SOCIETÀ ITALIANA DI DIRITTO ED ECONOMIA

Privacy Policy

EnglishItaliano

Last Updated: October 27, 2026

SIDE - Italian Society of Law and Economics (hereinafter “SIDE” or “the Controller”) respects user privacy and is committed to protecting personal data in accordance with Regulation (EU) 2016/679 (GDPR).

1. Data Controller

SIDE - Società Italiana di Diritto ed Economia Via Vigilio Inama n.5 At the Department of Economics and Management (DEM) University of Trento Tax Code: 97898440587

Contact: segreteria@side-isle.it

2. Types of Data Collected

2.1 Public Website (side-isle.it)

The SIDE public website does not use tracking or analytics cookies and does not collect personal data from users during browsing. Analytics tools such as Google Analytics are not active.

The website only stores, in the user’s browser:

  • the choice made in the cookie consent banner (see section 9);
  • the language chosen on bilingual pages such as this one.

The videos page embeds YouTube videos in privacy-enhanced mode (youtube-nocookie.com): no YouTube cookie is set before a video is played, but the page loads content from Google servers.

In the future, subject to authorization via the cookie consent banner, the following may be activated:

  • Analytics cookies (Google Analytics) to understand site usage
  • Analytics cookies will only be activated after explicit user consent

2.2 Conference Extranet (extranet.side-isle.it)

The extranet used to manage SIDE conferences collects and processes the following categories of personal data:

Account data:

  • First and last name
  • Email address
  • Password (stored only as a bcrypt hash)
  • University affiliation
  • Country
  • Profile photo (optional)

Conference registration data:

  • Name as printed on the badge
  • Attendance at the welcome aperitif and the gala dinner
  • Dietary requirements and other needs, if the participant chooses to state them
  • Names of dinner guests, for registrations to past editions (guests are no longer accepted)

Paper submission data:

  • Paper titles and abstracts
  • Authors’ names and affiliations, and the presenting author
  • Topic areas
  • Paper files (PDF)
  • Eligibility for the Brenno Galli Award, when declared
  • The scientific committee’s decision

Payment data:

  • PayPal order and capture identifiers
  • PayPal payer ID and payer email (when paying with a PayPal account)
  • Amount, currency, payment status and date
  • Technical records of each payment attempt, kept to diagnose payment problems

Technical data:

  • Session identifier (see section 9)

IP addresses are not recorded by the extranet.

Important note: SIDE does not receive or store credit card data. Payments, including card payments, are processed exclusively by PayPal as an external service.

3. Purposes of Processing

Personal data are processed for the following purposes:

  1. Conference registration management - participant registration, badges, catering and logistics organization
  2. Scientific contribution management - collection and evaluation of papers, notification of decisions, and publication of the conference program
  3. Payment processing - processing registration fees via PayPal and issuing receipts
  4. Membership - the registration fee includes SIDE membership for the following year
  5. Communications - sending information related to conferences and SIDE activities
  6. Security - protection against unauthorized access, fake accounts and fraud
  7. Legal compliance - compliance with Italian tax and accounting obligations

When an account is created, its details (name, email domain, affiliation, country) are checked automatically against simple rules to detect fake or automated sign-ups. An account flagged by these checks may be refused or held for review by the SIDE secretariat. A person affected can contact segreteria@side-isle.it to have the decision reviewed by a person.

For accepted papers, the title, authors, affiliations and abstract are published in the conference program on the public website.

4. Legal Basis for Processing

Data processing is based on:

  • Art. 6(1)(b) GDPR - Performance of a contract (account, paper submission, conference registration and membership)
  • Art. 6(1)(c) GDPR - Compliance with legal obligations (tax and accounting obligations)
  • Art. 6(1)(f) GDPR - Legitimate interest (system security, prevention of fake accounts and fraud, publication of the conference program)
  • Art. 6(1)(a) and Art. 9(2)(a) GDPR - Consent, for dietary requirements and other needs, which may reveal health or religious information and are only collected if the participant chooses to provide them
  • Art. 6(1)(a) GDPR - Consent (for analytics cookies, when implemented)

5. Data Recipients

Personal data are accessible, within SIDE, to the secretariat, to the scientific committee (for paper submissions) and to the conference organizers (for registrations), only as needed for their tasks.

