Privacy policy

Data controller

The controller is Leaders' International Liaison Association (LILA), the international students' association at LUISS Guido Carli, Viale Romania 32, 00197 Rome, Italy. Contact: ciao@lilastudenti.com.

The website is operated on LILA's behalf by a technical service provider. For website security matters you may also write to security@orpheus.bg or gotcha@orpheus.bg.

Scope

This policy applies to the public website at lilastudenti.com. Membership applications and some event registrations are handled on external forms. Those forms have their own privacy notices. LILA is the controller of information it receives from them in order to run the association.

You do not need an account to browse this website. Links to social networks or messaging groups take you to independent services; their own terms and privacy policies apply.

Categories of data

Depending on how you use the site, we may process:

• Technical data generated by your browser and our systems: IP address, date and time, requested pages, referrer, browser and device information, and security logs.
• Aggregated usage data from privacy-focused, cookieless analytics (for example page views, general visitor location, and device type).
• The content of messages you choose to send to us, including any personal data you include.

We do not use this website to collect membership lists or to run advertising profiles. Please do not send special-category data (such as health or beliefs) unless we have asked for it for a specific purpose.

Purposes and legal bases

We process personal data only as needed for the following purposes, under Article 6 GDPR:

• Providing and maintaining the website, including security, availability, and the investigation of abuse — legitimate interests (Art. 6(1)(f)).
• Understanding overall site usage through aggregated, cookieless analytics — legitimate interests (Art. 6(1)(f)).
• Responding to correspondence you send us — legitimate interests, or steps prior to a contract where relevant (Art. 6(1)(f) or Art. 6(1)(b)).
• Complying with legal obligations, including those relating to security incidents (Art. 6(1)(c)).

Where we rely on legitimate interests, we balance them against your rights. You may object to processing based on legitimate interests as described below.

Analytics

We use privacy-focused, cookieless analytics to understand overall site usage (for example page views, general visitor location, and device type). This information is aggregated. It is not used to identify you personally, to build a marketing profile, or for advertising.

Cookies

We use only what is strictly necessary for the site to function and remain secure, such as essential preferences stored on your device. We do not set advertising cookies.

The analytics described above does not use cookies. If we introduce non-essential cookies, we will update this notice and, where required, obtain consent.

Recipients

We do not sell personal data. Data may be processed by categories of recipients who assist us in operating the site, including hosting, security, and analytics providers, acting as processors under our instructions. We may also disclose data where required by law or to competent authorities.

International transfers

LILA is established in Italy. Some service providers may process data outside the EEA. Where that happens, we use a mechanism recognised by the GDPR, such as an adequacy decision or Standard Contractual Clauses.

Retention

We keep personal data only for as long as needed for the purposes above. Security logs are typically retained for no more than 12 months, unless a longer period is required to investigate an incident. Correspondence is kept for as long as needed to handle your request and for a short administrative period afterwards. Aggregated analytics is kept in non-identifying form. Data that is no longer needed is deleted or irreversibly anonymised.

Your rights

Subject to the conditions in Articles 15–22 GDPR, you may request access to your personal data, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, write to ciao@lilastudenti.com. We may need to verify your identity. We will respond within one month, or inform you if we need more time as permitted by the GDPR.

You may lodge a complaint with the Garante per la protezione dei dati personali (garanteprivacy.it). If your concern relates to website infrastructure, you may also contact the Bulgarian Commission for Personal Data Protection (cpdp.bg).

Security

We apply appropriate technical and organisational measures to protect personal data. No method of transmission or storage is completely secure. Vulnerability reports should follow the process in our Usage rules.

Children

This website is intended for university students and is not directed at children under 16. If you believe we have processed a child's data in error, contact us and we will delete it where required.

Changes

We may update this policy from time to time. The date at the top is the current version. The latest text is always published on this page.