NOTICE ON THE PROCESSING OF PERSONAL DATA
FOR THE “OPEN 2.0” SERVICE

FOR THE “OPEN 2.0” SERVICE

Before you provide us with your personal data - in accordance with the provisions of European Regulation 2016/679 on the protection of personal data (General Data Protection Regulation) and Italian Legislative Decree no. 196 of 30 June 2003 (so-called Privacy Code) as amended in accordance with Legislative Decree no. 101 of 10 August 2018, whose objective is to protect the fundamental rights and freedoms of natural persons, in particular the right to the protection of personal data - it is necessary for you to read a set of information that can help you understand the reasons why your personal data will be processed, specifying what your rights are and how you can exercise them.

1. Purpose and legal basis for the processing of personal data

1.1 We inform you that your personal data provided at the time of registration will be processed in order to allow you access to the “OPEN 2.0” web portal (https://www.open2.0.regione.lombardia.it/) and use of the functionalities made available on the platform. In particular, registration will allow you to access a reserved area and to participate in a community of qualified subjects (designers and developers), to view and download documentation, source codes and demo presets, as well as to build demo platforms through Wizards by installing OPEN 2.0 plug-ins and, within the community, to formulate specific assistance questions in the dedicated forums.

The purpose of the Portal, therefore, is to offer a presentation of the open source Open 2.0 application, made available by the Lombardy Region for the creation of collaborative tools, namely, a set of ready-to-use and customisable software packages, dedicated to those who are looking for solutions to optimise resources, share experiences and respond to the strategic challenges of growth and competitiveness in a collaborative way.

Indeed, the Portal is part of the initiatives promoted by the Lombardy Region as part of its Strategic Programme for research, innovation and technology transfer, in connection with the document for industrial policies pursuant to art. 6, paragraph 2, Regional Law no. 26 of 24 September 2015 (“Manifattura diffusa creativa e tecnologica 4.0”, i.e. “Widespread creative and technological manufacturing”) and the aims pursued by Regional Law no. 29 of 23 November 2016 (“Lombardia è ricerca ed innovazione”, i.e. “Lombardy is research and innovation”) whose objective is to promote the competitiveness of the economic-productive system, the growth of human capital, sustainable development and contribute to increasing social welfare and the quality of services provided to citizens and businesses.

With regard to the objectives and purposes pursued by the Portal “OPEN 2.0”, the legal basis that legitimises the processing of personal data required for registration is constituted, pursuant to art. 6, paragraph 1 letter a) of the GDPR, the consent freely given by you through the selection of the flag in the registration form.

2. Type of data processed and how to register to the “OPEN 2.0” Portal

2.1 In order to complete your registration to the “OPEN 2.0” Portal it is necessary that you provide the personal data indicated below by filling in the appropriate form. Some of the requested data, marked with an asterisk, are mandatory and public because they are designed to ensure consistent interaction between registered users within the specific areas of competence.

In particular, in order to benefit from the services and functionalities made available on the “OPEN 2.0” Portal, it will be necessary for you to provide the following personal data:

• Name (mandatory and public)
• Surname (mandatory and public)
• Valid email address (mandatory and confidential)
• Entity/Company (mandatory and public)
• Role (mandatory and public)
• How you discovered Open2.0 (optional and confidential)

The confirmation of your registration on the Portal will be made by receiving an email communication at the email address you provided.

After registration, it will also be possible, but not mandatory, to integrate your profile with the following information:

• Professional presentation (optional and public);
• Short presentation (optional and public);
• Tags and Areas of Interest (optional and public);
• Gender (optional and confidential);
• Age range (optional and confidential);
• Photo (optional and public);
• Photo (optional and public);
• Network (contacts, community in which you participate, Organisation) (optional and public);

At any rate, the processing of sensitive or legal data is expressly excluded; such data will be deleted if provided by mistake by the user.

Registration by providing the mandatory personal data indicated above will allow you to access to the services/tools made available by the OPEN 2.0 platform, namely to access the reserved area and the community of designers and developers, where you can:

• view and download Open 2.0 forms (preset): the application makes available a set of pre-configured platforms (by context and/or topic) designed to provide tools that facilitate cooperation, participation and sharing;
• download source codes and documentation: this area, for IT technicians and developers, makes available the source code for the software solutions and all the resources needed to make them easier to use. Additionally, technical documentation is available that explains the code and the logic of the structure;
• consult the “Open 2.0” plugin catalogue: this area includes the complete catalogue of the modules provided by the platform, offering a summary of the main features. It is possible to test their operation by creating a platform in the “Tutorial” area. The plugin source code is available for download in the “Open 2.0 – Source Code & Documentation” area;
• Open 2.0 Tutorial: a wizard to create platforms, to discover the structure and logic of each component and each solution. Step by step, it allows the creation of new platforms tailored to your needs with the ability to choose plugins in the catalogue and create new assets with the creation of fields and type;
• access to the “Open 2.0” community: : this area, designed for IT technicians and developers, makes it possible to exchange information and start discussions among those who work with OPEN 2.0 or want to understand its operation.

3. Navigation data

3.1 When browsing this website, the computer systems and software procedures that govern the functionality of the “OPEN 2.0” Portal collect certain personal data items, the transmission of which is implicit in the use of Internet communication protocols.

