Privacy Policy

1. Data Controller (Titolare del Trattamento)

The Data Controller is Associazione Studenti Musulmani - Politecnico di Milano (ASM POLIMI), with registered cultural and associative activities at Politecnico di Milano (Piazza Leonardo da Vinci 32, 20133 Milano, Italy).

For any request concerning data protection, access, correction, or deletion, you can reach out directly to the board at:
Email: info@asmpolimi.it or asm.polimi@gmail.com

2. Categories of Personal Data Collected

Depending on how you interact with our association website and services, we may collect and process:

• Membership Applications: Full name, university student matricola ID, university email address, phone number, study course and academic level (B.Sc., M.Sc., Ph.D.), spoken languages, requested associative gifts (personalized name for 3D keychain gift), and payment confirmation.
• Event Registrations: Name, matricola, student membership status, applied attendee fee, emergency contact, dietary requirements / allergies (for Iftar and food gatherings), and registration attendance status.
• Newsletter & Mailing List: Full name, university email address, graduation year, and explicit GDPR consent confirmation timestamp.
• "Ask an Imam" Submissions: Category of inquiry, email address (optional for private follow-ups), question text, and timestamp.
• Halal Scanner & Camera Permissions: When using the Live Camera Scanner, video frame analysis is executed 100% locally and client-side in the user's browser via JavaScript; zero photos, videos, or camera recordings are saved, stored, or transmitted to any server. When searching or scanning a barcode, only the numeric barcode digits are sent to our API and Open Food Facts. Optional user product reports (product name, store location, ingredient notes) do not collect, process, or link personal student identities.
• Technical Navigation & Security Data: IP address (hashed or extracted via secure reverse proxy headers), browser user agent, and Cloudflare Turnstile anti-bot verification tokens to prevent spam.

3. Purpose and Legal Bases for Processing

We process personal data solely for the following legitimate purposes:

• Associative Life & Membership (Art. 6(1)(b) & (f) GDPR): Managing membership enrollments, verifying active student status at Politecnico di Milano, issuing associative membership kits and materials.
• Event Logistics & Safety (Art. 6(1)(b) GDPR): Managing seat quotas, sending venue confirmations, catering arrangements, and emergency safety compliance.
• Student Communications & Friday Prayers (Art. 6(1)(a) GDPR): Sending informational updates regarding Jumu'ah prayer rooms (Bovisa / Leonardo), cultural talks, study halaqat, and student guides, based exclusively on your freely given consent.
• Security, Abuse Prevention & Spam Defense (Art. 6(1)(f) GDPR): Protecting application submission forms from automated bots, distributed attacks, and malicious requests.

4. Data Storage, Security & Third Parties

All personal data is stored on secure, encrypted servers located within the European Union (EU) or compliant with GDPR adequacy standards. We implement industry-standard encryption, parameterized database queries, and role-based administrative access controls.

Zero Third-Party Commercial Transfers: We do not sell, lease, disclose, or transfer personal data to commercial advertisers, marketing agencies, or unrelated third parties. Data is accessible solely to authorized board members of ASM POLIMI bound by confidentiality.

5. Data Retention Period

• Membership Data: Retained for the duration of your active student membership plus 1 academic year for auditing and continuity.
• Mailing List Data: Retained until you withdraw consent. You may unsubscribe at any time with one click or by sending an email. Unsubscribed records are deleted within 7 days.
• Event Attendee Logs: Retained for 90 days following event completion for organizational accounting and attendance reconciliation, after which personal identifiable records are archived or anonymized.

6. Your Rights Under GDPR (Articles 15–22)

As a data subject, you have the following guaranteed legal rights:

• Right of Access (Art. 15): Request confirmation and an export copy of all personal data held concerning you.
• Right to Rectification (Art. 16): Request correction of inaccurate, outdated, or incomplete data.
• Right to Erasure / Right to be Forgotten (Art. 17): Request total deletion of your personal records from our databases.
• Right to Restriction of Processing (Art. 18): Request temporary freezing of your data in contested cases.
• Right to Data Portability (Art. 20): Receive your data in a structured, commonly used machine-readable format.
• Right to Withdraw Consent (Art. 7(3)): Revoke consent at any time without penalty or retroactive consequence.

To exercise any of these rights, simply email us at info@asmpolimi.it. We will respond and process your request within 30 days without fee.

You also have the right to lodge a formal complaint with the Italian Supervisory Authority:
Garante per la protezione dei dati personali • www.garanteprivacy.it