Personal data may also be shared with:

Hosting and email provider:

  • AlwaysData SAS (France) - hosting of the website, the extranet and the database, and sending of emails
  • EU-based, GDPR compliant
  • Legal information: alwaysdata.com/terms-and-legal

Payment processor:

  • PayPal - for payment processing, including card payments
  • Data shared: order description, amount, currency
  • Data received: order and capture identifiers, payer ID, payer email, payment status
  • PayPal privacy policy: paypal.com/privacy

Video platform:

  • YouTube (Google) - only when a visitor opens the videos page of the public website

Competent authorities:

  • When required by law (e.g., Italian tax authorities)

6. Retention Period

  • User accounts: Retained while the account is active; users can ask for their account to be deleted at any time by writing to segreteria@side-isle.it
  • Profile photo: Until the user removes it from their profile or the account is deleted
  • Conference registrations: Historical data retained per conference year
  • Scientific contributions: Retained per conference year; the program of past conferences remains published on the public website
  • Payment data: Retained according to Italian tax regulations
  • Session data: Deleted when the user logs out, or after 30 days without activity
  • System logs: Maximum 12 months

7. Data Subject Rights

In accordance with Articles 15-22 of the GDPR, users have the right to:

  • Access (Art. 15) - obtain confirmation of processing and a copy of data
  • Rectification (Art. 16) - correct inaccurate or incomplete data; most account data can be corrected directly in the extranet profile
  • Erasure (Art. 17) - request deletion of data (“right to be forgotten”)
  • Restriction (Art. 18) - restrict processing in certain circumstances
  • Data portability (Art. 20) - receive data in a structured format
  • Object (Art. 21) - object to processing for legitimate reasons
  • Human review (Art. 22) - obtain a review by a person of an account refused by the automatic checks
  • Withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal

How to exercise rights: Send a request to segreteria@side-isle.it Response time: Within 30 days of the request

8. Security Measures

SIDE adopts technical and organizational measures to protect personal data:

  • HTTPS/TLS encryption for all communications
  • Password hashing with bcrypt
  • Protection against cross-site request forgery (requests from other websites are rejected)
  • Session cookies inaccessible to scripts (HttpOnly)
  • Role-based access to administrative functions
  • Database access controls
  • Regular security updates
  • File upload validation

9. Cookies and Browser Storage

9.1 Public Website (side-isle.it)

Necessary technical cookie:

  • cc_cookie
    • Purpose: Remembers the choice made in the cookie consent banner
    • Duration: 6 months
    • Type: First-party technical cookie

Browser storage (not a cookie):

  • The language chosen on bilingual pages is saved in the browser’s local storage. It is never sent to SIDE.

In the future, with user consent:

  • Analytics cookies (Google Analytics)
    • Purpose: Understand site usage
    • Duration: Variable
    • Type: Third-party cookies
    • IP anonymization: Enabled
    • Requires explicit consent

9.2 Conference Extranet (extranet.side-isle.it)

Necessary technical cookies (always active):

  • side_session

    • Purpose: User authentication and session management
    • Duration: Until the browser is closed, or 30 days when “Keep me logged in on this device” is selected at login
    • Type: First-party session cookie, inaccessible to scripts

  • side_impersonator

    • Purpose: Lets an administrator return to their own account after viewing the extranet as another user
    • Duration: Until the browser is closed
    • Type: First-party technical cookie, set for administrators only

These cookies are strictly necessary for the operation of the service and do not require consent under Art. 5(3) of the ePrivacy Directive.

During payment, PayPal’s own pages and buttons may set PayPal cookies, governed by PayPal’s privacy policy.

10. International Transfers

Data is hosted on servers located in France (AlwaysData) within the European Union. No data transfers are made to third countries, except for PayPal and Google (YouTube) (USA), which operate based on adequate safeguards for international transfers.

11. Changes to the Privacy Policy

SIDE reserves the right to modify this policy. Substantial changes will be communicated to registered users via email. The “Last Updated” date at the top of the document indicates the current version.

12. Contact

For questions about this policy or to exercise your rights:

Email: segreteria@side-isle.it

Address: SIDE - Società Italiana di Diritto ed Economia Via Vigilio Inama n.5 At the Department of Economics and Management (DEM) University of Trento Italy

13. Supervisory Authority

In case of violations of data protection regulations, users have the right to lodge a complaint with the competent supervisory authority:

Garante per la Protezione dei Dati Personali Piazza Venezia n. 11 00187 Rome, Italy Website: garanteprivacy.it Email: garante@gpdp.it

This policy complies with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).