Privacy Policy
Last updated: 7 October 2026 — Como, Italy
Associazione Alternativa protects your personal data in accordance with the General Data Protection Regulation (GDPR, EU 2016/679) and applicable Italian data protection law (the Data Protection Code — Legislative Decree 196/2003, as amended by Legislative Decree 101/2018). This policy explains what data we collect in connection with the VIMUN project (Voices for Impact Model United Nations), why, how long we keep it and which rights you can exercise.
1. Data controller
The data controller is Associazione Alternativa A.P.S — VIMUN (Voices for Impact Model United Nations), registered office at Via Ippocrate 45, 20161 Milan, Italy. For any data protection question or to exercise your rights, email contact@voicesforimpact.eu.
2. Data we collect
Identity (first/last name, date of birth, gender, nationality, country of residence); contact details (email, phone); background (university, occupation, MUN experience, CV, languages); application data (motivation, committee preferences, stay package, food preferences, emergency contact, and optional medical information — see below); payment data (amount, status, payment method); technical data (IP address and user-agent captured at the time of consent, for proof purposes). We only collect data that is relevant and necessary for the purposes described.
3. Health information (GDPR Art. 9)
Where voluntarily provided, we process limited health-related information (allergies, medical conditions…) for health, safety and emergency purposes during VIMUN activities. This is a special category of data under GDPR Art. 9 and is processed only on the basis of your explicit consent (Art. 9-2-a). Access is limited to authorised members of the organising team who need it for those purposes. Providing this information is voluntary; you may withdraw your consent at any time by writing to contact@voicesforimpact.eu.
4. Purposes and legal bases (GDPR Art. 6)
Account, application and event management — pre-contractual steps / performance of the arrangements relating to your participation (Art. 6-1-b) and, failing that, the legitimate interest of Associazione Alternativa in organising the project (Art. 6-1-f). Age and eligibility verification: the date of birth is used to confirm that the participant meets the age requirement — participation in VIMUN is reserved for people aged 18 and over. Communications related to participation — necessary for the administration of the project (not treated as marketing). Medical information — explicit consent (Art. 9-2-a). Optional marketing communications — consent (Art. 6-1-a), withdrawable at any time. Announcements that a conference is open for applications — at the request of people on the waiting list, and for account holders on the basis of our legitimate interest in informing them of a similar activity (Art. 6-1-f); every announcement includes a one-click unsubscribe link, honoured for all later announcements. Legal and accounting obligations — legal obligation (Art. 6-1-c). Security and fraud prevention — legitimate interest (Art. 6-1-f).
5. Payments
Where participation requires a fee, payment is made by card via Stripe or by bank transfer. For card payments, Associazione Alternativa does not collect or store full card numbers or security codes: Stripe processes those under its own terms. For bank transfers, we process the payer name, the proof of payment you submit and the transaction status; the proof is reviewed by the Finance Administrator. Payment-related information may include name, email, amount and transaction status.
6. IP-based geolocation
When an application is created and submitted, we record your IP address and derive an approximate location from it (country, region, city, continent, approximate coordinates). Purposes: security and fraud prevention, better identification of applicants and determining the applicable payment terms. Legal bases: legitimate interest (GDPR Art. 6(1)(f)) and pre-contractual steps (Art. 6(1)(b)). The location is computed on our own servers from a local database: your IP address is never sent to any third party. This data is only accessible to the authorised organising team, is kept with your application file for the same periods and is erased when your account is anonymised. IP Geolocation by DB-IP (https://db-ip.com), licensed under Creative Commons Attribution 4.0.
7. Email service provider
VIMUN platform emails (account verification, password reset, applications, interviews, payments, invitations, notifications) are sent by our own mail service hosted by Infomaniak Network SA (Switzerland), a country covered by a European Commission adequacy decision. The newsletter, sent only to people who have consented to it, is managed with Brevo (Sendinblue SAS, established in France): your email address and first name are shared with it for that purpose, without any transfer outside the European Economic Area. You can unsubscribe at any time from each newsletter or from your profile.
8. Recipients and processors
Your data is accessible to authorised members or representatives of Associazione Alternativa who need it to organise the project. We use processors: Namecheap, Inc. (platform hosting, United States), Infomaniak Network SA (platform email delivery, file storage and DNS, Switzerland), Brevo / Sendinblue SAS (newsletter only, France), Stripe (card payments) and Google (optional “Sign-In” authentication). Where applicable, these providers act under appropriate contractual arrangements and only to the extent necessary. Associazione Alternativa does not sell participants’ personal data.
9. International transfers
Associazione Alternativa is established in Italy, while part of the VIMUN activities take place in Morocco. The platform is also hosted in the United States (Namecheap, data centre in Arizona): your data is therefore transferred from the European Economic Area to the United States. This transfer, like the availability of data to recipients located in Morocco and the processing by certain processors outside the EEA (notably Stripe), is covered under Chapter V of the GDPR by means of the European Commission Standard Contractual Clauses (or another legally recognised mechanism). Processing by Infomaniak (Switzerland) is covered by the adequacy decision that Switzerland benefits from. We limit international transfers to what is necessary to organise the project.
10. Retention periods
Registration data (name, email…): kept for the duration of the project and for up to 3 years after the end of your participation, then deleted or anonymised, unless a longer statutory period applies or it is necessary to establish, exercise or defend a legal claim. Payment and transaction records: kept as required by applicable Italian accounting and tax legislation. Emails containing personal data: only as long as reasonably necessary to administer the project and manage potential disputes. Technical and security logs: only as long as necessary for security and legal purposes. You may request earlier deletion (see "Your rights").
11. Cookies
We only use strictly necessary cookies (authentication session, language preference, storing your cookie choice) for the operation and security of the site. Should we ever introduce analytics, advertising or profiling technologies, we would provide the appropriate information and obtain consent where required. See our dedicated cookie policy.
12. Audience measurement
We measure site traffic with GoatCounter, self-hosted on our servers, based on our legitimate interest (GDPR Art. 6(1)(f)) in understanding the platform's audience. No cookie is set and no IP address is kept; only aggregated statistics (pages viewed, country of origin, browser, referrer) are produced. The total number of visits and their breakdown by country are shown publicly on the home page.
13. Security (GDPR Art. 32)
We implement appropriate technical and organisational measures: access controls, secure authentication, hashed passwords (bcrypt), encryption of data in transit (HTTPS/TLS), private file storage, minimised logging (personal data redaction) and regular review of access. No online service can guarantee absolute security, but we take reasonable measures to protect your data.
14. Your rights (GDPR)
You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent at any time (without affecting processing already carried out). You can exercise access/portability (export) and erasure (account deletion) directly from your profile, under "Privacy & my data", or by writing to contact@voicesforimpact.eu. We respond within the time limits required by the GDPR, normally within one month.
15. Complaints
If you believe your data has been processed unlawfully, you may lodge a complaint with the competent supervisory authority. As Associazione Alternativa is established in Italy, the competent authority is the Garante per la protezione dei dati personali (garanteprivacy.it). You may also lodge a complaint with the supervisory authority of the EU Member State of your habitual residence or place of work.
16. Changes
We may update this policy to reflect changes in our activities, services or legal obligations. The latest version is published on the VIMUN website together with its update date.
17. Contact
Associazione Alternativa A.P.S — VIMUN (Voices for Impact Model United Nations), registered office at Via Ippocrate 45, 20161 Milan, Italy. Email: contact@voicesforimpact.eu.