In accordance with Article 13 of the General Data Protection Regulation (EU) 2016/679 (“GDPR” or “Regulation”), the Association EUGEN – EUROPEAN GENERATION APS, as Data Controller, provides data subjects with information regarding the processing of personal data collected during registration for courses promoted by the Association and during membership procedures.
Personal data will be processed in accordance with the principles of lawfulness, fairness and transparency, as well as in full respect of the fundamental rights and freedoms of natural persons, with particular regard to the protection of privacy and personal identity.

1. DATA CONTROLLER
The Data Controller (hereinafter the “Controller”) is:
EUGEN – EUROPEAN GENERATION Associazione di Promozione Sociale – APS
Tax Code: 97834840585
Registered office: Piazza Albania 35 – 00153 Rome, Italy
Represented by its acting President.
Contacts: Tel.: +39 3518770536 – Email: info@eu-gen.org – PEC: eugen-europeangeneration@pec.it

2. DATA PROTECTION OFFICER (DPO)
Pursuant to Article 37 of the Regulation, the Controller has appointed the Data Protection Officer (DPO): Massimo Corinti
Contact details: Email: dpo@corinti.eu – PEC: dpo@pec.corinti.eu

3. TYPES OF DATA PROCESSED
For the management of course registrations promoted by the Association and for membership purposes, the Association may process personal data of a common nature provided directly by the data subject through the registration form or subsequently during the membership relationship and participation in training activities.

In particular, the following categories of data may be processed:

• Personal identification data, such as name and surname, place and date of birth, address and country of residence;
• Contact details, such as email address and telephone number.

Information related to participation in training activities organised by the Association may also be processed, including:

• the selected course;
• data necessary for the organisation and delivery of lessons;
• information related to participation in learning activities delivered through digital platforms.

Within the administrative management of registrations, data necessary for accounting and administrative management of courses and association activities may also be processed. The processing concerns only ordinary personal data and does not involve the processing of special categories of personal data as defined by Article 9 of the Regulation.

4. PURPOSES AND LEGAL BASIS OF PROCESSING
The personal data collected are processed by the Association in order to:

• manage course registration requests;
• manage membership requests and the related membership relationship;
• organise and deliver training activities promoted by the Association.

The legal basis for this processing is Article 6(1)(b) GDPR, as the processing is necessary for the performance of pre-contractual measures requested by the data subject and for the subsequent management of the membership and training relationship.

Personal data are also processed to enable the organisational and operational management of training activities, including:

• communications regarding course schedules;
• sending links for accessing online lessons;
• sharing training materials;
• other activities strictly related to the delivery of the courses.

This processing is also based on Article 6(1)(b) GDPR.
Personal data may further be processed for the fulfilment of legal, administrative, fiscal and accounting obligations related to the management of association and training activities.

In this case, the legal basis is Article 6(1)(c) GDPR.
The Association may also use the contact details of members to send communications related to association life, initiatives and training activities promoted by the Association.

These communications are strictly connected to the management of the membership relationship and the institutional activities of the Association and are therefore based on Article 6(1)(b) GDPR.

5. METHODS OF PROCESSING AND ONLINE TRAINING ACTIVITIES
Personal data are processed using IT and electronic tools and, where necessary, paper-based documentation, in compliance with the principles of security, confidentiality and integrity established by the Regulation.

Training activities organised by the Association may also be delivered through digital videoconferencing platforms, allowing participants to attend lessons in synchronous mode.

During online training sessions:

• participants connected to the same session may view the names and surnames of other participants;
• participants may be visible to others through audio and video, depending on the platform’s functionalities.

Lessons are recorded for organisational purposes, documentation of training activities and proper management of initiatives promoted by the Association.
Recordings are used exclusively within the institutional activities of the Association and processed in compliance with the technical and organisational measures adopted by the Controller to ensure the security and confidentiality of personal data.

Recordings are not intended for public dissemination, publication or communication to third parties and may not be used for purposes other than those indicated above.

Participants are invited to use digital platforms in compliance with rules of fairness and confidentiality, avoiding the unauthorised sharing of images, recordings or content related to training activities.

6. RECIPIENTS OF PERSONAL DATA
For the purposes described above, personal data may be accessed or communicated to parties collaborating with the Association in the delivery of training activities and in the organisational and administrative management of the initiatives promoted.

In particular, data may be processed by:

• trainers and collaborators responsible for delivering teaching activities;
• service providers supplying technological solutions necessary for delivering lessons through digital platforms;
• consultants and professionals supporting the Association in the administrative, accounting or technical management of its activities.

These parties process personal data within the limits of the tasks assigned to them and in accordance with the instructions provided by the Data Controller.

7. TRANSFER OF DATA TO THIRD COUNTRIES
When digital platforms and IT services are used for organising and delivering training activities, some personal data may be processed by technology service providers whose systems or infrastructures may be located, in whole or in part, outside the European Economic Area (EEA).

In such cases, data processing is carried out in accordance with Articles 44 and following of Regulation (EU) 2016/679, and where necessary through the adoption of appropriate safeguards provided by applicable legislation, such as:

• European Commission adequacy decisions, or
• Standard Contractual Clauses (SCCs).

8. DATA RETENTION PERIOD
Personal data are stored for the time strictly necessary to achieve the purposes for which they were collected and processed.

Data relating to course registration and membership management are retained for the entire duration of the relationship with the Association and, subsequently, for a period not exceeding five years after the end of the membership relationship, unless further retention is required for the protection of the Controller’s rights.

Data processed for administrative, accounting and fiscal purposes are retained for the period required by applicable legislation and, in any case, for not less than ten years. Data processed within online training activities, including lesson recordings, are retained for the time strictly necessary for organisational and documentation purposes and in any case for no longer than five years from their collection.

9. NATURE OF DATA PROVISION
Providing the personal data requested in the registration form is necessary for the Association to manage membership requests, course registrations and the delivery of training activities.

Failure to provide the required data will make it impossible for the Association to proceed with course registration and the activation of the membership relationship.

10. RIGHTS OF THE DATA SUBJECT
Data subjects may exercise the rights provided for by Articles 15 and following of the GDPR, where applicable.

In particular, the data subject has the right to:

• access their personal data (Art. 15);
• request rectification of inaccurate data (Art. 16);
• request erasure of data (Art. 17);
• request restriction of processing (Art. 18);
• request data portability in digital format (Art. 20);
• object to processing (Art. 21);
• not be subject to a decision based solely on automated processing, including profiling (Art. 22);
• withdraw consent, where applicable.

Requests can be submitted by contacting the Data Controller or the Data Protection Officer at the contact details provided above, or by completing the “privacy rights request form” available on the institutional website.

A response will be provided within one month.
In the case of complex requests or numerous requests, this period may be extended by a further two months. Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) at: www.garanteprivacy.it or to seek judicial remedy.

11. CHANGES AND UPDATES
This privacy notice was updated in March 2026.
The Data Controller reserves the right to modify or update this notice also as a result of regulatory or organisational changes.

EUGEN – EUROPEAN GENERATION