Version 1.2 – last updated: 23 October 2026. This English translation is provided for convenience only: in case of any discrepancy, the Italian version (https://ricerca-innovazione.enea.it/privacy) prevails.

INFORMATION PURSUANT TO ARTICLE 13 OF REGULATION (EU) 679/2016 ON THE PROCESSING OF PERSONAL DATA (GDPR – General Data Protection Regulation)

This notice is provided by ENEA – Agenzia nazionale per le nuove tecnologie, l’energia e lo sviluppo economico sostenibile (Italian National Agency for New Technologies, Energy and Sustainable Economic Development), pursuant to art. 13 of Regulation (EU) 2016/679 – General Data Protection Regulation, with regard to the personal data provided through the website https://ricerca-innovazione.enea.it (hereinafter also the “Site”).

This notice covers only the processing of Users’ personal data collected through the Site and not other websites that may be consulted through links (such as redirection to social media pages).

1. IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER

The Data Controller is ENEA – Agenzia nazionale per le nuove tecnologie, l’energia e lo sviluppo economico sostenibile, with registered office in Roma 00196, Lungotevere Thaon di Revel, 76. You may contact the Data Controller by writing to the address above or by sending an e-mail to the certified e-mail address: enea@cert.enea.it

2. CONTACT DETAILS OF THE DATA PROTECTION OFFICER (DPO)

ENEA’s Data Protection Officer (DPO) was appointed by Provision no. 34/2020/PRES of 6 February 2020. For communications relating exclusively to the processing of personal data, the DPO can be contacted at the following e-mail address: dpo@enea.it

3. PURPOSES AND LEGAL BASIS OF THE PROCESSING

Users’ personal data are processed in order to:

• respond to requests sent to the e-mail addresses published on the website;
• comply with legal or administrative obligations.

Personal data are processed by ENEA for the pursuit of its institutional purposes, including the promotion and provision of scientific training and the dissemination of culture in its institutional sectors, always in the performance of its tasks carried out in the public interest or in the exercise of official authority.

4. NATURE OF THE PROVISION OF DATA

The provision of personal data, by sending communications to the e-mail addresses published on the Site to request information, is optional; however, if the requested data are not provided, ENEA will not be able to provide the service requested from time to time.

5. TYPES OF DATA PROCESSED

5.1. Browsing data

The computer systems and software applications dedicated to the operation of this website record, in the course of their normal operation, certain data (whose transmission is implicit in the use of Internet communication protocols) that are not associated with directly identifiable users.

The data collected include the IP addresses of the computers used by Users who connect to the site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (success, error, etc.) and other parameters relating to the operating system and the IT environment used by the user.

5.2. Data provided voluntarily by the User

Other personal data collected are those provided by the User by sending communications to the e-mail addresses published on the Site: in that case the sender’s address, which is necessary in order to reply, is acquired together with any other personal data contained in the message (for example name, contact details, organisation of belonging).

The optional, explicit and voluntary sending of personal data that are not mandatory, including through e-mail messages sent to the addresses published on this site, entails the subsequent acquisition of such data, of the sender’s address necessary to reply, and of any other personal data included in the message.

5.3. Search text

If the User uses the free-text search, the text typed in the search box is recorded, together with the references of the returned cards, in a database of the Site. The record is linked solely to the searched text and to the instant of the search: it is not associated with the User’s IP address, with cookies or with other information that may identify the User.

The processing is based on the Data Subject’s consent (art. 6, para. 1, lett. a, of the Regulation) and is aimed at improving the quality of the search service. Providing consent is not mandatory: a User who does not consent may use the filters by category, department, TRL level and licence, which do not involve the recording of any text. Consent is requested through a specific notice when the search is opened and may be withdrawn at any time with the “Cambia la scelta” (change my choice) command next to the search box; if consent is withdrawn, free-text search is disabled. The choice made is stored on the User’s device: see the section “Cookies and local storage notice”.