Although the data items indicated above cannot be traced back to the identified users, they could allow for the identification of the users to whom they refer by means of reprocessing in conjunction with additional data held by third parties. These types of data include IP addresses, the domain names of the computers utilised by the users who connect to the website, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code that indicates the response provided by the server (successful, error, etc.), and other information relating to the user’s operating system or IT environment. The data, however, are only used for the purpose of obtaining anonymous statistics regarding the use of the Portal and ensuring its proper functionality.

3.2 Cookie Policy
For information regarding the cookies used on the “OPEN 2.0” Portal, please refer to the specific information provided , as well as the Lombardy Region cookie policy.

4. Data processing method

The processing of your personal data will be carried out with the aid of electronic and/or automated means, in accordance with the principles of necessity and minimisation, and thus for the time strictly required to allow you to use the functions and services available on the platform. The data controller adopts appropriate technical and organisational measures in order to guarantee a suitable level of security with respect to the type of data processed.

5. Data controller

Pursuant to art. 4, par. 7 of EU Regulation 2016/679, the Data Controller is the Lombardy Region (Tax no. 80050050154 and VAT number 12874720159), in the person of the President of the Regional Council pro tempore, with registered office in Milan, Piazza Città di Lombardia no. 1 (20124), Italy.

6. Data Protection Officer (DPO)

You can contact the Data Protection Officer (DPO) of the Lombardy Region by sending an e-mail to the following address: rpd@regione.lombardia.it

7. Nature of the provided data and consequences of a possible refusal

The provision of personal data indicated above is optional. However, since the data marked as mandatory are necessary for registration, in the event of your refusal or the provision of incorrect and/or incomplete information, it could result in the Data Controller formalising your registration, making it impossible to use the functions on the “OPEN 2.0” Portal.

8. Communication and dissemination of personal data

The personal data provided by you for the registration will be processed exclusively by the Data Controller and the Data Processors appointed for this purpose pursuant to art. 28 of the GDPR, among which ARIA S.p.A. Regional Company for Innovation and Purchasing that institutionally carries out management and maintenance of information systems on behalf of the Lombardy Region, as well as any providers of specific services duly appointed, in addition to its staff adequately trained in the processing and protection of your personal data. And this, in order to guarantee you the same level of security offered by the Data Controller.

With reference to personal data, we further inform you that ARIA S.p.A., in consideration of its specific competences, also performs the task of IT system administrator, with the task of managing the correct operation of the platform for the provision of “OPEN 2.0” services and functionalities.

Your personal data will never be communicated to third parties, unless in fulfilment of any legal obligations or motivated orders from the judicial authorities. Apart from these hypotheses, your data will not be disseminated or communicated in any way to third parties.

9. Automated processes and profiling

The personal data provided by you are not subject to any fully automated decision-making process, including profiling, capable of producing legal effects of any kind, or even significantly affecting your person.

10. Transfer of personal data to countries outside the European Union

Your personal data collected and processed for registration to the “OPEN 2.0” Portal will not be transferred to companies or other entities located outside the territory of the European Union.

11. Data retention time

We inform you that your personal data will be stored until your registration to the “OPEN 2.0” Portal remains active. At any time, you may cancel your registration from the “OPEN 2.0” Portal by using the appropriate function on your user profile, or by sending a request to the Support Service. As a result, your profile will be erased and completely anonymised and obscured, while the contributions provided by you and/or published on the OPEN2.0 Portal will remain available for consultation in order to ensure their usability by active users. Following registration cancellation, the personal data provided by you will be kept for a further period of 1 year, after which they will be deleted in full.

With regard to personal data voluntarily provided by you in relation to Call Center, Call Back, Web Chat, Contact (portal form), “Help” services, data retention times are indicated in the Integrated Contact Center Services Privacy Notice.

The navigation data, appropriately anonymised, will remain available for statistical processing and will never be deleted from the servers, unless expressly requested by the user; said request must be sent in the manner described in point 11 below ("Rights of the data subjects") of this notice. Furthermore, data could also be used to ascertain liability in the event of any hypothetical IT crimes aiming to cause loss or damage to the Portal.

12. Rights of the data subject

In accordance with articles 15-22 of the GDPR, you may exercise the following rights:

• right to access the data, making an appropriate request for the following details: purposes and methods of processing; categories of personal data in question; recipients or categories of recipients to whom the personal data have been or will be communicated; period of storage of data; logic applied to the processing; identification details of the data controller and data processors;
• right to request correction or integration of data;
• right to request cancellation (in the cases provided for in the Regulation), transformation of data into anonymous form and blocking of data if processed in violation of the law, without prejudice to all storage obligations provided by law;
• right to data portability;
• right to oppose the processing of data for legitimate reasons.

Requests for the exercise of your rights should be sent to the following certified email address ricercainnovazione@pec.regione.lombardia.it, or by registered mail with return receipt sent to the address of the Lombardy Region, Piazza Città di Lombardia 1, (20124) Milan, Italy, to the attention of the pro tempore Manager of the Research, Innovation, University, Export and Internationalisation Department. Furthermore, it is always possible to exercise the right to lodge a complaint with the Supervisory Authority.