MLT initiative - Privacy notice on the processing of personal data personali

Pursuant to Article 13 of Regulation (EU) 679/2016 of 27 April 2016

This privacy notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter, the "GDPR") and Italian Legislative Decree no. 196 of 30 June 2003, as amended by Italian Legislative Decree no. 101 of 10 August 2018 (Personal Data Protection Code).

It concerns the Artificial Intelligence tools of the My Learning Talk - MLT initiative integrated into the Politecnico di Milano POK platform, available at pok.polimi.it.

At the current stage, these tools are available as a pilot version for a limited number of lecturers and students.

1. Data Controller

The Data Controller is Politecnico di Milano, represented by the General Director, acting by delegation of the Rector pro tempore, with registered office at Piazza Leonardo da Vinci 32, 20133 Milan, Italy - Tax Code/VAT no. 04376620151.

Contacts: dirgen@polimi.it | Certified email (PEC): polimi@cert.polimi.it

2. Data Protection Officer (DPO)

The Data Protection Officer can be contacted at privacy@polimi.it - Politecnico di Milano, Piazza Leonardo da Vinci n. 32, 20133 Milan, Italy.

3. Description of the service: what the system does and does not do

3.1 What the system does

The Artificial Intelligence tools of the My Learning Talk - MLT initiative integrated into POK (MTA - My Teaching Assistant, AiBook and AiDO) are adopted in accordance with the Decree of the General Director of Politecnico di Milano concerning the implementation of artificial intelligence tools in teaching and learning available at https://www.normativa.polimi.it/privacy-e-sicurezza (in Italian) and the "General principles for the conscious use of artificial intelligence tools in teaching and learning", available at https://www.polimi.it/en/education/documents-about-didactis.

These tools are based on Large Language Models. They enable:

• lecturers to receive support in course design (structure, content, definition of methods, and support in designing student learning assessments) through MTA - My Teaching Assistant;
• lecturers to create practice tools for students (review, simulation, comprehension checks) through AiBook and AiDO, based on course materials uploaded to the POK platform;
• students to interact conversationally with the teaching materials of their course through AiBook and AiDO, to the extent that the lecturer has activated and customised these tools.

From a technical standpoint, the service is implemented through Amazon Web Services AWS Bedrock and Retrieval-Augmented Generation (RAG) technology: the system answers users' questions by drawing exclusively on the course documents uploaded by the lecturer.

Amazon Web Services AWS Bedrock may use different language models (by way of example and without limitation: Anthropic Claude Sonnet, Amazon Nova Pro, Amazon Nova Lite, Mistral Large) in order to ensure the best performance from time to time. The models used may change over time, particularly after the pilot phase, depending on the technological evolution of the available services and the governance choices adopted by the University.

Materials uploaded by lecturers and, where applicable, students remain within the AWS Bedrock service and are not processed within the LLMs.

3.2 What the system does not do: declared functional limits

The system does not assess students or issue automatic judgements on their performance or preparation.

In particular:

• the system does not assess the performance, conduct or quality of lecturers' teaching activities. No report on an individual lecturer's work is generated or sent to Politecnico di Milano for assessment purposes;
• at the current stage, the system does not process audio or video recordings from platforms outside POK (e.g. Webex lecture recordings);
• the system does not respond to requests that are not relevant to the materials of the relevant course;
• the system is equipped with technical and organisational measures designed to limit responses to the scope of the course teaching content and to the purposes envisaged for the tools of the MLT initiative;
• the system does not profile users and does not make automated decisions that produce legal effects or similarly significantly affect the person (Article 22 of the GDPR);
• the system does not use users' interaction data to train or fine-tune third-party language models.

4. Purposes of processing, legal basis, categories of data and retention period

5. Methods of processing

Processing is carried out using electronic and automated tools. Access to the data is restricted to authorised Politecnico di Milano staff and to Processors appointed pursuant to Article 28 of the GDPR.

Each lecturer may activate all or some MTA tools for her/his course (MTA Design, MTA Teaching Assessment - visible only to lecturers and course collaborators) and may add or remove materials. Where provided, students may also add or remove materials.

The lecturer may use ready-made AiBook and AiDO tools (Review, Find the Error, Oral Simulation) or customise them through a "one click" natural-language procedure.

6. Categories of data subjects

• Students of Politecnico di Milano
• Lecturers of Politecnico di Milano
• Technical and administrative staff of Politecnico di Milano
• Authorised external users

7. Data recipients

In relation to the purposes indicated, data may be disclosed to the following categories of subjects, duly appointed as Processors pursuant to Article 28 of the GDPR:

• Amazon Web Services EMEA SARL (provider of the cloud infrastructure and AWS Bedrock service used to deliver the language model);
• providers of technical outsourcing and infrastructure maintenance services, operating on behalf of Politecnico di Milano;
• public authorities, where required by law.

8. Transfers to non-EU countries or international organisations

Personal data will be processed by the Data Controller within the territory of the European Union. Where, for technical and/or operational reasons, it becomes necessary to rely on entities located outside the European Union, or to transfer some of the data collected to technical systems and cloud-managed services located outside the European Union, the processing will be governed in accordance with Chapter V of the GDPR and authorised on the basis of specific decisions of the European Union.

All necessary precautions will therefore be adopted in order to ensure the fullest protection of personal data, basing the transfer on:

1. adequacy decisions concerning the recipient third countries issued by the European Commission;
2. appropriate safeguards provided by the third-party recipient pursuant to Article 46 of the GDPR;
3. the adoption of binding corporate rules.

9. Nature of data provision

The provision of data is mandatory in order to access the service functionalities. Refusal to provide the data makes it impossible to use the tools of the My Learning Talk - MLT initiative, without prejudice to the possibility of accessing the other functionalities of the POK platform that do not concern MLT.

10. Automated decision-making

Politecnico di Milano declares that the tools of the My Learning Talk - MLT initiative integrated into POK do not make decisions based solely on automated processing that produce legal effects concerning data subjects or similarly significantly affect them, pursuant to Article 22 of the GDPR.

The system is an aid and support tool: any assessment of students remains the exclusive responsibility of the lecturer.

11. Data subjects' rights

Data subjects have the right to:

• access their personal data (Article 15 of the GDPR);
• request rectification (Article 16 of the GDPR);
• request erasure in the cases provided for by law (Article 17 of the GDPR);
• request restriction of processing (Article 18 of the GDPR);
• receive their data in a structured and machine-readable format (data portability, where applicable under Article 20 of the GDPR);
• object to processing on legitimate grounds (Article 21 of the GDPR).

To exercise these rights, data subjects may contact the Data Controller or the DPO at privacy@polimi.it or at the postal address indicated above.

12. Right to lodge a complaint with the supervisory authority

Data subjects have the right to lodge a complaint with the Italian Data Protection Authority (https://www.garanteprivacy.it/web/garante-privacy-en/home_en - Piazza Venezia 11, 00187 Rome, Italy - tel. +39 06 6967 71) if they believe that the processing of their personal data is carried out in breach of the GDPR.

13. Updates

This privacy notice may be updated in the event of changes to the service or to the applicable legislation. The current version is always available on the POK platform.

Updated on 22 June 2026.