Privacy notice
1. Why this notice is provided
Pursuant to Regulation (EU) 2016/679 (hereinafter, theRegulation ) and Legislative Decree no. 196 of 30 June 2003, as amended, this notice describes how the personal data of users who browse the web pages and use any services at https://web.infn.it/hepscape/ are processed.
It applies to those who interact with the website identified above, and not to other websites that may be accessed through links to external resources.
2. Data Controller
Italian National Institute for Nuclear Physics (INFN)
Via E. Fermi 54, Frascati (Rome), Italy
email: presidenza@presid.infn.it
Certified email (PEC): amm.ne.centrale@pec.infn.it
3. Data Protection Officer
The Data Protection Officer can be contacted by email at dpo@infn.it
4. Processing personal data through the website
The personal data described on this page are processed by INFN to fulfil its institutional purposes, including promoting and providing scientific education and disseminating knowledge in its fields of activity, in the performance of tasks carried out in the public interest or in the exercise of official authority.
Processing means any operation or set of operations involving the collection, recording, organisation, storage, consultation, processing, modification, selection, retrieval, comparison, use, interconnection, blocking, disclosure, erasure and destruction of data.
The types of data processed through the Institute’s web pages are described below.
5. Types of data processed
5.1 Browsing data
During their normal operation, the computer systems and software procedures used to run this website acquire certain personal data whose transmission is implicit in the use of Internet communication protocols. These include the user’s IP address, browser type, referring websites, pages visited within the website, access time, the numerical code indicating the server’s response status, and other parameters relating to the user’s operating system and computing environment.
These data, which are necessary to use the web services, are used to ensure their correct operation and security. They may also be used to establish liability in the event of cybercrime or damage to the website. Except in such cases, they are retained no longer than necessary to carry out system security checks, and for a maximum of 30 days.
5.2 Data provided by users
Registration is not required to browse the public pages. The administrative area is restricted to authorised personnel.
Data provided in enquiries are processed to respond within the institutional purposes described in section 4 and retained for the time needed to handle the enquiry, subject to applicable retention obligations. Separate notices are provided for any specific services.
Sending email to the addresses listed on this website is optional, explicit and voluntary. Doing so entails the subsequent collection of the sender’s address, which is needed to respond, and any other personal data included in the message.
Sensitive data or data relating to judicial matters are not processed; if provided by the user, they will be deleted.
5.3 Cookies and absence of tracking
The website does not use analytics tools, including Matomo, profiling or advertising cookies, or other tools to track visits. No cookie consent banner is therefore displayed.
Technical functions, such as authentication for authorised staff in the administrative area, may use cookies strictly necessary for the requested service. These cookies are not used to analyse visitor behaviour or for advertising, and do not require consent. Cookies can be managed or deleted through the browser; blocking technical cookies may prevent the relevant functions from working.
5.4 Locally hosted resources and external links
Images, fonts and other resources used on the public pages are hosted on the INFN website. Social media and external platform content can be accessed through links, without embeds that load automatically during a visit.
When opening an external link, users access another website, which processes data according to its own privacy notice and any cookie policy.
6. Disclosure and dissemination
In carrying out its activities and providing its services, the Data Controller may disclose data to:
- Public administrations;
- Technical service providers, hosting provider and cloud service provider;
- Judicial authorities.
Collected data will not be disseminated or disclosed to third parties except as provided for in this notice and by law, and only in the ways they permit. Institute staff may access the data within their respective duties and in accordance with the instructions they receive, solely to fulfil the purposes described in this notice.
Where necessary, recipients are appointed as Data Processors by the Data Controller, from whom an up-to-date list may be requested. Under their contracts, these processors must use personal data exclusively for the purposes specified by the Controller, retain them no longer than the specified period, and not transfer them to third parties without the Controller’s explicit authorisation.
Personal data provided by users submitting enquiries or suggestions are used solely to deliver the requested service. They may be shared with other areas of the Institute or other public or private bodies only when necessary to complete the request. Data are not transferred to countries outside the EU.
7. How data are processed
Personal data are processed primarily using electronic procedures and media, lawfully, fairly and in a manner that is relevant and limited to what is necessary for the purposes of processing. They are retained only for the time needed to achieve the purposes for which they were collected and in accordance with the principles set out in Article 5 of the Regulation.
Specific security measures are taken to prevent data loss, unlawful or improper use, and unauthorised access.
8. Where data are processed
Personal data processing associated with this website’s web services takes place at INFN facilities and is performed only by the technical staff of the office responsible for processing, or by processors appointed by the Data Controller and operating within the European Union.
9. Data subjects’ rights
Data subjects have the right to ask the Data Controller for access to their personal data, rectification or erasure, restriction of processing, or to object to processing, as provided for in Article 15 and subsequent articles of the Regulation. Requests should be submitted to the Data Protection Officer at the address given above.
Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority or seek a judicial remedy (Articles 77 and 79 of the Regulation).
10. Updates
This notice may be updated to comply with relevant national and EU legislation. Please consult it periodically.
Last updated: 2 October 2026.
Unless otherwise specified, the privacy policy published on the website continues to apply to personal data collected before it was replaced.