This Privacy Policy provides the following information – pursuant to Regulation (EU) 2016/679 (hereinafter the “Regulation”) – regarding the processing of personal data of the User (hereinafter the “Data Subject”) who visits the website https://startupencubator.com/ (hereinafter the “Site”) of Encubator (hereinafter “Encubator”).

1. Data Controllers and Data Protection Officer

The joint controllers of the Data Subject’s personal data are the Chamber of Commerce of Milan Monza Brianza Lodi (hereinafter “Chamber of Commerce”), with registered office at Via Meravigli 9/b, 20123 Milan, https://www.milomb.camcom.it – cciaa@pec.milomb.camcom.it, and the Politecnico di Milano (hereinafter “Politecnico”), with registered office at Piazza Leonardo da Vinci 32, 20133 Milan – General Director on behalf of the Rector pro-tempore, dirgen@polimi.it (hereinafter the “Joint Controllers”).

The Data Protection Officer of the Chamber of Commerce, pursuant to Article 37 of the GDPR, can be contacted at RPD@mi.camcom.it; the Data Protection Officer of the Politecnico di Milano, pursuant to Article 37 of the GDPR, can be contacted at privacy@polimi.it.

The Data Processor pursuant to Article 28 of the GDPR for the processing of the Data Subject’s data is PoliHub s.c.a.r.l. Società Benefit, with registered office at Piazza Leonardo Da Vinci 32, 20133 Milan (hereinafter the “Processor”).

2. Purposes and Legal Bases of Processing

The personal data of the Data Subject visiting the Site are processed to ensure the proper technical functioning of the Site, thus facilitating the quality, accessibility, usability and availability of the information published thereon by users.

In pursuing these purposes, the Chamber of Commerce and the Politecnico act pursuant to Article 6(1)(e) of the Regulation, whose legal basis is the performance of a task carried out in the public interest.

3. Types of Data Processed and Processing Methods

Browsing Data

The personal data of the Data Subject are processed through automated means that, through the computer systems and software procedures used to operate the Site, acquire, during their normal operation, some data whose transmission is implicit in the use of Internet communication protocols; these are information that is not collected to be associated with identified data subjects, but which by their very nature could, through processing and association with data held by third parties, allow users to be identified (this category of data includes IP addresses or domain names of the computers used by users who connect to the Site, the addresses in URI – Uniform Resource Identifier – notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the response file, the numerical code indicating the status of the response given by the server, and other parameters relating to the user’s operating system and computer environment).

In particular, these data are used solely to obtain anonymous statistical information on the use of the Site and to check its correct functioning. Any statistical surveys of users’ browsing within the Site will be carried out in an absolutely anonymous form.

It should be noted that, in any case, browsing data could be used to ascertain responsibility in the event of any computer crimes against the Site.

The data are processed exclusively by personnel authorized to process them and specifically trained and instructed by the respective Organizations of the Joint Controllers and the Processor identified in Point 1.

The collected data are protected by the adoption, as far as reasonably possible and in accordance with the state of the art, of technical and organizational measures aimed at preventing the risks of destruction, loss, unauthorized access, unauthorized processing, or processing not in accordance with the purposes of the collection.

4. Data provision

The transmission of the information described above is necessary, and therefore not optional for the Data Subject, to achieve the purposes of the functioning and improvement of the Site and the services offered by the Chamber of Commerce and the Politecnico, as specified in Point 2.

5. Communication and dissemination

The personal data collected may be communicated to third parties authorized for activities strictly related and instrumental to the operation of the service, such as the management of the computer system, or for processing carried out by other companies with the same purposes. Outside of these cases, personal data will not be communicated, nor granted to anyone, except as provided by contract or with the Data Subject’s authorization. In this sense, personal data may be transmitted to third parties, but only and exclusively in the event that:

• there is explicit consent to share the data with third parties;
• it is necessary to share the information with third parties to provide the requested service;
• it is necessary to comply with requests from Judicial or Public Security Authorities.

6. Retention period

Browsing data – collected for the purpose specified in point 2 and processed in the manner specified in point 3 – are retained for a maximum period of 7 (seven) days, and then archived by the Processor pursuant to Article 28 of the GDPR for a further 6 (six) weeks; after this period, the data are no longer accessible, except for legal obligations regarding the retention of telematic traffic within the scope of the investigation and repression of crimes.

