Privacy notice

1Who processes your data

lab.z14.it is the platform of the interaction design lab led by Prof. Michele Zannoni: tools for research and teaching, classes, assignments and submissions. Only people with an account created or approved by the lab can use it.

The data controller is [to be specified], [to be specified]. For any question about your data, and to exercise the rights described below, write to [to be specified].

2What data we process

• Account data: first and last name, email address, level in the lab (student, tutor, lecturer…), course or group and supervisor if given, language and preferences. If you sign in with Google, also the identifier Google assigns to your account: it lets us recognise you if your address changes.
• Profile picture, only if you choose to upload one. It is cropped and re-encoded, and camera metadata — location included — is removed.
• Teaching activity: the classes you join; your submissions (texts, links, files, code written in the online editor); your statement of the AI tools used for a piece of work; lecturers' scores and comments; the notices the platform sends you.
• Messages: what you write to other people in the lab and what they write to you — subject, text, participants, date. Only the people in the conversation can read them, and a copy of each message is emailed to you.
• Sign-in and security data: sign-in attempts (email typed and IP address), active "remember me" sessions (IP address, browser type, dates), the log of administrative operations (who did what and when, with the IP address).
• Web server logs: for each page requested, IP address, date and time, page address and browser. The server writes them, as for any website.

The platform does not ask for special categories of data (health, religious or political beliefs, and the like): please avoid putting them in your submissions.

3Why, and on what legal basis

• Providing your account and the lab's tools; managing classes, assignments, submissions and grading; sending service emails (invitation, password reset, enrolment outcome). Basis: performance of the service you request by using the platform (Art. 6(1)(b) GDPR).
• Protecting the platform: slowing down password guessing, reconstructing who changed what, spotting abuse and faults. Basis: legitimate interest in the security of the service (Art. 6(1)(f)).
• Aggregate traffic statistics (most viewed pages, number of visits), derived from server logs with no cookies and no profiling. Basis: legitimate interest (Art. 6(1)(f)).
• Profile picture and public profile: optional, and you change them from your account page whenever you like. Basis: consent (Art. 6(1)(a)).

Data is not used for advertising, nor sold or passed on. There is no automated decision-making or profiling: submission scores are assigned by lecturers.

4Who can see it

• The lecturers and tutors of the classes you join see and grade your submissions. Other students do not see them.
• The people you choose when you write a message receive it, on the site and by email, and stay in the conversation until they leave it. Nobody else can read it.
• Lab administrators manage accounts and see the data needed to do so. To test the platform they use test accounts, never those of real people.
• If you choose a public profile in your preferences, your name, level and picture appear on the People page, visible to signed-in users.
• Providers processing data on the controller's behalf, only as far as their service requires: Hetzner Online GmbH, Germania (server and database); Migadu, Switzerland (sending service emails).
• Google, only if you choose "Sign in with Google": Google knows you are signing in to lab.z14.it and sends us your name, email and account identifier. For its part Google acts as an independent controller, under its own privacy policy.

Pages load no scripts, fonts, analytics or other content from third-party sites: when you open lab.z14.it your browser talks only to our server.

5Transfers outside the European Union

Server and database are in the European Union. Service emails go through Migadu, in Switzerland, a country the European Commission recognises as providing adequate data protection. Signing in with Google may involve a transfer to Google LLC in the United States, which participates in the EU-U.S. Data Privacy Framework.

6How long we keep it

• Account, picture, enrolments, submissions, grades and notices: as long as the account exists. When it is deleted, submitted files and the profile picture go with it.
• Messages: as long as you stay in the conversation. If you leave, it disappears for you; when the last participant has left, it disappears entirely. Deleting your account deletes the messages you wrote.
• "Remember me" sessions: until they expire (30 days), you sign out, or you close them from your account page.
• Sign-in attempts: 30 days.
• Invitation and password reset links: valid for a few hours or days, and deleted 30 days after they expire.
• Administrative operations log: kept, because it is how we reconstruct who did what; the IP address is erased after 365 days.
• Web server logs: about 42 days, then overwritten.

7Your rights

You can ask at any time to access your data and get a copy, to correct it, to erase it, to restrict its processing, to object to processing based on legitimate interest, and to receive it in a machine-readable format. You can withdraw any consent given, without affecting what happened before. Write to [to be specified]: you will get an answer within one month.

Some things you can do yourself, from your account page: change your picture, preferences and password, and close sessions open on other devices.

If you believe the processing breaches the Regulation you can lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the authority of the country where you live or work.

8What is required

Name and email are needed to have an account: without them the platform cannot be used. Profile picture and preferences are optional. Submissions are those required by the assignments of the courses you attend.

9Cookies

The site only uses the technical cookies needed to sign you in and keep you signed in. The full list, with the purpose and duration of each, is on the cookie page.

10Changes

Last updated: 26/09/2026. Substantial changes are announced to users with a notice on the platform.