Privacy Policy

Data controller and contact details

The data controller is IUS@B, the Bocconi law students association. For information or to exercise your data protection rights, email as.iusatb@unibocconi.it.

Data we process

The website may process technical browsing data, such as IP address, request date and time, device information, and security logs; data submitted through newsletter subscriptions, applications, and interview bookings; data included in messages voluntarily sent to the association; and authentication data reserved for administrators.

Purposes and legal bases

• to manage applications, drafts, selection processes, and interviews requested by the user: steps taken at the data subject’s request before entering into an arrangement;
• to send the newsletter: consent, which can be withdrawn at any time through the link in each message;
• to respond to requests and messages: performance of the request and the legitimate interest in managing relationships with users;
• to protect the website, prevent abuse, and ensure service continuity: the controller’s legitimate interest in security;
• to comply with legal obligations or requests from public authorities: legal obligation.

Providing your data

Data marked as required is necessary to provide the requested service; if it is not supplied, the relevant operation cannot be completed. Newsletter subscription is optional. No solely automated decisions producing legal effects for the data subject are made.

Recipients and service providers

Data is accessible to authorized IUS@B members and, where necessary, to the providers supporting the website: Vercel for hosting and delivery, Supabase for the database and authentication, Resend for email, and Cloudflare Turnstile for abuse prevention. Data may also be disclosed to public authorities when required by law.

International transfers

Some providers may process data outside the European Economic Area. In such cases, transfers rely on an adequacy decision, standard contractual clauses, or another safeguard provided by the GDPR. You can request more information by contacting the data controller.

Retention

Data is retained for as long as necessary for its purpose: applications for the duration of the selection process and any subsequent period needed to handle disputes or applicable obligations; newsletter data until consent is withdrawn or the user unsubscribes, except for the minimum information required to document that event; technical and security logs for periods proportionate to abuse prevention; and communications for as long as needed to handle the request.

Your rights

Where Articles 15–22 GDPR apply, you may request access, rectification, erasure, restriction, portability, or object to processing, and you may withdraw consent without affecting the lawfulness of earlier processing. You may lodge a complaint with the Italian Data Protection Authority.

Cookies and technical tools

Information about cookies, local storage, and security services is available in the Cookie Policy.

Updates

This policy may be updated when services or processing activities change. The version published on this page is the applicable version.

Last updated: August 12, 2026.