1. Data Controller

The controller for the personal data collected through this site is theUniversity of Salerno (UNISA), acting through the DISUFF Department / DiSoSW Lab, within the framework of the project PARTECIPA — Giovani Campania.

Registered office: Via Giovanni Paolo II, 132 — 84084 Fisciano (SA), Italy
Project contact: partecipagiovanicampania@unisa.it

2. Data Protection Officer (DPO)

The University of Salerno, as a public body, has appointed a Data Protection Officer (DPO) pursuant to Article 37(1)(a) of the GDPR.

DPO contact:
E-mail: protezionedati@unisa.it
PEC (certified email): protezionedati@pec.unisa.it

3. Purposes and legal basis of processing

Personal data is processed for the following purposes:

a) Managing contact requests

Responding to requests submitted via the site’s Contact form.
Legal basis: consent of the data subject (Article 6(1)(a) GDPR), given by ticking the consent checkbox in the form.

b) Early registration for the PARTECIPA MOOC

Recording interest and communicating updates on the launch of the MOOC MOOC before official registration opens.
Legal basis: consent of the data subject (Article 6(1)(a) GDPR).

c) Registration and participation in the PARTECIPA MOOC

Delivering the online training course, tracking module completion and managing the certificate of participation; fulfilling the project’s reporting obligations towards the Regione Campania and the National Department for Youth Policies and Universal Civil Service.
Legal basis: performance of a service requested by the data subject (Article 6(1)(b) GDPR) and compliance with a legal obligation connected to the project’s public funding (Article 6(1)(c) GDPR).

d) Site usage statistics (Google Analytics 4)

Aggregated analysis of user behaviour on the site to improve content and measure the reach of the project’s communication activities.
Legal basis: consent of the data subject (Article 6(1)(a) GDPR), given through the cookie management banner.

e) Browsing data (server logs)

Automatic recording of the IP address, user agent, pages visited and access times by the site’s IT system, for IT security and technical diagnostic purposes.
Legal basis: legitimate interest of the controller (Article 6(1)(f) GDPR) in ensuring the security and proper operation of the site.

4. Personal data processed

In relation to the purposes indicated, the following data is processed:

• Contact form: name, e-mail address, subject of the request, message text.
• Early MOOC registration: name, e-mail address.
• MOOC registration: first name, last name, e-mail address, year of birth, municipality and province of residence; module-completion data (necessary for project reporting).
• Google Analytics 4: anonymised browsing data (pages visited, session duration, device, aggregated geographic area). No data that allows direct identification of the user is transmitted to Google.
• Server logs: IP address, user agent (browser and operating system), pages requested, date and time of access.

Data is collected directly from the data subject or generated automatically through browsing. No special categories of data under Article 9 GDPR are collected.

5. Retention period

a) Contact requests and early MOOC registrations

Data is retained for the time necessary to handle the request and for a maximum of 12 months from collection, unless required for litigation or legal obligations.

b) MOOC registration and participation data (reporting)

The data strictly necessary for reporting on the PARTECIPA project to the funding bodies (Regione Campania, National Department for Youth Policies and Universal Civil Service) are kept for the ten years following its conclusion, in line with the retention periods for administrative and accounting records required for public funding.

c) Analytics data (Google Analytics 4)

The retention period is defined by Google’s policy (default: 26 months from collection); raw data retention can be changed in the GA4 property settings.

d) Server logs

Logs are retained for a period not exceeding 12 months, unless required for IT security or legal obligations.

6. Recipients of the data

Personal data is not disclosed to third parties for their own purposes. It may be communicated, to the extent strictly necessary for the provision of services, to the following parties acting as data processors (Article 28 GDPR):

• Serverplan S.r.l. — hosting provider hosting the website and its databases; based in Italy.
• Google LLC — provider of Google Analytics 4, exclusively for browsing data provided with the consent of the data subject; based in the United States (see section 7).

Data may be transmitted to competent authorities only in cases provided for by law (e.g. upon request from the judiciary).

Data is not disseminated.

7. Transfer to third countries

The use of Google Analytics 4 involves the transfer of data to Google LLC based in the United States, a country that does not benefit from an adequacy decision under Article 45 GDPR. The transfer takes place on the basis of the Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Article 46(2)(c) GDPR, which Google incorporates into its data processing terms.

Further information on the safeguards adopted by Google is available at business.safety.google/gdprcontrollerterms/.

All other processing described in this notice takes place within the territory of the European Union.

8. Data subject rights

As a data subject, you have the right to exercise, in the manner and within the limits set out in the GDPR, the following rights:

• Right of access (Article 15 GDPR): obtain confirmation of the existence of processing of your data and access information about the processing.
• Right to rectification (Article 16 GDPR): request the correction of inaccurate or incomplete data.
• Right to erasure (Article 17 GDPR): request erasure of data, in the cases provided for by law (“right to be forgotten”).
• Right to restriction of processing (Article 18 GDPR): request the restriction of processing in specific circumstances.
• Right to object (Article 21 GDPR): object to processing based on legitimate interest (e.g. server logs) for reasons related to your particular situation.
• Right to data portability (Article 20 GDPR): receive personal data in a structured, commonly used format (applicable to processing based on consent or contract).
• Right to withdraw consent (Article 7 GDPR): withdraw consent given at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint (Article 77 GDPR): lodge a complaint with the competent supervisory authority — in Italy the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it).

Requests to exercise these rights can be sent to partecipagiovanicampania@unisa.it. The controller will respond within 30 days of receiving the request, unless a justified extension applies.

9. Cookies and tracking technologies

The site uses technical cookies necessary for its operation and, upon the user’s explicit consent, analytics cookies (Google Analytics 4) to collect aggregated statistics on site usage.

For detailed information on the types of cookies used, their duration, the third parties involved and how to manage and withdraw consent, please refer to the COOKIE POLICY.

Consent to analytics cookies can be given or withdrawn at any time via the banner on the site or by accessing the cookie settings.

Updates to this notice

This notice may be updated at any time, in particular following regulatory changes or changes in the way data is processed. The date of the last update is shown at the bottom of this document.

Last updated: 30 July 2026.