Privacy Notice – 2nd ASTIN Bulletin Conference

 

Event: 2nd ASTIN Bulletin Conference, University of Naples Parthenope, Naples, 20–22 January 2027.

Administrative association: Associazione Partenopea per la Matematica Economica e Finanziaria (APMEF).

Data Controller: Associazione Partenopea per la Matematica Economica e Finanziaria (APMEF)

Registered/legal address and tax identifiers:

Dipartimento di Studi Aziendali e Quantitativi (DISAQ)
Università degli Studi di Napoli Parthenope
Via Generale Parisi, 13 – Palazzo Pacanowski
80132 Napoli (NA), Italia

Privacy contact / DPO: astinbulletinconference@gmail.com

General conference contact: astinbulletinconference@gmail.com

1. Scope

This notice explains how personal data are processed when a participant registers for the 2nd ASTIN Bulletin Conference and, where applicable, pays the registration fee. The conference is hosted by the University of Naples Parthenope and is organised with the administrative support of Associazione Partenopea per la Matematica Economica e Finanziaria (APMEF).

2. Data collected

• first name, last name, email, affiliation/institution and country;
• Social Dinner attendance;
• whether the participant has food allergies, intolerances or dietary requirements and, if voluntarily provided, the relevant details;
• whether the participant will be accompanied by a guest, the guest’s name and any dietary information voluntarily provided for the guest;
• invoice request and billing/tax details where an invoice is requested;
• registration and payment-reconciliation data such as registration ID, payment status, Stripe Checkout Session ID, Stripe Payment Intent ID and timestamps.

Payment card number, CVC and bank-authentication credentials are not collected or stored by the conference website.

3. Dietary and health-related information

Information concerning food allergies, intolerances or dietary requirements may reveal data concerning health. These data are collected only when voluntarily supplied and are processed solely for conference catering and organisational purposes. They are not copied into Stripe payment metadata. If a registrant provides dietary information about an accompanying person, the registrant should ensure that the accompanying person has been informed and has agreed to that disclosure.

4. Purposes and legal bases

Personal data are processed for conference registration and administration, payment reconciliation, communications relating to the registration, Social Dinner/catering organisation, accompanying-person arrangements, invoicing and accounting where requested, security, fraud prevention and compliance with legal obligations. Registration/payment processing is expected to rely on contractual or pre-contractual necessity; accounting/invoicing may rely on legal obligations; system security may rely on legitimate interests. Where voluntarily supplied dietary information constitutes health data, the intended legal basis is explicit consent. The final legal wording should be reviewed by APMEF and, where applicable, the University privacy/DPO function before launch.

5. Stripe payments

The registration fee is paid through Stripe-hosted Checkout. Stripe processes the information required to execute the payment, prevent fraud and perform any card-issuer authentication such as 3D Secure/SCA. The conference website does not receive or store card details. Stripe’s own privacy information is available at https://stripe.com/privacy.

6. Recipients and technical providers

Registration data may be accessed only by persons authorised to administer the conference and by technical providers acting under appropriate contractual arrangements, including the website/hosting maintainer where applicable. Payment-related data are also processed by Stripe and by the banks, card networks and payment service providers involved in the transaction.

7. Storage and retention

In the DiSAQ implementation, WordPress/MySQL should be the authoritative registration record. An XLSX snapshot named ASTIN_2027_Registrations.xlsx may also be maintained in a persistent private server directory outside the public web root and may be downloaded by authorised WordPress administrators. No registration workbook should have a public URL.

Final retention schedule:

• Authoritative registration record (WordPress/MySQL): retained until the conference close-out is complete, then erased or irreversibly anonymised no later than 12 months after the end of ASTIN 2027. Only aggregate, anonymous statistics (attendance by country, category, etc.) are kept beyond that date.

• Records with accounting relevance (fee payments, invoices, receipts, refunds): extracted from the registration system and filed in the administrative and accounting records of the Associazione Partenopea per la Matematica Economica e Finanziaria (APMEF) APS; retained for 10 years in accordance with Art. 2220 of the Italian Civil Code and the applicable APMEF accounting and record-keeping procedures, which prevail over the 12-month term above.

• XLSX snapshot (ASTIN_2027_Registrations.xlsx): a working copy, not an archive. Regenerated from the database when needed and deleted no later than 6 months after the end of the conference, or as soon as the registration record is anonymised, whichever comes first. Downloaded copies held by authorised administrators are deleted on the same schedule.

• Server backups: rotated in accordance with the backup policy adopted for the ASTIN registration system under the responsibility of APMEF (maximum 90 days); personal data in backups is not restored after the deletion date except where necessary for disaster recovery.

• Contact data for future ASTIN communications: kept only for registrants who gave separate consent, until consent is withdrawn.

• Web server logs: retained for a maximum of 12 months, in accordance with the privacy and technical data-retention rules adopted by APMEF for the ASTIN registration system.

8. Rights

Subject to the conditions of Regulation (EU) 2016/679 (GDPR) and applicable law, data subjects may have the right to request access, rectification, erasure, restriction of processing, data portability, or to object to certain processing, and may lodge a complaint with the competent supervisory authority.

9. Mandatory information

Required fields are necessary to administer registration and payment. Invoice fields are required only if an invoice is requested. Dietary details are requested only when the participant indicates that such information is relevant.

10. Updates

This notice must be reviewed before registration opens and updated with APMEF’s legal address/tax identifiers, the definitive privacy/DPO contact, the retention schedule and any final allocation of privacy roles agreed with the University and technical providers.