Information provided under Article 13 of Regulation (EU) 2016/679 (GDPR). All the data described here is provided directly by the person filling in the form. Where a form happens to contain the data of someone else, for example a colleague named in a free-text field, this page is also the information provided under Article 14 GDPR, and the source of that data is the person who sent the form. Last updated: 20 September 2026.
This notice explains what happens to the personal data entered in the four Serendipity Summer School forms on this website: registration, Erasmus+ funding, faculty-led programs, and general information. Other pages of international.unicollege.eu are covered by the general privacy policy (opens in a new tab).
Who processes the data
The data controller is Adiuva Srl, via Durini 7, 20122 Milan, Italy, VAT IT06279150962, which operates Unicollege – Scuola Superiore per Mediatori Linguistici.
For any question about data protection, and to exercise the rights listed below, the contact address is dpo@adiuva.it. For questions about the School itself, the address is studyabroad@unicollege.eu.
What is collected, form by form
| Form | Data entered |
|---|---|
| Registration | First and last name, email address, country, institution or organization, role, registration category, mode of participation, Academic Credit Option, and, where the applicant chooses to provide them: title and abstract of a proposed contribution, accessibility and accommodation needs, dietary requirements and allergies, free-text message. |
| Erasmus+ funding | First and last name, email address, country, home institution, role, status of the Erasmus+ mobility grant, existence of an inter-institutional agreement, free-text message. |
| Faculty-led programs | First and last name, email address, country, home institution, role, expected number of students, level of the group, academic credit required, free-text message. |
| General information | First and last name, email address, country, institution or organization, role, type of request, free-text message. |
Every form also records the date and time of submission, in UTC, and the fact that this privacy notice was acknowledged when the form was sent. The outcome of the anti-spam check is not recorded. No account is created, no profiling takes place, and no advertising or analytics cookies are set by these pages.
Alongside what is typed into the fields, these forms process the IP address of the device used to send them. The IP address is sent to Cloudflare to run the Turnstile anti-spam check, it is used by Cloudflare to work out which country the visit comes from so that the right version of the site is served, and it appears in the technical logs that Cloudflare keeps as host of this website. The Turnstile widget is loaded from challenges.cloudflare.com and reads standard browser and device signals in order to tell a person from an automated script; the page also measures how long the form was open before it was sent, for the same reason. None of this is stored by Unicollege, none of it is added to the message sent to the office, and none of it is used to identify or profile the person.
Accessibility needs, dietary requirements and allergies
Two fields of the registration form can reveal information about health or disability: accessibility and accommodation needs and dietary requirements and allergies. These fields are entirely optional, and a request can be submitted without them.
When one of them is completed, the form asks for a separate and explicit consent (Article 9(2)(a) GDPR). That information is used for one purpose only: to arrange access, accommodation, rooms and meals during the School. It is seen by the International Office staff in charge of the School and, where strictly necessary, by the venue or the accommodation provider. It is never used to decide whether a registration is accepted.
The consent can be withdrawn at any time by writing to studyabroad@unicollege.eu or dpo@adiuva.it, without affecting the lawfulness of what was done before the withdrawal.
Why the data is processed, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to a request about registration, Erasmus+ mobility or a faculty-led agreement, and taking the steps that lead to it | Steps taken at the request of the person concerned before entering into a contract (Article 6(1)(b)) |
| Replying to a general question about the School, and sending invitation or participation letters | Legitimate interest in answering the people who write to the School (Article 6(1)(f)) |
| Assessing a proposed contribution submitted for the Call for Contributions | Steps taken before a possible contract, and the legitimate interest of the School in building its academic program (Article 6(1)(b) and (f)) |
| Arranging access, accommodation and meals on the basis of accessibility needs, dietary requirements or allergies | Explicit consent (Article 9(2)(a)) |
| Keeping a record that this privacy notice was shown and acknowledged when the form was submitted | Legitimate interest of the controller in being able to show that the information duty was complied with (Article 6(1)(f), applying the accountability principle of Article 5(2)) |
| Protecting the forms from automated abuse | Legitimate interest in a working, secure website (Article 6(1)(f)) |
Who receives the data
- Unicollege staff in the International Office, the Erasmus+ office and the academic direction of the School, as needed to deal with the request. Requests sent through the Erasmus+ form reach erasmus@unicollegessml.it and requests sent through the faculty-led form reach facultyled@unicollege.eu; in both cases a copy is also sent to the International Office at studyabroad@unicollege.eu, which coordinates the School. Requests sent through the other forms reach studyabroad@unicollege.eu only.
- Cloudflare, Inc., which hosts this website, runs the code that receives the forms, keeps the archive of the requests within the European Union, and provides the Turnstile anti-spam check, as a data processor.
- Resend (Plus Five Five, Inc.), which delivers the email generated by each form, as a data processor.
- Google Ireland Ltd, which provides the mailboxes where those messages are received, as a data processor.
- The venue and the accommodation and catering providers of the School, and only for the information strictly needed to arrange access, rooms and meals. They receive that information as data processors, under a written agreement, or as independent controllers where the service is booked directly by the participant.
The data is not sold, is not used for advertising, and is not disclosed to anyone else. A copy of each submitted request is sent to the email address provided, as confirmation of receipt: if that copy does not arrive within a few minutes, the request may have been stopped by the anti-spam filter and can be sent again by email to studyabroad@unicollege.eu.
Where the data is kept
Alongside the mailboxes, each request is recorded in an archive kept by Unicollege on Cloudflare D1, a database restricted to the European Union, so that requests can be found, counted and deleted on the dates set out below. The archive holds the data listed above, but not the accessibility needs and not the dietary requirements and allergies: of those it keeps only the fact that something was declared, and that indication is itself removed thirty days after the end of the edition concerned. The archive is reachable only by the staff of the International Office, through a reserved page protected by an access key.
To record when the International Office has replied, a script running inside the office mailbox reads only the sender and the date of the messages exchanged with the person who sent the request, and passes those dates to the archive. It never opens or stores the text of the messages.
The mailboxes that receive these requests are provided by Google and are managed from Italy. The website and the code that receives the forms run on the Cloudflare network, which serves each page and handles each submission at the data centre closest to the person sending it: a request sent from outside the European Union is therefore processed outside the European Union before it reaches the mailbox. Cloudflare, Inc. and Plus Five Five, Inc. (Resend) are established in the United States. Where a provider is certified under the EU-US Data Privacy Framework, the transfer relies on the adequacy decision of the European Commission (Article 45 GDPR). Where it is not, the transfer relies on the Standard Contractual Clauses adopted by the European Commission, together with the additional measures agreed with that provider. A copy of those clauses and of those measures can be obtained by writing to dpo@adiuva.it.
How long it is kept
| Data | Retention |
|---|---|
| Requests that do not lead to participation | 12 months from the last exchange |
| Requests that lead to participation in the School | They become part of the participation file and are kept for 10 years from the end of the financial year in which the participation is closed, the period set by Article 2220 of the Italian Civil Code for accounting records and by the rules that govern any European funding involved |
| Accessibility needs, dietary requirements and allergies | Deleted within 30 days of the end of the edition of the School they refer to, or earlier if the person concerned asks for it. They are not kept with the accounting records |
| Proposals submitted for the Call for Contributions | Until the academic program of the edition is closed, and in any case no longer than 24 months |
Rights
At any time the person concerned may ask for access to the data, for its correction, for its erasure, for the restriction of its use, for it to be received in a machine-readable format, and may object to processing based on legitimate interest. Where processing is based on consent, that consent may be withdrawn at any time.
The right to object applies in particular where the processing rests on legitimate interest: an objection stops that processing unless the controller shows compelling legitimate grounds.
Requests are sent to dpo@adiuva.it and are answered within one month, which may be extended by two further months where the request is complex, with reasons given. A complaint may also be lodged with the Italian Data Protection Authority, the Garante per la protezione dei dati personali, www.garanteprivacy.it (opens in a new tab), or with the supervisory authority of the country of residence or of the place of the alleged infringement.
Is the data required?
The fields marked as required are needed to deal with the request: without them the request cannot be handled. All the other fields, including the two that may reveal health information, are optional.
Changes to this notice
If the way these forms handle personal data changes, this page is updated and the date at the top is changed. Where the change concerns something that was consented to, consent is asked again.