Cookie Policy

1. Introduction

This Cookie Policy describes the types of cookies and similar technologies used by Scuola Internazionale Superiore di Studi Avanzati (hereinafter "SISSA" or "Data Controller") on the website mcs.sissa.it and provides users with all the information required by applicable legislation, in particular:

• Regulation (EU) 2016/679 (GDPR);
• Directive 2002/58/EC ("ePrivacy"), as transposed in Italy by Legislative Decree 196/2003 and subsequent amendments;
• Guidelines of the Italian Data Protection Authority (Garante) of 10 June 2021 on cookies and other tracking tools.

This notice is to be considered an integral part of the website's general Privacy Policy, to which reference is made for information concerning the processing of personal data.

2. What cookies are

Cookies are small text files that the websites visited send to the user's browser, where they are stored to be retransmitted to the website on the next visit. Similar technologies (such as web beacons, pixels, local storage) allow information to be collected in a similar way.

Cookies can be classified according to:

• Who installs them: first-party cookies (set directly by mcs.sissa.it) and third-party cookies (set by different domains, managed by third parties);
• Duration: session cookies (deleted when the browser is closed) and persistent cookies (with a defined expiry date);
• Purpose: technical cookies (necessary for operation), analytical cookies (usage statistics) and profiling cookies (creation of user profiles, including for advertising purposes).

3. Data Controller

The Data Controller is Scuola Internazionale Superiore di Studi Avanzati , with registered office at Via Bonomea 265 – 34136 Trieste – Italia, , VAT no. 80035060328 .

For any request relating to this Cookie Policy or to the exercise of the rights granted by the GDPR (Articles 15-22), the Data Controller can be contacted using the following details: e-mail info@sissa.it , tel. +39 040 378 7111 .

4. Categories of cookies used on the website

The website uses the types of cookies described below. The tables show the name, provider, purpose, category and duration of each cookie.

4.1 Technical and consent management cookies

Technical cookies are necessary for the correct functioning of the website and for the proper provision of the services requested by the user. Pursuant to the provision of the Italian Data Protection Authority and Article 122 of the Privacy Code, the installation of such cookies does not require the user's prior consent. This category also includes cookies used to store the choices made on the cookie banner.

• SESS<hash> / SSESS<hash>
  Provider: mcs.sissa.it (first party)
  Purpose: Session cookie used by the Drupal platform to identify the user's browsing session, maintain the authentication state in restricted areas and ensure the correct functioning of the website.
  Category: Technical / session
  Duration: Session (deleted when the browser is closed)
• cookie-agreed
  Provider: mcs.sissa.it (first party)
  Purpose: Stores the user's choice regarding the cookie banner (accepted / rejected / selected categories). Necessary to avoid showing the banner again on every visit.
  Category: Technical (consent management)
  Duration: 180 days
• cookie-agreed-version
  Provider: mcs.sissa.it (first party)
  Purpose: Stores the version of the cookie notice on which consent was given, so as to request new consent if the policy is updated.
  Category: Technical (consent management)
  Duration: 180 days
• cookie-agreed-categories
  Provider: mcs.sissa.it (first party)
  Purpose: Stores the categories of cookies (analytical, video, etc.) for which the user has given consent.
  Category: Technical (consent management)
  Duration: 180 days
• has_js
  Provider: mcs.sissa.it (first party)
  Purpose: Drupal technical cookie that indicates whether the user's browser supports JavaScript, used to serve content consistent with the client's capabilities.
  Category: Technical
  Duration: Session
• Drupal.toolbar.*
  Provider: mcs.sissa.it (first party)
  Purpose: Technical cookies set only for authenticated users with access to the Drupal administration panel, to store the toolbar state (e.g. menu open/closed). Not used for visitors of the public website.
  Category: Technical (back-end only)
  Duration: Persistent

4.2 Analytical cookies (Google Analytics)

The website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to collect statistical and aggregated information about the use of the website (number of visitors, most viewed pages, traffic sources, etc.). The identifier of the Google Analytics property used is G-WCL97MSWHM.

Analytical cookies are installed only with the user's prior consent, given via the cookie banner. Consent can be withdrawn at any time using the "Privacy settings" link on the website.

For more information on the processing carried out by Google, please refer to the privacy policy available at policies.google.com/privacy and to the page dedicated to opting out tools.google.com/dlpage/gaoptout.

