إشعار الخصوصية

Controller, DPO and scope

The controller must be definitively identified before services go live: ; legal address: [SEDE LEGALE DA INDICARE / LEGAL ADDRESS PENDING]; contact: info@medconvergence.org. Project DPO contact: dr. prof. Giuseppe Izzo, dpo@medconvergence.org; the formal appointment and published contact details require documentary validation.

This notice covers website use, participation requests, accounts, newsletters, sponsorships, bookings and, when enabled, payments and donations. Service-specific notices may supplement it.

Data categories and purposes

Identity and contact details, declared institutional capacity, organisation, country, applications, booking and transaction references, communication choices and security logs may be processed as strictly necessary. Special-category data should not be supplied unless expressly requested under a separate lawful procedure.

Purposes include responding to enquiries, human-reviewed accreditation, event administration, contract and tax compliance, account security, fraud prevention and consent-based communications.

Lawful bases

GDPR Article 6(1)(b) for pre-contractual steps and contracts; Article 6(1)(c) for legal obligations; Article 6(1)(f) for assessed and documented legitimate interests, including cybersecurity; and Article 6(1)(a) where consent is required for newsletters and optional trackers. Necessary data may be required to fulfil a request; optional processing must not be bundled with it.

Processors and international transfers

Role-scoped staff, hosting, email, payment providers, optional AI services and technical service partners may receive relevant data subject to appropriate arrangements. UESE ITALIA S.p.A. is Technology Partner; any processor appointment requires an appropriate GDPR Article 28 agreement.

Transfers outside the EEA require a verified transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, and any additional measures deemed necessary. No unverified claim about the actual supplier list is made.

Retention and security

Retention follows the relevant purpose and statutory obligations as documented in the controller’s Article 30 register: applications for a proportionate operational period, newsletter until unsubscribe, accounting records for statutory terms, and security logs for a justified retention period. Unlimited retention is not the default.

Access control, operator MFA, secure credential handling, backups and incident management require periodic technical validation.

Individual rights

You may request access, correction, erasure, restriction, portability where available, objection and withdrawal of consent. Email dpo@medconvergence.org; requests are handled under GDPR Articles 12–22. You may lodge a complaint with the Italian Garante or another competent supervisory authority.

AI assistance does not independently decide applications with legal or similarly significant effects; authorized staff retain responsibility.