7. Data Subject’s Rights and Forms of Protection

The Data Subject is guaranteed the exercise of the rights recognized by Articles 15 and following of the Regulation. In particular, the Data Subject has the right to access their personal data, to request their rectification, updating, or deletion if incomplete, erroneous, or collected in violation of the law, to object to their processing, to transform them into anonymous form or to limit their processing, to revoke consent where provided. These rights can be exercised in compliance with the exceptions provided by sector regulations.

To exercise the aforementioned rights, the Data Subject can contact the contact points of the Joint Controllers and their respective Data Protection Officers: dirgen@polimi.it, privacy@polimi.it, and/or cciaa@pec.milomb.camcom.it, RPD@mi.camcom.it. The Data Subject can also file a report and complaint with the Data Protection Authority, according to the methods provided by the Authority itself.

The Data Subject’s data will not be transferred outside the European Economic Area (EEA).

COOKIE POLICY

This cookie policy (hereinafter the “Cookie Policy”) constitutes a further specification of the privacy policy mentioned above with reference to the site https://startupencubator.com/ (hereinafter the “Site”) of the Encubator Program promoted by the Chamber of Commerce of Milan Monza Brianza Lodi (hereinafter the “Chamber of Commerce”) and the Politecnico di Milano (hereinafter “Politecnico”).

With the Cookie Policy, the Chamber of Commerce and the Politecnico describe the various types of cookies and technologies used on the Site in accordance with the current provisions on personal data protection, security, and management of tracking tools.

The purpose of cookies is to improve the usability of the Site, making navigation more functional and efficient; for any other information, especially regarding the Joint Controllers and Processor, purposes and legal basis, processing methods, and the Data Subject’s rights, please refer to the aforementioned privacy policy.

What are cookies

Cookies are small text files that the sites visited by the user send to the device used for navigation: they are stored in the corresponding browser folder (often it is an anonymous identification code) while the user is visiting a website, to be retransmitted to the same sites during subsequent visits. They are used to improve navigation, save preferences already entered, track the user’s tastes and preferences, allowing, for example, to better manage the provision of services related to the owner’s activity.

Cookies can be divided into two categories: technical cookies and profiling cookies. The latter are aimed at creating profiles related to tastes, habits, choices, etc. of the user and are used to send advertising messages in line with the preferences expressed by the user during web browsing.

In addition to the distinction between technical cookies (which may also include analytical cookies, as will be seen later) and profiling cookies, there is also a distinction between first-party cookies and third-party cookies.

Consequently, cookies can be of multiple types simultaneously (e.g., third-party technical-analytical).

Technical Cookies

Technical cookies are those used solely to “carry out the transmission of a communication over an electronic communications network or to the extent strictly necessary for the provider of an information society service explicitly requested by the subscriber or user to provide such service” (Art. 122, paragraph 1, Privacy Code); they are therefore used to carry out navigation or to provide the service requested by the user. They are not used for further purposes other than purely technical ones and are usually installed directly by the website owner.

Among the cookies in this category are:

• session cookies, which are temporary as their operation on the machine is limited to the duration of the user’s session (when the browser is closed, session cookies expire); these are generally used to identify users when they access a site, to remember the user’s preferences when moving between pages of the site, to provide specific information collected previously;
• persistent cookies, which, on the other hand, help sites remember user data and settings for subsequent consultation (and therefore remain active even after the browser is closed); this allows faster and more convenient access in terms of time as it is not necessary to log in again.

Analytical Cookies

These tools (so-called analytics) are used to collect information on the use of websites. For this category, the purpose is generally to improve the site. In fact, if information is collected in an aggregated form on the number of users and how they visit the site for optimization purposes, this type of cookie is assimilated to technical cookies.

Third-Party Cookies

If cookies are not installed directly by the website owner (the aforementioned “first-party” cookies), they fall into the category of third-party cookies, which are set by a site other than the one the user is browsing. They are used, for example, by the site that the visitor first chose and that contains ads from another server or third-party website, or they may be installed by third parties providing technical services for the site (e.g., Google Analytics).