Together with the search text, a random code generated by the browser is sent to ENEA’s servers; the Site stores only its cryptographic fingerprint (hash), not linked to the IP address. It is used to group the searches made from the same browser and to give effect to any erasure request (art. 17 of the Regulation). The code is shown next to the search box and may be communicated toenea@cert.enea.it to request the erasure of the searches associated with it.

In the free-text search, Users are invited not to type their own or third parties’ personal data that are not necessary for the search (for example names, contact details or health data): the text typed is recorded as described above and is not filtered by the Site.

6. PROCESSING METHODS AND DATA RETENTION PERIOD

Personal data are processed by electronic means, in compliance with art. 32 of GDPR 2016/679 and with the other provisions and specific measures of the Italian Data Protection Authority regarding security measures.

The Controller ensures that the personal data processed:

• are processed lawfully, fairly and in a transparent manner in relation to the Data Subject;
• are collected and recorded for specified, explicit and legitimate purposes and used in further processing operations in a manner compatible with those purposes, and in any case only to the extent necessary to pursue those purposes (in this respect, the use of personal data and identifying data must be reduced to a minimum);
• are accurate and, where necessary, kept up to date;
• are relevant, complete and not excessive in relation to the purposes for which they are collected and subsequently processed;
• are stored in a form that allows their erasure and rectification (as well as the subsequent notification to any recipients to whom the personal data have been transmitted following a request for rectification or erasure), as well as restriction of or objection to the processing;
• are kept in a form that permits identification of the Data Subject for no longer than is necessary for the purposes for which they were collected and subsequently processed.

In particular, browsing data (web server logs) are retained for 14 days, with daily rotation of the files and automatic deletion at the end of that period, while personal data provided voluntarily by the User are retained for the time necessary to respond to the Data Subject’s requests, for the time necessary to provide the services requested through the Site and for the retention periods imposed by legal or regulatory obligations.

Sending e-mail to the addresses published on this Site entails the subsequent acquisition of the sender’s address, which is necessary in order to reply, as well as any other personal data included in the message.

The personal data provided by Data Subjects who submit such requests are used solely for the purpose of performing the services envisaged or responding to requests, and are disclosed to third parties only where this is necessary for those purposes.

ENEA adopts the security measures required by the GDPR to protect the data collected, in order to prevent the risks of loss or theft of data, unauthorised access, unlawful and improper use.

The text of the searches performed with the free-text search is retained for 90 days from recording, after which it is automatically deleted.

7. CATEGORIES OF RECIPIENTS

For the purposes indicated in art. 3, the User’s personal data may be disclosed to or made accessible to:

• ENEA employees and collaborators, in their capacity as persons authorised to process personal data pursuant to art. 29 GDPR;
• any further service providers outsourced on behalf of the Controller (e.g. providers of IT and/or postal services), in their capacity as data processors;
• all parties to whom access to such data is granted under legislative or authoritative measures; and all natural and/or legal persons, public and/or private, where disclosure is necessary or functional to the provision of the services requested through the Site, in the manner and for the purposes described above.

Under no circumstances will personal data be disclosed, disseminated, sold or otherwise transferred to third parties for unlawful purposes or, in any event, without adequate information to Data Subjects and without obtaining their prior consent, where required by law.

Any disclosure of data at the request of the judicial or public security authorities, in the manner and in the cases provided for by law, remains unaffected. Personal data will not be transferred abroad to countries or international organisations outside the European Union that do not ensure an adequate level of protection recognised pursuant to art. 45 GDPR on the basis of an adequacy decision of the EU Commission. Should it be necessary for the provision of the Site’s services, the transfer of personal data to countries or international organisations outside the EU for which the Commission has not adopted an adequacy decision pursuant to art. 45 GDPR will take place only where adequate safeguards are provided by the recipient country or organisation pursuant to art. 46 GDPR and on condition that Data Subjects have enforceable rights and effective remedies.

In the absence of an adequacy decision of the Commission pursuant to art. 45 GDPR, or of adequate safeguards pursuant to art. 46 GDPR, including binding corporate rules, the cross-border transfer will take place only if one of the conditions set out in art. 49 GDPR is met.

