Privacy Policy

1. Data Controller and Data Protection Officer (DPO)

The Data Controller is UniNeuromed – Neuromed Mediterranean University of Sciences and Technologies, with its registered office at Via dell’Elettronica, 1 – 86077 Pozzilli (IS), Tax Code (C.F.) 90051570944, email: privacy@unineuromed.it, certified email (PEC): unineuromed@legalmail.it.

Pursuant to Article 37 of the GDPR, the University has appointed a Data Protection Officer (DPO), who may be contacted directly regarding any matters concerning the processing of personal data and the exercise of your rights at the following email address: dpo@unineuromed.it.

2. Data processed

2.1 Data provided voluntarily by the user via contact and orientation forms

Through the sections of the website dedicated to contact and orientation, the University collects and processes the following personal data:

Identification and personal details (first name, surname, date of birth);

Contact details (email address, landline/mobile phone number);

Information regarding educational and academic background (previous school, current year of study, degree program of interest, current educational status);

Any additional personal data voluntarily entered by the user within the text of their message.

Providing this data is necessary for the University to process the request, provide the requested responses, and send educational materials. Failure to provide such data will make it impossible to deliver the requested orientation and support services.

2.2 Browsing data and cookies

During their normal operation, the IT systems and software procedures used to run this website collect certain personal data, the transmission of which is implicit in the use of Internet communication protocols (e.g., IP addresses, time of the request, method used to submit the request to the server). The website also uses cookies and other tracking tools. For detailed information regarding the categories of cookies used, their purposes, and how to manage your preferences, please consult the website’s full Cookie Policy.

2.3 Processing of data concerning minors

In the event that a user requesting information or participating in orientation activities is a minor, please note that, pursuant to Art. Under Article 2-quinquies of Legislative Decree 196/2003 (the Italian Privacy Code), an individual who has reached the age of 14 may independently provide consent for the processing of their personal data in relation to information society services. If the data subject is under the age of 14, such processing is lawful only if—and to the extent that—consent is given or authorized by the person holding parental responsibility.

3. Purposes and legal basis for processing

3.1 Handling of information requests and university guidance activities

Purpose: To respond to requests submitted by users, provide information regarding degree programs, admission procedures, open days, tuition fees, and university services, and to send specific informational material as requested.

Legal basis: Article 6, paragraph 1, letter b) of the GDPR (performance of pre-contractual measures taken at the request of the data subject), in conjunction with Article 6, paragraph 1, letter e) of the GDPR and Article 2-ter of Legislative Decree 196/2003 (performance of a task carried out in the public interest, related to the promotion of the right to education and academic guidance, as per Law 240/2010).

3.2 Sending of promotional communications, newsletters, and university events

Purpose: To send (via email, SMS, or telephone contact) newsletters, promotional material, invitations to Open Days and educational events, and notifications regarding deadlines for admission calls and enrollment.

Legal basis: Article 6, paragraph 1, letter a) of the GDPR (Consent of the data subject). Such consent is free, optional, and may be withdrawn at any time without affecting the use of the services referred to in point 3.1.

3.3 Fulfillment of legal obligations and requirements for legal protection

Purpose: To fulfill obligations established by laws, regulations, EU legislation, or orders from public authorities, as well as to establish, exercise, or defend a legal claim of the University in judicial or extrajudicial proceedings.

Legal basis: Article 6, paragraph 1, letter c) of the GDPR (compliance with a legal obligation) and Article 6, paragraph 1, letter f) of the GDPR (legitimate interest of the Data Controller in protecting their rights).

3.4 Website operation and statistical analysis (Browsing data and cookies)

Purpose: To ensure the security of the website, facilitate proper navigation, and—where permitted—conduct statistical analysis or profiling activities.

Legal basis: For technical cookies, Article 122 of Legislative Decree 196/2003; for non-anonymized third-party analytical cookies and for profiling/marketing cookies, Article 6, paragraph 1, letter a) of the GDPR (consent obtained via a cookie banner).

4. Data retention period

In compliance with the principles of proportionality and data minimization set forth in Article 5, paragraph 1, letter e) of the GDPR, data will be retained according to the following criteria:

• Data for information and guidance requests (Sec. 3.1): Data will be retained for the time strictly necessary to manage and respond to the user's request, and for a maximum period of 12 months from the last relevant contact, in order to verify the outcome of the guidance provided. Should the user subsequently enroll in a university program, the data will be transferred to the student's file and become subject to the regulations governing the retention periods for university administrative records.

• Data for promotional communications and events (Sec. 3.2): Retained until the data subject withdraws their consent (via the "unsubscribe" link provided in every email, or by direct request), and in any case for no longer than 24 months from the date consent was obtained or from the last verifiable interaction.

• Technical browsing data (Sec. 3.4): Retained for a maximum period of 7 days, unless required for the investigation of cybercrimes by judicial authorities.

Once the aforementioned periods have elapsed, the data will be deleted or rendered anonymous in a permanent and irreversible manner.

5. Scope of communication, dissemination, and transfer of data

Personal data will not be disclosed to the public under any circumstances. Such data may be processed by:

• UniNeuromed personnel who have been expressly authorized and instructed to do so, within the scope of their respective duties (pursuant to Article 29 of the GDPR and Article 2-quaterdecies of Legislative Decree 196/2003);

• Providers of IT services, hosting, communication management (e.g., email distribution platforms, CRM systems), and technical support, who have been appointed as Data Processors pursuant to Article 28 of the GDPR;

• Public or judicial authorities, where required by law.

In the event that, for the provision of certain IT services (e.g., cloud services, email platforms), data must be transferred to third countries outside the European Economic Area (EEA), the University guarantees that such a transfer will take place only if there is an adequacy decision by the European Commission (Article 45 of the GDPR) or subject to the adoption of Standard Contractual Clauses (Article 46 of the GDPR), supplemented by any additional security measures necessary to ensure a level of protection equivalent to that of the European Union.

6. Rights of the data subject

As a data subject, pursuant to Articles 15–22 of the GDPR, you may exercise the following rights at any time:

• Right of access (Article 15 GDPR): to obtain confirmation as to whether or not your personal data are being processed and to access such data;

• Right to rectification (Article 16 GDPR): to have inaccurate data updated or corrected, or to have incomplete data completed;

• Right to erasure / "Right to be forgotten" (Article 17 GDPR): to request the deletion of your data in the circumstances provided for by law;

• Right to restriction of processing (Article 18 GDPR): to request that the processing of your data be restricted under specific conditions set out by law;

• Right to data portability (Article 20 GDPR): to receive the data you have provided to the Data Controller in a structured, commonly used, and machine-readable format, in the circumstances provided for by law;

• Right to object (Article 21 GDPR): to object at any time—on grounds relating to your particular situation—to the processing of your data when based on legitimate interests or carried out for marketing purposes;

• Right to withdraw consent (Article 7, paragraph 3 GDPR): to withdraw, at any time, any consent previously given for promotional purposes, without affecting the lawfulness of the processing based on such consent before its withdrawal.

How to exercise your rights

To exercise your rights, you may contact us at privacy@unineuromed.it or reach out to the Data Protection Officer (DPO) at dpo@unineuromed.it.

Complaint to the Supervisory Authority

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali – Piazza Venezia, 11, 00187 Rome – www.garanteprivacy.it) if you believe that the processing of your personal data violates applicable law.

7. Updates to the privacy policy

This privacy notice may be subject to changes to reflect regulatory updates or new data processing methods. In such cases, the new version will be published on the website, indicating the date of the update; if the changes concern processing activities based on consent, you may be asked to provide your choices again.

Last updated: 28.08.2026