in an anonymised format) to other public administrations if they must process data for any procedures falling within their institutional responsibility. Under relevant conditions, data will be disclosed to public entities when mandatory under European legislation, laws or regulations, and to insurance companies to process accident files.

Personal data collected may be disclosed to the following third parties:

  • ANAC;
  • Prefecture;
  • INPS;
  • INAIL;
  • Court;
  • Public Administrations;
  • Managers of public services;
  • Legal persons;
  • Associations;
  • Foundations;
  • Professional Associations;
  • Professional registers;
  • Citizens;
  • Cashiers;
  • Judicial authority.



Storage period of personal data

Under the purposes above, data collected will be kept until Politecnico di Milano is subject to retention obligations for tax, legal or regulatory purposes.

Data Transfer to Extra EU Country

Personal data will not be transferred to non-EU countries.

Right to submit a complaint

As a data subject, you may ask the Data Controller to:

  • confirm your personal data’s existence;
  • access your personal data and related information, correct inaccurate data, integrate incomplete data, delete your personal data (if one of the conditions set out in art. 17, paragraph 1 of the Regulation occurs and under the exceptions provided for in paragraph 3); limit the processing of your personal data (if one of the conditions set out in art. 18, paragraph 1 of the Regulation occurs), anonymise or block data processed unlawfully, including data for which retention was unnecessary for the purposes for which it was collected or later processed;

As a data subject, you have the right to partially or fully oppose:

  • the processing of your personal data for sending the Politecnico di Milano’s promotional material for training initiatives and cultural events.

These rights can be exercised by contacting privacy(at)
If you believe that your rights have been violated by the controller and/or a third party, you have the right to lodge a complaint with the Authority for the Protection of Personal data, and/or another competent controlling authority in terms of the Regulation.



Last update: October 28, 2019