Pursuant to Articles 13 and 14 of the EU Data Protection Regulation 2016/679 ("GDPR"), we inform you of the following.

Purpose of processing and legal basis. 

The Association processes your personal data, i.e., in the case of a person who is a minor, it processes the latter's data with the prior authorization of the person exercising parental authority, exclusively for the purpose of carrying out its institutional activity and in particular:
(a) for the management of the association relationship (sending correspondence, convening meetings of the bodies, internal administrative procedures) and for the organization and
execution of the service;
b) for fulfilling legal obligations (e.g. tax, insurance, etc.) referring to the members of the Association;
c) for sending (by mail, e-mail, newsletter or cell phone number or other computerized means) communications related to the activities and initiatives of the Association;
d) in relation to images/videos, for publication on the Association's website, on the Association's social networks or in newsletters or printed material promoting the Association's institutional activities upon your explicit consent;
e) for the participation of members in courses, meetings and initiatives and for the organization and management of courses;
f) for statistical analysis, including in aggregate form.
The legal basis for the processing is the membership application and the membership contract (Art. 6 para. 1 lett. b GDPR), consent to processing (Art. 6 para. 1 lett. a - Art. 9 para. 2 lett. a GDPR), regular contacts with the Association (Art. 9 para. 2 lett. d GDPR), legal obligations to which the Association is bound (Art. 6 para. 1 lett. c GDPR).
Methods and principles of processing. 

The processing will take place in compliance with the GDPR and Legislative Decree No. 196/03 ("Code regarding the protection of personal data"), as well as with the principles of lawfulness, correctness and transparency, adequacy and relevance, using paper and computer methods, by persons authorized by the Association and with the adoption of appropriate protective measures, so as to ensure the security and confidentiality of the data. No automated decision-making process will be turned.
Necessity of Provision. 

The provision of personal and contact data is necessary as it is strictly related to the management of the association relationship. Consent to the use of images/videos and dissemination of data on the institutional website and in the other ways described above is optional.
Communication of data and transfer abroad of data. 

Data may be communicated to other members for the purposes of organization and execution of service, for the organization of courses, seminars, conferences and events, and for the submission of nominations for social offices. The data may be communicated to the subjects deputed to the performance of activities to which the Association is obliged by law (accountant, insurer, systems analyst, etc.) and to all those individuals and/or legal entities, public and/or private when the communication is necessary or functional to the performance of the institutional activity (trainers, Local Authorities, companies that take care of computer maintenance, companies that organize courses, etc.). Data may be transferred to recipients based outside the EU that have signed agreements aimed at ensuring an adequate level of protection of personal data, or in any case after verification that the recipient guarantees adequate protection measures. Where necessary or appropriate, parties to whom data is transferred for the purpose of carrying out activities on behalf of the Association will be appointed as (external) Data Processors pursuant to Article 28 GDPR.
Data Retention Period.

The data will be used by the Association until the termination of the association relationship. After that date, they will be retained for archival purposes, legal or accounting or tax obligations or for the Association's protection needs, with the exclusion of communication to third parties and dissemination in each case applying the principles of proportionality and minimization.
Rights of the interested party. 

As a data subject, you are guaranteed all the rights specified in Articles 15 to 20 of the GDPR, including the right to access, rectification and erasure of data, the right to restrict and object to processing, the right to withdraw consent to processing (without prejudice to the lawfulness of the processing based on the consent acquired before the revocation), as well as the right to lodge a complaint with the Garante per la Protezione dei dati personali if you believe that the processing concerning you violates the GDPR or Italian law. The above rights may be exercised by written communication to be sent by e-mail, p.e.c. or fax, or by registered mail at the Association's headquarters.

Data Controller. The data controller is the International Club Association, based in Milan at 12 Via Vizzola. Email addresses: international.club@gmail.com, info.erasmus+mentoring@unimib.it