Skip to content

Privacy Notice

ReCaS Bari Authentication Service

Last updated: 29 September 2026

1. Service Description

The ReCaS Bari Authentication Service is a federated authentication service managed by the Italian National Institute for Nuclear Physics (INFN) to provide access to ReCaS Bari services and applications.

The service allows users to authenticate through the Identity Providers of INFN, the University of Bari Aldo Moro, and organizations belonging to the IDEM GARR AAI Federation or to identity federations participating in eduGAIN.

2. Data Controller

2.1 Data Controller Identity and Contact Details

Istituto Nazionale di Fisica Nucleare (INFN)
Via Enrico Fermi, 54
00044 Frascati (Rome), Italy

For technical information and requests concerning the ReCaS Bari Authentication Service, users can contact user support through the support request form or by writing to recas-support@lists.ba.infn.it.

2.2 Data Protection Officer

The INFN Data Protection Officer (DPO) can be contacted at:

dpo@infn.it

Further information is available on the INFN DPO website.

2.3 Jurisdiction and Service Location

The Data Controller is established in Italy. The service is provided by the ReCaS Bari infrastructure, located in Bari, Italy.
Geographical reference: IT-BA — Italy, Bari.

3. Categories of Personal Data Processed

3.1 Data Received from the Home Organization

During authentication, the Identity Provider of the user's home organization may transmit the following data to the service.

Attributes required to complete sign-in:

  • first name;
  • last name;
  • email address;
  • home organization;
  • Italian tax identification code (codice fiscale).

Optional attributes that the Identity Provider of the user's home organization may release, where available:

  • full display name used within the organization;
  • affiliation with the organization or role within it.

3.2 Technical and Usage Data

The following data may be processed to operate, secure, and troubleshoot the service:

  • date and time of authentication requests;
  • selected Identity Provider and its technical identifier;
  • IP address and technical client information, such as user agent and browser type;
  • application or service the user is requesting access to;
  • authentication outcome and error codes;
  • security events and logs needed to prevent and investigate anomalies, abuse, and incidents.

The credentials used at the user's home organization are not disclosed to ReCaS Bari, in accordance with the authentication protocol used, SAML 2.0.

4. Purposes of Processing

Personal data are processed to:

  1. authenticate the user;
  2. correctly and consistently link the federated identity to a local ReCaS profile;
  3. transmit the information needed to identify and authorize the user to integrated applications;
  4. verify that the attributes required for access are available;
  5. manage sessions, sign-ins, and sign-outs;
  6. provide technical assistance to users;
  7. ensure the security, integrity, and availability of the service;
  8. prevent and detect unauthorized access, abuse, and cybersecurity incidents;
  9. diagnose, maintain, and resolve service malfunctions;
  10. comply with legal obligations and lawful requests from competent authorities.

The data are not used for commercial or advertising purposes.

5. Recipients of Personal Data

Access to the collected data is restricted to ReCaS Bari technical staff authorized to manage the service, to the extent necessary to perform their duties. This staff may include employees or associates of INFN or the University of Bari Aldo Moro.

6. Data Retention

Data are retained for no longer than necessary for the purposes for which they are processed.

  • Authentication, security, and diagnostic logs: retained for 30 days, unless an extension is strictly necessary to investigate an incident, protect systems, or comply with a legal obligation.
  • Session data: the technical state cookie has a normal maximum lifetime of 20 minutes and is deleted when the authentication flow is completed, except in the event of technical interruptions to the flow.
  • Account information: email address, first name, last name, Italian tax identification code, and home organization are retained to ensure the proper operation and management of the account, until the user explicitly requests deletion of the account.

7. Cookies and Session Data

The service uses only technical cookies and tools necessary to perform federated authentication, protect the sign-in flow, and maintain the user's session.
The service does not use these cookies for advertising or commercial profiling.

8. Data Subject Rights

Where provided for by the GDPR, data subjects may exercise the following rights:

  • access to their personal data;
  • rectification of inaccurate data;
  • erasure;
  • objection to processing.

Requests can be sent through the support request form or by writing to recas-support@lists.ba.infn.it.

Requests to correct data originally supplied by the home organization must also be submitted to that organization's Identity Provider or help desk. ReCaS Bari cannot modify attributes managed by an external Identity Provider at their source.

9. Complaint to a Supervisory Authority

Data subjects have the right to lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority in the Member State where they reside or work, or where the alleged infringement occurred.