Privacy Policy in accordance with Regulation (EU) 2016/679

The following information is given with respect to the personal data provided by the data subject on the digital platform for receiving applications to take part in the Encubator Acceleration Programme:

1. Data Controller and Data Protection Officer

The Joint Controllers are the Milan Monza Brianza Lodi Chamber of Commerce (hereinafter “Chamber of Commerce”), with office in Milan, Via Meravigli 9/B, and the Politecnico di Milano (hereinafter “Politecnico”), with registered office in Milan, Piazza Leonardo Da Vinci 32 which, as part of the Executive Agreement relating to the implementation of the Encubator Programme – Third Edition 2024-25, have jointly established the purposes and means of data processing and regulated their respective responsibilities with regard to compliance with the obligations deriving from the GDPR and Privacy Legislation, in accordance with Art. 26 GDPR.

The Data Protection Officer of the Chamber of Commerce, within the meaning of Art. 37 GDPR, may be contacted at RPD@mi.camcom.it, while the Data Protection Officer of the Politecnico di Milano, within the meaning of Art. 37 GDPR, may be contacted at privacy@polimi.it.

The External Data Processor, appointed by the Politecnico as agreed with the Chamber of Commerce, under Art. 28 of Regulation (EU) 2016/679, is PoliHub S.c.a.r.l. Società Benefit (hereinafter “PoliHub”), with registered office in Milan, Piazza Leonardo da Vinci 32, which will manage the Encubator Acceleration Programme along with the digital platform for receiving applications to participate therein.

The Joint Controller Arrangement within the meaning of Art. 26 GDPR is made available to the data subject through the contacts of each Data Controller mentioned above.

2. Purposes and legal basis of data processing

The data provided shall be processed to manage the different stages of participation in the Encubator acceleration programme, such as: receipt of applications, assistance in filling out forms, formal verification of admission requirements, management of communications to participants, verification of the growth path of award-winning companies, including expense reporting. 

The data processed are personal and contact data, such as name, surname and e-mail address.

The legal basis of data processing is, under Art. 6 (1)(e) of Regulation (EU) 2016/679, the performance of tasks carried out in the public interest connected with the promotion and support of entrepreneurship and the local economy, as assigned to the Chamber of Commerce by Law No. 580/1993 and to the Politecnico di Milano under Law 240/2010, the Statute of the Politecnico di Milano issued with Rector’s Decree No. 623/AG of 23 February 2012 and the spin-off Regulation of the Politecnico di Milano issued with Rector’s Decree No. 2399 of 07.10.2011, as amended, and the Intellectual Property Regulation of the University issued with Rector’s Decree No. 2400 of 07.10.2011 as amended.

The personal data provided by winners may be further processed in connection with their possible participation in future initiatives proposed by the Controllers; in that case, data subjects will be adequately informed of the corresponding methods and purposes of processing as well as of the relevant period of storage.

The application to participate in the programme involves the entering of the applicant’s data into the user interaction platform of the Chamber of Commerce (CRM), which is used to assist and interact with users so as to customise the support provided, discover their needs, improve services and offer those that best meet their needs.

The legal basis of any further processing on such platform is, under Art. 6 (1)(e) GDPR, the performance of the task carried out in the public interest established by P.A. reforms (specifically Legislative Decree 150/2009), which introduced the criteria of citizen centricity, with a view to improving, customising and meeting users’ expectations.

3. Processing methods

The data are collected, used and processed by the Parties as Joint Controllers, as regards the Chamber of Commerce and the Politecnico, and as External Data Processor as regards PoliHub S.c.a.r.l. Società Benefit, using manual, IT and electronic methods in accordance with the principles of fairness, lawfulness and transparency, in compliance with Regulation (EU) 2016/679 and national legislation on the processing of personal data.

The data shall be adequate, relevant and limited to what is necessary for the purposes for which they are processed. 

4. Data provision

Providing data is voluntary. Non-provision of data will prevent the acceptance and assessment of the application for the Encubator Programme, including the acceleration programme.

5. Recipients, communication and dissemination

The Politecnico di Milano, as Joint Controller with the Chamber of Commerce and as agreed therewith, has appointed PoliHub S.c.a.r.l. Società Benefit, with registered office in Milan, Piazza Leonardo Da Vinci 32, in its capacity of Data Processor within the meaning of Art. 28 of Regulation (EU) 2016/679, as the entity that will manage the Encubator Acceleration Programme along with the digital platform for receiving applications to participate therein.

The data may be communicated, solely to pursue the purposes set out in point 2, to the Organisers of the initiative, the project partners and the Selection Jury, whose members will be expressly authorised to process data by the Data Controllers.

Lastly, with regard to the purposes set out in the second paragraph of point 2, the data may be communicated to the personnel of other Chamber of Commerce offices who, in supporting and interacting with users in the course of service supply, shall be authorised to process data.

6. Storage period

The data provided will be processed for no more than twelve months and otherwise for no longer than is strictly necessary for the pursuit of the aforesaid purposes and will be stored for as long as is required by laws or regulations or to ensure due management of the procedure.

The data processed on the CRM platform will be stored for no more than 10 years.

7. Rights of data subjects and protection

Under Art. 15 et seq. GDPR, data subjects have the right to access their personal data, ask for their rectification, update or erasure if their data are incomplete, wrong or collected in breach of the law; they also have the right to object to processing, ask for anonymization of their data or restriction of processing. To exercise such rights, data subjects may write to the Joint Controllers’ contacts and their DPOs: dirgen@polimi.it, privacy@polimi.it and/or cciaa@pec.milomb.camcom.it, RPD@mi.camcom.it . Data subjects may also lodge a complaint with the Data Protection Authority, in accordance with the manner established by the Authority itself.