PRIVACY POLICY
in accordance with Article 13 of EU Regulation 2016/679

Festival Internazionale dell’Ingegneria — Politecnico di Milano

This notice explains how the Politecnico di Milano collects and uses the personal data of participants in the Engineering Festival, how it protects that data, and what rights you can exercise.

Who is the data controller?

The data controller is the Politecnico di Milano, represented by the Director General acting on behalf of the Rector pro tempore.

Contact: dirgen@polimi.it

In-house Coordinator for the “Engineering Festival”

Dr. Marcella Elvira Antonietta Logli, Director of Communications and External Relations. Email: marcellaelvira.logli@polimi.it

Data Protection Officer (DPO)

If you have any questions regarding the handling of your data, please contact us at: privacy@polimi.it

Why we collect your data and how long we keep it

What do we do with the data?	On what legal basis	What data	How long
Management of festival event registration: seat reservations, sending of access QR codes, attendance tracking, and distribution of organizational communications.	Esecuzione del contratto di prenotazione (art. 6, par. 1, lett. b) GDPR). For children under 14, registration must be completed by a parent or legal guardian acting as their representative.	First name, last name, date of birth, email address, phone number; as well as the first name, last name, and age of the participating minor	For up to 180 days after the Festival ends, after which they are deleted or anonymized.
Use of contact information for communications regarding future events. Subject to your specific and separate consent, the University may retain your contact information in order to send you informational communications regarding future editions of the Engineering Festival or similar events organized by the University.	La base giuridica del trattamento è il consenso dell’interessato (art. 6, par. 1, lett. a) GDPR). Il conferimento di tale consenso è facoltativo e il mancato rilascio non pregiudica in alcun modo la partecipazione agli eventi del Festival in corso.	First and last name, email address	I dati saranno trattati per tale finalità per un periodo di 24 mesi [dalla loro raccolta. Lei potrà comunque revocare il consenso in qualsiasi momento, senza pregiudicare la liceità del trattamento precedente, scrivendo a privacy@polimi.it o utilizzando il link di disiscrizione (unsubscribe) presente in calce alle comunicazioni che riceverà.
Photographic and video documentation of the Festival for the Politecnico’s institutional communications (website, social media, archival materials).	Environmental footage (non-identifiable subjects): institutional communication purposes (Art. 6, para. 1, subpar. e) of the GDPR) and dissemination of the images within the limits set forth in Art. 97 of Law 633/1941. Immagini identificabili di minori: consenso del genitore/tutore (art. 6, par. 1, lett. a) GDPR), raccolto tramite liberatoria sul posto. The dissemination of images related to public events may also take place for the purposes of institutional reporting and news coverage, in accordance with Article 21 of the Constitution and Articles 136–139 of Legislative Decree No. 196/2003, as well as the principles of essentiality, relevance, and proportionality.	Photos, videos, audio recordings.	The data will be retained for no longer than is strictly necessary to fulfill the purposes for which it was collected, in accordance with the principles of data minimization and proportionality. Specifically, the following criteria apply: Communication and social media purposes: Images remain published for as long as there is institutional interest in promoting the event or activity documented, unless a request is made for their removal or editorial update. Archival purposes: Images documenting events of particular public or institutional significance are retained indefinitely for historical archiving and collective memory purposes. News purposes: Retention is limited to the period during which the image retains its newsworthiness or informational value.
Subscribe to the Politecnico di Milano Newsletter – Events	Consent of the data subject (Article 6(1)(a) of the EU General Data Protection Regulation)	First Name, Last Name, Email Address	The personal data required to send the newsletter will be processed by the Data Controller until the data subject revokes their consent.

What happens if you don’t provide the information?

You must provide the required registration information to participate in the Festival; without it, you will not be able to complete your reservation.

Registration of children under 14

Registration is carried out by the parent or legal guardian, acting on behalf of the minor. By registering, the parent:

confirmation that you have parental responsibility for the child;
accept this policy on behalf of the minor;
You are responsible for the child’s behavior during the event.

Without this statement, the system will not allow you to complete the reservation

Registration of minors between the ages of 14 and 17

They may register on their own. For processing based on consent, consent may be given by a minor over the age of 14, subject to the possible involvement of a parent or guardian in the exercise of rights.

Photographs and video footage

During the Festival, we take photos and videos of the event to document it and share it on our channels. We take special care to protect underage participants.
The footage primarily captures the event’s settings, activities, and moments, and is shot without focusing on individual participants.
Areas where filming is taking place are marked with appropriate signage.
Anyone who does not wish to appear in the images may avoid these areas or write to privacy@polimi.it to request the removal of their image, providing details necessary for precise identification (such as a description, date, event, or, if available, a link or reference to the image), which are required to process the request.
*** Translated with www.DeepL.com/Translator (free version) ***

For images or footage that specifically and recognizably depict individual participants (such as close-ups), particularly minors, specific authorization from the individual concerned or their parent/guardian is required.

For more information, please refer to the Politecnico’s Level 2 Privacy Notice on Multimedia Content: polimi.it/privacy/contenuti-multimediali

How we use images

Images and audiovisual content collected during the Festival may be used in the following contexts:

institutional channels (website, portals, newsletters)
official social media channels; these platforms act as independent data controllers for processing activities following publication, in accordance with their respective terms of use and privacy policies.
institutional publishing and promotional materials
news reporting and journalism
the University’s historical archives

The images are not used for commercial purposes or shared with third parties for marketing purposes.

How we process data

The data is processed using computer systems and, where necessary, on paper. Access is restricted to authorized personnel at the Politecnico di Milano and to vendors working with the organization, in compliance with the security measures set forth in the GDPR.

Who we share your data with

The data is shared with:

the staff of the Politecnico di Milano involved in organizing the Festival;
technical service providers (e.g., video production companies, booking platforms), bound by a specific contract as data processors;
the competent authorities (police, judicial authorities), when required by law.

We do not sell or share data with third parties for commercial purposes.

Is data transferred outside of Europe?

Generally speaking, no: data is processed in Italy and within the European Union. If we were to use tools with servers located outside the EU, we would ensure that the transfer complies with the safeguards provided for by the GDPR, for example:

European Commission adequacy decisions;
clausole contrattuali standard (art. 46 GDPR).

Your rights

With regard to the personal data processed by the Politecnico di Milano, you may exercise at any time the rights provided for in Articles 15–22 of the GDPR, and in particular:

to obtain confirmation as to whether or not personal data concerning you is being processed and to access such data (right of access);
request the correction of inaccurate data or the completion of incomplete data (correction);
request the erasure of data in the cases provided for by law (erasure);
request the restriction of processing in the cases provided for in Article 18 of the GDPR (restriction);
object to the processing of your personal data, on grounds relating to your particular situation, in cases where the processing is carried out for the performance of a task carried out in the public interest (objection);
to receive the personal data provided and transmit it to another data controller, in cases where processing is based on a contract and carried out using automated means (data portability).

You may exercise your rights by writing to: privacy@polimi.it.

You may still file a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

Milan, April 2026