• _ga
  Provider: Google Ireland Ltd. (Google Analytics 4)
  Purpose: Cookie used by Google Analytics to distinguish unique users by assigning a randomly generated client-side identifier. It allows statistical data on the use of the website to be collected (page views, visit duration, traffic source).
  Category: Third-party analytical
  Duration: 2 years
• _ga_WCL97MSWHM
  Provider: Google Ireland Ltd. (Google Analytics 4)
  Purpose: Cookie used by Google Analytics 4 to persist the session state and collect browsing information associated with the specific GA4 property (measurement ID G-WCL97MSWHM).
  Category: Third-party analytical
  Duration: 2 years
• _gid
  Provider: Google Ireland Ltd. (Google Analytics)
  Purpose: Cookie used by Google Analytics to distinguish users on a daily basis (possibly set depending on the configuration).
  Category: Third-party analytical
  Duration: 24 hours
• _gat / _gat_gtag_*
  Provider: Google Ireland Ltd. (Google Analytics)
  Purpose: Cookie used to limit the rate of requests to the Google Analytics servers (throttling).
  Category: Third-party analytical
  Duration: 1 minute

4.3 Third-party video cookies (YouTube)

The website is set up to host video content via the YouTube service, provided by Google Ireland Limited. When a YouTube video is embedded in a page of the website, YouTube may install its own cookies on the user's device. Such cookies are installed only with the user's prior consent, given via the cookie banner. In the absence of consent, the videos are not loaded.

As of the last update of this policy, the website does not contain embedded YouTube videos: all videos present are hosted directly on the mcs.sissa.it domain. The category is kept in the banner to allow the possible future integration of YouTube content without requiring changes to the notice.

For further information, please refer to the Google/YouTube privacy policy available at policies.google.com/privacy.

• VISITOR_INFO1_LIVE
  Provider: Google Ireland Ltd. (YouTube)
  Purpose: Cookie set by YouTube when a YouTube video is embedded in the website. It measures the user's bandwidth to determine whether to use the new or the old player interface.
  Category: Third-party profiling
  Duration: 6 months
• YSC
  Provider: Google Ireland Ltd. (YouTube)
  Purpose: YouTube session cookie used to keep track of views of embedded videos.
  Category: Third-party profiling
  Duration: Session
• PREF
  Provider: Google Ireland Ltd. (YouTube/Google)
  Purpose: Cookie used by YouTube to store the user's preferences and information (e.g. language, region, playback quality).
  Category: Third-party profiling
  Duration: 8 months
• __Secure-YEC, VISITOR_PRIVACY_METADATA, etc.
  Provider: Google Ireland Ltd. (YouTube)
  Purpose: Additional cookies possibly set by YouTube/Google in relation to consent and the privacy settings of the video player.
  Category: Third-party profiling
  Duration: From 6 months to 2 years

5. Other third-party services used by the website

The website uses the following third-party services which, although they do not install cookies on the user's device, involve the transmission of browsing data (e.g. IP address, user-agent) to the relevant providers for loading the resources:

• Google Fonts - Provider: Google Ireland Limited. Purpose: loading the typographic fonts used by the website. Transmission of the IP address to Google when the font is loaded. Privacy policy: policies.google.com/privacy.
• jsDelivr CDN - Provider: Prospect One sp. z o.o. (cdn.jsdelivr.net). Purpose: distribution of open source JavaScript libraries (slick-carousel) used for displaying content. Does not install cookies. Privacy policy: jsdelivr.com/terms/privacy-policy-jsdelivr-net.

6. Legal basis of the processing

The processing of personal data carried out through technical cookies is based on the legitimate interest of the Data Controller in ensuring the correct functioning of the website (Article 6(1)(f) GDPR) and on Article 122 of Legislative Decree 196/2003, which excludes the need for consent for technical cookies.

For third-party analytical cookies and for profiling cookies (including the loading of YouTube videos), the legal basis is the user's free, specific, informed and unambiguous consent (Article 6(1)(a) GDPR).

7. Transfer of data outside the EU

The use of third-party services such as Google Analytics and YouTube (Google Ireland Limited) may involve the transfer of personal data to non-EU countries, in particular to the United States, where some servers of the Google group companies are located. Such transfers take place in compliance with Chapter V of the GDPR, on the basis of adequate safeguards such as the Standard Contractual Clauses approved by the European Commission and/or the provider's adherence to the "EU-U.S. Data Privacy Framework".

8. How to manage or withdraw consent to cookies

The user can change their cookie preferences at any time:

• by clicking on the "Privacy settings" link on the website, which reopens the consent management banner and allows the choices made to be modified or withdrawn;
• by configuring their browser to block or delete cookies already installed. Please note, however, that disabling technical cookies may compromise the correct functioning of the website.

Below are the links to the instructions of the main browsers for managing cookies:

• Google Chrome
• Mozilla Firefox
• Microsoft Edge
• Apple Safari
• Opera

9. Rights of the data subject

In relation to the processing of personal data carried out through cookies, the user may exercise at any time the rights provided for by Articles 15-22 of the GDPR: access, rectification, erasure, restriction, objection, portability and withdrawal of consent. The right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) is also recognised.

To exercise their rights, the user can contact the Data Controller at info@sissa.it .

10. Updates to this Cookie Policy

The Data Controller reserves the right to update this Cookie Policy at any time, in particular in response to regulatory changes or changes in the technologies used on the website. The date of the last update is indicated on the first page of the document. In the event of substantial changes, the user will be asked to give their consent again on the cookie banner.