Under Regulation (EU) No 2016/679 of the European Parliament and the Council
This Privacy Policy Statement (the “Policy”) explains the processing by Villa I Tatti: The Harvard University Center for Italian Renaissance Studies of personal data provided by our fellows, visitors, employees, and others. The processing of personal data by Villa I Tatti is carried out according to the principles and processing methods provided for by the EU General Data Protection Regulation (the “Regulation”).
Villa I Tatti, based in Fiesole (FI), Via di Vincigliata n. 26, is the Data Controller, meaning the entity which, alone or jointly with others, determines the purposes and means of the processing of such personal data under this Policy. Under the Regulation, (i) “personal data” means any information relating to an identified or identifiable natural person; and (ii) “processing” means any operation or set of operations subject to the Regulation which is performed on personal data.
Fellows
"Fellows" are people who have applied for and/or obtained a Villa I Tatti fellowship. Villa I Tatti as the Data Controller processes the personal data supplied by fellows, including: academic title, first name, last name, email address, home/residence address, telephone number, gender, education, job position at the time the data is collected and work contact information, terms of leave from employment to pursue a fellowship, work history, nationality, first name and last name of partner, first name and last name (including age) of children, request for fellowships in progress or fellowships already obtained, any publications, foreign languages spoken, current project in progress for which the fellow asks for access to Villa I Tatti, references, first name, last name and telephone number of the person to contact in case of emergency. Villa I Tatti also processes such data with respect to former fellows.
Villa I Tatti also collects data necessary to process grant payments to fellows, including state-issued identity number such as US social security number or Codice Fiscale, Harvard identity number if any, bank information including bank account number, and passport information or US green card data where applicable including date and place of issue and expiration date. If Villa I Tatti is assisting a fellow to obtain an Italian visa, the travel itinerary will also be collected as well as information on the date of taking of fingerprints if any.
Purposes of data processing: review of applications for Villa I Tatti fellowships; determination of the total remuneration to be awarded for the fellowship; identification of the most suitable accommodation based on the composition of the fellow's family; for the purposes of Villa I Tatti archives; sending of any communications; access to the library and other Villa I Tatti resources and events and processing requests to photograph or reproduce library materials; listing on our website and in I Tatti Newsletter and in online and printed publications and social media (Facebook, Instagram, Twitter etc.) provided that any photo or video in which the person is identified will be used exclusively for internal lists unless consent has been obtained for public use; processing of payments; facilitation of visa for entry into Italy.
Visitors
A "visitor" is any person who requests to visit Villa I Tatti as a tourist or to attend a specific event such as a lecture, or graduate seminars as described below. Villa I Tatti as the Data Controller processes personal data provided by visitors, including: first name, last name, address of residence/domicile, e-mail address, telephone number.
Villa I Tatti also processes personal data provided by Harvard students who attend spring graduate seminars in order to book air travel and reimburse certain other expenses of such students, including: first name, last name, address of residence/domicile, e-mail address, telephone number, travel itinerary, expense records, Harvard identity number, bank information including bank account number, and passport information or US green card data where applicable including date and place of issue and expiration date.
Purposes of data processing: insertion of personal data in the electronic calendar - for internal use only - to indicate the day set for the tour or event, data entry in internal database at Villa I Tatti, after the tour or event is finished, only for historical/statistical purposes in order to understand who passed through Villa I Tatti.
Readers
A "reader" is a person who requests access to the Villa I Tatti library to access, borrow, study or reproduce library materials. Villa I Tatti as the Data Controller processes personal data provided by readers, including the information in the list of fields here: https://itatti.harvard.edu/berenson-library/request-access. We also request a copy of a personal identification instrument, for security purposes.
Purposes of data processing: allow access to the library, allow the use of academic resources made available by Villa I Tatti, manage requests to borrow, photograph or reproduce library materials.
Visiting Lecturers and Visiting Faculty
Visiting lecturers and visiting faculty stay at Villa I Tatti for varying periods to deliver instructional and academic talks or courses and to participate in our research activity. Villa I Tatti as the Data Controller processes the personal data supplied by visiting lecturers and visiting faculty, including: academic title, first name, last name, email address, home/residence address, telephone number, gender, education, current permanent job position at the time the data is collected, work history, nationality, first name and last name of partner, first name and last name (including age) of children, any publications, foreign languages spoken, first name, last name and telephone number of the person to contact in case of emergency. If Villa I Tatti is reimbursing expenses or paying a stipend, we will request a state-issued identity number such as US social security number or Codice Fiscale, Harvard identity number if any, bank information including bank account number, and passport information or US green card data where applicable including date and place of issue and expiration date.
Purposes of data processing: identification of the most suitable accommodation based on the composition of family; for the purposes of Villa I Tatti archives; sending of any communications; access to the library and other Villa I Tatti resources and events and requests to photograph or reproduce library materials; listing on our website and in I Tatti Newsletter and in online and printed publications and social media (Facebook, Instagram, Twitter etc.) provided that any photo or video in which the person is identified will be used exclusively for internal lists unless consent has been obtained for public use; processing of payments; facilitation of visa for entry into Italy for which a travel itinerary will also be collected.
Employees and Interns; Other Service Providers
Villa I Tatti as the Data Controller processes personal data supplied by employees and interns, and by independent individual service providers, which may include: first name, last name, email address, home/residence address, telephone number, gender, date of birth, health information, educational and work history, first name and last name of partner, first name and last name (including age) of children, first name, last name and telephone number of the person to contact in case of emergency; information necessary to process compensation and tax and social welfare payments such as a state-issued identity number such as US social security number or Codice Fiscale, Harvard identity number if any, bank information including bank account number, and passport information or US green card data where applicable including date and place of issue and expiration date; work authorization status; other information required by applicable regulations.
Purposes of data processing: evaluate applications for employment or other work relationship and communicate engagement decisions; administer work-related processes and facilitate employment-related operations, including compensation and payroll processing and the provision of employee benefits; satisfy legal, regulatory and contractual obligations.
Friends and Supporters
Villa I Tatti as the Data Controller processes personal data supplied by persons providing financial support and others interested in Villa I Tatti activities, including: first name, last name, email address, home/residence address, telephone number, Villa I Tatti associations and activities.
Purposes of data processing: provide information about and facilitate opportunities to engage with Villa I Tatti and with other interested persons through newsletters, events and gifts or donations; for Villa I Tatti archives; satisfy legal, regulatory and contractual obligations.
Other Data Processing
Villa I Tatti as the Data Controller will process personal data provided by persons wishing to obtain goods or services, such as publications or wine or olive oil, as necessary to complete the requested transactions, including contact information and payment card numbers where applicable.
We will place cookies as necessary to support certain website functions, such as log in. We also use analytic tools to analyze website traffic. No identifiable data is directly associated with these tools as used by Villa I Tatti.
Villa I Tatti as the Data Controller may also process or share personal data as necessary for preventing, investigating, taking action regarding or providing notice of fraud, unlawful or criminal activity, other misconduct, security or technical issues, or unauthorized access to or use of personal data or our website or data systems; responding to subpoenas, court orders, or other legal process; enforcing our agreements; protecting the health, safety, rights or property of you, us or others; and meeting legal obligations.
Legal Bases for Processing
Villa I Tatti as the Data Controller processes personal data for the purposes described above to facilitate transactions requested by data subjects and to meet its obligations (for example, award and administration of fellowships); on the basis of its legitimate interests (for example, managing access to its premises and collections); to satisfy its legal or regulatory obligations; or, where applicable, on the basis of data subject consent.
Further Data Processing Information
- Since Villa I Tatti is a department of Harvard University which is located in the United States of America, Villa I Tatti transfers personal data to Harvard University in the United States of America for processing and storage by entering the personal data provided in databases shared between Villa I Tatti as the Data Controller and Harvard University. Said transfers take place for the purposes/aims of processing indicated above. Your personal data may also be communicated to government Authorities and related Institutes for the purposes/aims of the processing, such as the Ministry of Universities, Institutes of Studies on the Italian Renaissance and other Institutes related to the activities carried out by Villa I Tatti and to others to whom, according to legal provisions, said data must be communicated.
- Villa I Tatti as the Data Controller also engages vendors and service providers to assist in its activities which may include processing by such vendors or service providers of personal data for the purposes described above.
- Personal data will be kept for the period necessary for the performance of the purposes described above for each type of person mentioned above and will be kept for the purposes of the historical/archival/statistical heritage of Villa I Tatti.
Your Rights
Villa I Tatti as the Data Controller will provide you, upon your reasonable, good faith request, with information about whether Villa I Tatti holds any of your personal data as part of the processing described in this Policy, to the extent required by and in accordance with applicable law. In certain cases, you may also have a right, with respect to your personal data processed under this Policy:
- to correct or update any of your personal data that is inaccurate;
- to restrict or limit the ways in which we use your personal data;
- to object to the processing of your personal data;
- to request the deletion of your personal data; and
- to obtain a copy of your personal data in an easily accessible format.
To submit such a request, you may contact Villa I Tatti by sending an email message to EEADataSubjectRequest(@)harvard.edu with a copy to gdpr(@)itatti.harvard.edu . Because we want to avoid taking action regarding your personal data at the direction of someone other than you, we will ask you for information verifying your identity. We will respond to your request within a reasonable timeframe.
You also have the right to withdraw your consent to the Villa I Tatti’s processing of your personal data under this policy, where processing is solely based on your consent, subject to certain limitations at law. If you withdraw your consent to the use or sharing of your personal data for the purposes set out in this Policy, you may not have access to all (or any) of the related services, and we might not be able to provide you all (or any) of the services. Please note that, in certain cases, Villa I Tatti as the Data Controller may continue to process your personal data after you have withdrawn consent or requested that we delete your personal data, if Villa I Tatti has a legal basis to do so, for example, to comply with an independent legal obligation, if the data is still needed for the lawful purposes for which it was obtained, or to pursue our legitimate interest in keeping our services and operations safe and secure.
If you have any complaints regarding our privacy practices, you have the right to make a complaint with your national data protection authority (i.e., supervisory authority).
This Policy is effective as of: 25/05/2018