Profiling Cookies

Profiling cookies are aimed at creating profiles related to the user and are used to send advertising messages in line with the preferences expressed by the user during web browsing. Due to the particular invasiveness that such devices can have within the private sphere of users, European and Italian regulations provide that the user must be adequately informed about their use and express their valid consent to their use in an unequivocal manner.

Cookies on the Site

The Site uses cookies of all three types illustrated above.

Specifically, the following are used:

• technical cookies to allow the user to navigate the website and possibly use the requested services;
• analytical cookies, including third-party cookies, only for anonymous statistical detection of browsing activities, and in any case analytical cookies equivalent to technical cookies by virtue of their nature and function of optimization and improvement of the site’s usability;
• profiling cookies, including third-party cookies, for promoting the institutional initiatives of the University.

Given their technical utility, it should be noted that limiting the use of cookies will certainly affect the consultation of the site: in fact, blocking or removing them from the browser cache could cause incomplete use of the services offered by the visited web application.

The user is informed that the preferences expressed, in terms of consent/dissent, regarding profiling cookies will be collected and recorded by the Entity, which may retain them for a maximum duration of 6 months.

User Consent

The Joint Controllers, pursuant to the regulations mentioned in the preamble, are not required to request the user’s consent regarding first-party technical cookies or third-party analytical cookies (which perform statistical data collection in an aggregated and anonymous form for site improvement purposes) and can automatically proceed with their installation on the user’s browser.

With regard to profiling cookies, however, the Joint Controllers are obliged to obtain the user’s consent in order to install and use them.

The user can express their consent by using the “Accept all cookies” button on the banner or by directly selecting the “Profiling cookies” box by clicking on the “Confirm my choices” button.

Conversely, consent will be considered denied when the user closes the banner by clicking on the X.

The user remains free to change their choice by making the banner reappear by clicking on “Privacy settings,” always displayed in the navigation window.

How to Disable Cookies

Most browsers automatically accept cookies, but it is still possible to choose not to accept them or to make changes, although this may prevent moving from one page to another and using all the site’s specific features (e.g., it may not be possible to complete operations such as paying for an online service). Consequently, the choice to remove and not accept cookies could negatively affect the stay on the Site and its usability.

When the user first enters the site, a specific banner is shown, allowing them to make choices regarding cookies. The banner allows the user to express their consent on profiling cookies, as specified in the “User Consent” paragraph. In line with the reference regulations, consent is not required for technical and analytical cookies, which are therefore always installed, unless the user’s browser settings are different. If the user does not want the computer to receive and store cookies, it is possible to change the browser’s security settings.

Here are brief instructions on how to perform this operation in the four most popular browsers:

Microsoft Internet Explorer

Click the ‘Tools’ icon in the upper right corner and select ‘Internet Options.’ In the pop-up window, select ‘Privacy.’ Here you can adjust your cookie settings.

Google Chrome

Click the button in the upper right corner and select ‘Settings.’ Then select ‘Show advanced settings’ and change the ‘Privacy’ settings.

Mozilla Firefox

From the drop-down menu in the upper left corner, select ‘Options.’ In the pop-up window, select ‘Privacy.’ Here you can adjust your cookie settings.

Safari

From the drop-down settings menu in the upper right corner, select ‘Preferences.’ Select ‘Privacy’ and here you can adjust your cookie settings.

To disable analytical cookies and prevent Matomo from collecting browsing data, you can download the browser add-on for disabling Matomo.

As for Flash Cookies, Adobe does not directly provide a tool to customize Flash Player settings related to their management. To access the various adjustments offered, it is necessary to access any web page containing the created content, right-click on it, choose the Global Settings option, then click on the General Privacy Settings Panel link. Alternatively, you can visit the Macromedia website directly.

Below are the instructions provided by the main browsers to delete, allow, and manage cookies:

• Internet Explorer: http://windows.microsoft.com/it-it/internet-explorer/delete-manage-cookies#ie=ie-11
• Chrome: https://support.google.com/chrome/answer/95647?hl=it
• Firefox: http://support.mozilla.org/it/kb/Eliminare%20i%20cookie
• Opera: http://www.opera.com/help/tutorials/security/privacy/
• Safari: https://support.apple.com/it-it/HT201265

List of cookies on the Site: