Information for students: processing of the collected personal data

Information to be provided where personal data are collected from the data subject

According to Regulation (EU) 2016/679 (General Data Protection Regulation) we provide you with the due information concerning the processing of the collected personal data.
This notice is provided pursuant to art. 13 of the Regulation (EU) 2016/679 (General Data Protection Regulation) and according to the provisions of the Directive 2002/58/CE, as amended by Directive 2009/136/CE on Cookies, as well as according to the Provision of the Data Protection Authority dated 08.05.2014 on cookies.


DATA CONTROLLER, pursuant to art. 4 and 24 of the Regulation (EU) 2016/679, is Libera Università di Lingue e Comunicazione IULM, Via Carlo Bo, 1 - 20143 Milan, as represented by the pro tempore legal representative.
The University, in accordance with art. 37-39 Reg. UE 2016/679, appointed Data Protection Officer, who can be contacted at the following email address:


Your personal data shall be processed in accordance to the requirements for the lawfulness of processing set forth by Art. 6 lett. b) del of the Regulation (EU) 2016/679 for the following purposes:

  • browsing on this website;
  • creation of the account and registration with the website;
  • enrollment on three-year university courses and enrollment on Master’s degree courses (Laurea Magistrale) including the management of the relevant activities (carrying out of admission tests and assessment tests with respect to the initial preparation, assessment of the income proportional contributory position, calculation of the amount of taxes due, management of any applications for exemption of payment of university fees, registration to bids or requests of other services and / or aids for the right to university study, such as grant of benefits and / or subsidies provided by law);
  • management of Your university career and related activities (study plan management, exams registrations, degree thesis’ request and/or request for the suspension of the career, enrollment and attendance to university courses, use of telematic and e-mail services, transmission of communications concerning Your university career);
  • activities required by law in order to manage the administrative and educational relationship between Università IULM and the students;
  • enrollment at university master and not- university master, with particular reference to the activities required by law, the management of the administrative and educational relationship between the Communication School (Scuola di comunicazione) and the students, as well as the provision of specific services requested by the users;
  • submit an application for PhD scholarship and for the subsequent management of the educational path;
  • communication of initiatives and events organized by the Università IULM;
  • transmission of the informational material concerning the university courses held by Università IULM
  •  organization and management of mobility programme, training and subsequent ranking decision together with the grant of possible financial aids in accordance to the EU Directives, the national laws and the provisions set out in the Regulation adopted by Università IULM
  • management of internships (also supplementary to the educational programme) and relevant activities (e.g. drafting of special terms);
  • assistance to job searching (by means of dedicated channels) as well as to the organization of seminar, career days etc.;
  • carrying out disciplinary measures towards the students.

Personal data provided by you may be communicated to recipients, appointed pursuant to art. 28 of the Regulation EU 2016/679, which shall process your data as processors and/or persons acting under the authority of the Controller and the Processor, in order to perform agreements or related purposes. Precisely, your data may be communicated to recipients part of the following categories:

  • management services providers of IT systems and communication networks of the Libera Università di Lingue e Comunicazione IULM (including emails and IULM web platform);
  • internal structures of the University such as. Departments, structures tasked with communication, placement etc.;
  • providers of printing and binding services for degree thesis;
  • advisory and consultancy firms and companies;
  • competent Authorities for the fulfillment of obligations of law, if required;
  • certifying administrations carrying out the control of the substitutive declarations provided pursuant to DPR 445/2000;
  • local entities for the purposes of possible grants for particular categories of students
  • State General Attorney, Ministry of Foreign Affairs, Police Headquarters, Embassies, Public Prosecutor's Office in relation to residence permits, recognition of special status;
  • insurance companies for injuries claims;
  • occupational medicine doctor or accredited health structures (e.g. in the case of accidents
  • Region and Direzione Territoriale del Lavoro (Job Territorial Direction);
  • public and private accredited or authorized operators and potential employers for the orientation and admission to the labor market;
  • Almalaurea (Interuniversity Consortium that promotes graduates placement);
  • Regional Management Bodies (Entities with administrative-managerial autonomy established in accordance with the regulations in force concerning the right to university studies) and other institutes for the purposes of promoting the students international mobility, evaluating economic benefits and assigning students’ accommodations;
  • Tax Agency for 730;
  • MIUR;
  • Public and private subjects for the purposes of allowing students to benefit from subsidies, aids and services. Data concerning exchange students can be communicated to institutions, entities or associations in order to favor their integration in the territory and in the university environment
  • Funders of awards, doctoral scholarships and grants, including foreigner funders, in the case of students and / or PhD students who have benefited from funding;
  • Foreign universities, engaged in training courses aimed at issuing joint degrees;
  •  Penitentiary services;
  • In case of administrative accounting purposes, the data may be sent to commercial information companies for the assessment of solvency and payment habits and / or subjects for debts collection purposes.

The subjects belonging to the aforesaid categories act as data Processors or act in complete autonomy as separate data Controllers. The list of designated data Processors is constantly updated and available at the offices of Libera Università di Lingue e Comunicazione IULM.


Personal data may be transferred to a third Country within or outside the European Union, subject to the limits and conditions set forth by art. 44 and subsequent articles of the Regulation EU 2016/679, namely:

  • to third countries or international organisations on the basis of an adequacy decision of the Commission (art. 45 Regulation EU 2016/679);
  • to third countries or international organisations that have provided appropriate safeguards and on condition that enforceable data subject rights and effective legal remedies for data subjects are available (art. 46 Regulation EU 2016/679);
  • to third countries or international organisations on the basis of derogations for specific situations (art. 49 Regulation EU 2016/679).
    Personal data shall be transferred:
  • to foreign Authorities, upon request, in case it is necessary to verify the title of studies for professional reasons or continuation of studies;
  • to foreign Embassies, also for exemptions such as in case of military service;
  • to Extra UE Universities, in the context of international exchanges for in-going and out-going students;
  • to companies / organizations in case of activation of internship abroad;
  • in case of international students, to University abroad, also Extra EU, provenance of the same student;

The data subject may obtain a copy of such data by writing an email to the address


The processing shall be carried out in automated and / or manual manner, with methods and tools aimed at ensuring the best security and confidentiality, by persons specifically appointed to do so.
According to the provisions set forth in art. 5 par. 1 lett. e) of the Regulation EU 2016/679, collected personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Personal data retention period is determined based on criteria available in the guidelines provided by CODAU (Association of General Directors of the Italian university administrations). Different data storage periods may be provided, according to regulations in force, by regulations and by-laws of Libera Università di Lingue e Comunicazione IULM available upon request to the data Controller.

The provision of personal data for the purposes referred to in point 3 of this information notice is necessary in order to manage the above described activities related to the training path as well as the university career. The refusal to provide the personal data shall entail the impossibility to manage all the activities referred to in point 3 of this information notice.


You may exercise your rights pursuant to articles 15, 16, 17, 18, 19, 20, 21, 22 of the Regulation EU 2016/679, by contacting the data Controller, or the data Processor, or the Data Protection Officer service by writing to

You have the right, at any time, to request the data Controller to access, rectify, cancel your personal data or limit their processing. Furthermore, you have the right to object, at any time, to the processing of your data (including automated processing, e.g. profiling) and to the portability of your data.
Without prejudice to any other administrative and judicial appeal, if you believe that the processing of your data violates the provisions of Regulation EU 2016/679, pursuant to art. 15 letter f) of the aforementioned Regulation EU 2016/679, you have the right to lodge a complaint with the Data Protection Authority and, with reference to art. 6 paragraph 1, letter a) and art. 9 paragraph 2, letter a), you have the right to withdraw the consent given at any time.
In case of request of data portability the Controller shall provide you with your personal data in a structured, commonly used and machine-readable format, subject to the provisions set forth in paragraphs 3 and 4 of art. 20 of Regulation EU 2016/679.

Updating date on: 3rd September 2018