8. RIGHTS OF DATA SUBJECTS

Articles 15-22 of the Regulation grant the Data Subject the exercise of the following rights:

• to obtain confirmation as to whether or not personal data concerning them exist (art. 15 para. 1);
• to obtain information about the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed and, where possible, the retention period (art. 15 para. 1 lett. a, c);
• to obtain rectification and erasure of the data (arts. 16 and 17);
• to obtain restriction of processing (art. 18);
• to obtain from the Controller information about the recipients to whom the personal data have been transmitted and about any rectification or erasure or restriction of processing (art. 19);
• to data portability, i.e. to receive the data from the Controller in a structured, commonly used and machine-readable format and to transmit them to another controller without hindrance (art. 20);
• to object to automated decision-making concerning natural persons, including profiling (arts. 21 and 22);
• where processing is based on consent, to withdraw it at any time (art. 7 para. 3).

Data Subjects have the right to lodge a complaint with the supervisory authority pursuant to art. 77 of the Regulation, or to seek judicial remedies.

9. EXERCISING RIGHTS

The rights set out above are exercised by a request addressed to the Data Controller by sending an e-mail message to enea@cert.enea.it. The request is formulated freely and without formality by the Data Subject, who is entitled to receive adequate feedback within a reasonable time, depending on the circumstances of the case.

Data Subjects may avail themselves, for the exercise of their rights, of bodies, organisations or non-profit associations whose statutory objectives are of public interest and which are active in the field of the protection of Data Subjects’ rights and freedoms with regard to the protection of personal data, by granting them a suitable mandate. Data Subjects may also be assisted by a trusted person.

Further information on the purposes and methods of processing personal data may be obtained by writing to dpo@enea.it with the subject “Privacy - Direzione Innovazione e Sviluppo”.

To learn about their rights, lodge a complaint/report/appeal and stay updated on legislation on the protection of individuals with regard to the processing of personal data, Data Subjects may contact the Italian Data Protection Authority, consulting its website at Garante per la protezione dei dati personali — external site

COOKIES AND LOCAL STORAGE NOTICE

THE SITE DOES NOT USE COOKIES.

The Site does not set cookies, does not use profiling cookies nor cookies, pixels or other third-party identifiers, and does not load resources from external domains: scripts, stylesheets, images and fonts are served from the domain ricerca-innovazione.enea.it.

In order not to repeat the notice on every visit and to keep the state of the free-text search consistent, the Site stores on the User’s device two technical items, in the browser’s localStorage:

• name: ttec-consenso-ricerca;
• content: only the value “salva” (consent given) or “non-salva” (consent refused), without any code, identifier or personal data;
• purpose: to store the choice made in response to the notice “Salvataggio del testo di ricerca” (saving of the search text);
• recipients: none, the information remains in the User’s browser and is not transmitted to ENEA’s servers or to third parties;
• duration: until the User deletes the site’s data; the item has no automatic expiry.

The second item is ttec-consenso-token: it contains a random code generated by the browser when the User gives consent (UUID format), with the same purpose, the same recipients (none: it stays on the device) and the same duration as the previous item. The code is sent to ENEA’s servers together with the search text, which is recorded linked to the cryptographic fingerprint of the code and not to the code itself: this allows searches from the same browser to be grouped and erased on request of the Data Subject, without allowing ENEA to trace the User. The code is shown next to the search box.

This storage is technical and serves only to give effect to the User’s choice: it does not require prior consent under art. 122 of the Italian Personal Data Protection Code and is described here for the purposes of art. 13 of the Regulation and art. 5, para. 3, of Directive 2002/58/EC.

The User may change or withdraw the choice at any time with the “Cambia la scelta” command next to the search box, which reopens the notice, or by deleting the site’s data from the browser settings (Settings → Privacy and security → Clear browsing data → Site data): in this case the notice is shown again on the next visit. Where no choice is available, the notice is in any case shown on every new visit.