Personal Data Processing Policy
World Association of Noonomy (WAN)
This WAN Personal Data Processing Policy describes the methods of processing personal data in accordance with Article 13 of Regulation (EU) 2016/679 (GDPR). The WAN Personal Data Processing Policy does not apply to other third-party websites that may be accessed through links on this website, for which no responsibility is accepted.
1. Who is the Data Controller? How can it be contacted?
The Data Controller is the World Association of Noonomy (WAN) with its registered office in Milan, Italy, at Via Mecenate 84/8, tax code/VAT 98017870159. To contact the Controller: email: privacy@noonomy-wan.org.
The Data Protection Officer (DPO) has not been appointed: WAN data processing does not meet the criteria for mandatory appointment under Article 37 GDPR. Data protection questions may be sent to privacy@noonomy-wan.org.
2. What personal data is processed?
For membership purposes, WAN may process: first name, patronymic (if any) and surname, age, country of residence/work, position, academic degree, title, email address, residential address, optional telephone number, optional personal photograph, information on participation in events and publications related to noonomy, membership status, confirmation of payment of the membership fee, receipt of a grant, records of decisions of the WAN Council and correspondence with the member, information on awarding the member, as well as other personal data that may be required for the purposes of membership in WAN and achievement of its purposes provided for by the WAN Statute.
WAN does not collect personal data of persons under 18 years of age.
3. Purposes, legal bases, data retention period and nature of provision of data
The main purposes of processing are set out below. Mandatory data are marked with an asterisk in the application form. Optional data are processed only if voluntarily provided and, where required, on the basis of consent.
Purpose A) Admission and registration of members; management of membership relations; keeping the register (Book) of WAN members
Collection and processing of identification and contact data of potential and current WAN members for the purposes of considering and processing membership applications, maintaining membership relations, ensuring participation in WAN governance (Assembly meeting, voting right, notices, internal messages related to membership status), as well as keeping and updating the internal register (Book) of members (Libro Soci) and minutes of WAN bodies, as required by the Statute (Arts. 5, 12, 12b, 13 and 17).
Legal basis: performance of a contract to which the data subject is party / pre-contractual measures (Art. 6 para. 1 letter b) GDPR).
Data retention period: for the term of membership in WAN and, after its termination, for 10 years (on the basis of legal obligations of accounting/tax records and legitimate interest in defending legal claims, Art. 6(1)(c) and (f) GDPR).
Nature of provision: mandatory for data marked * (or “required”) in the application form. Failure to provide such data makes registration impossible. Inclusion in the internal register (Book) of members is a necessary consequence of membership and does not depend on consent.
Purpose B) Publication of the members catalogue on the WAN website and indication of members in WAN publications and informational materials
Publication of selected identifying data of the member (for example, first name, surname and, where consent is available, position, academic degree, title, city/province, participation in events and publications related to noonomy) in the members catalogue on the WAN website, as well as indication or mention of the member in WAN’s own institutional publications, reviews, research materials and informational materials.
Legal basis: consent (Art. 6 para. 1 letter a) GDPR).
Data retention period: until withdrawal of consent and in any event no longer than the term of membership in WAN. The data subject may withdraw consent at any time without consequences for membership status.
Nature of provision: optional. Members who have not given consent will not be indicated in the members catalogue published on the website (or will be indicated only in pseudonymised form / by initials). This does not affect membership in WAN.
Purpose C) Participation in WAN activities and initiatives
Processing of members’ data necessary for organising and managing participation in the activities that WAN carries out for the purposes provided for by the Statute (Art. 3 of the Statute).
Legal basis: performance of the membership contract / fulfilment of obligations related to membership (Art. 6 para. 1 letter b) GDPR), in respect of activities intended for members and their direct participation in WAN.
Data retention period: for the term of the specific activity/event and subsequently for the period necessary for administrative, accounting and reporting purposes (as a rule, up to 10 years).
Nature of provision: optional in relation to any separate initiative or event (the member may not participate); failure to provide data necessary for a specific activity will only prevent participation in it and will not affect membership in WAN.
Purpose D) Mailing, scientific materials and invitations to conferences/events
Sending to the email address provided upon registration institutional messages, mailings, scientific/informational materials and invitations to conferences, seminars and webinars organised by WAN, for the purposes provided for by the Statute (promotion of research and dissemination of knowledge, professional development of members). The Data Controller may use analytics/reporting tools for messages sent (for example, number of openings and clicks, delivery status) to evaluate and improve the service.
Legal basis: legitimate interest of the Data Controller (Art. 6 para. 1 letter f) GDPR and Recital 47), consisting in achieving WAN’s institutional informational purposes, subject to a documented Legitimate Interest Assessment (LIA) balancing WAN’s interest with the rights and freedoms of the data subject. The data subject may object to such processing at any time, free of charge, including via the unsubscribe link in each message.
Data retention period: until the data subject objects/unsubscribes; each message contains an immediate unsubscribe mechanism.
Nature of provision: optional. The email address is provided upon registration for the general purposes of membership relations (see Purpose A); its use for mailing is a separate processing to which one may object. If the data subject objects/unsubscribes, he/she will simply stop receiving the mailing; this does not affect membership or access to WAN activities.
Purpose E) Publication of images, photographs, videos and audio from WAN events
Collection during events organised by WAN (conferences, seminars, training, including in webinar/remote format), and subsequent dissemination of personal data, including images (photo/video/audio), for advertising and informational purposes related to WAN activities and services, through such channels as the website, social networks, magazines, brochures and presentations.
Legal basis: consent (Art. 6 para. 1 letter a) GDPR): the data subject has expressed consent to the processing of his/her personal data.
Data retention period: the data subject has the right to withdraw this consent at any time; for printed advertising materials already produced, distribution will continue until the existing print run is exhausted, after which images/data will not be reproduced in subsequent materials.
Nature of provision: optional. Failure to provide or refusal of consent does not affect membership or participation in WAN events; the data subject may, where possible, be excluded from photo/video shooting or, upon request, his/her image may be excluded from subsequent publications.
Purpose F) Transfer of data to third parties (partners and sponsors of the Data Controller) for marketing purposes
Transfer of data to third parties (partners and sponsors of the Data Controller) for marketing purposes, that is, for receiving advertising materials and commercial/informational messages from third parties operating, for example, in the following sectors: consulting and training companies, universities, software development companies and, in general, third parties affiliated with WAN.
Legal basis: consent (Art. 6 para. 1 letter a) GDPR): the data subject has expressed consent to the processing of his/her personal data.
Data retention period: the data subject has the right to withdraw this consent at any time.
Nature of provision: provision of data is optional. Failure to provide data for this purpose will not affect membership in WAN.
4. Recipients of personal data
We may disclose information about you, ensuring that the recipients are contractually obliged to keep your personal data confidential and comply with GDPR and other applicable data protection laws. Personal data may be processed by members of the WAN Council, authorised employees or volunteers of WAN, IT providers, website and hosting providers, email/mailing providers, CRM or membership management system providers, payment providers, accountants, legal consultants, event platforms, photo/video contractors (where applicable) and public authorities where required by law. Processors act on the basis of agreements under Article 28 GDPR, where applicable. Partners and sponsors to whom your data are transferred under Purpose F act as independent data controllers and process them for their own purposes in accordance with their own personal data processing policies; WAN is not responsible for such processing.
The list of Data Processors is constantly updated and is available upon request by email: privacy@noonomy-wan.org.
5. Transfer of data outside the EEA
We operate globally and may transfer your personal data to countries outside the European Economic Area. Such transfers are carried out with the application of safeguards under Chapter V GDPR, including adequacy decisions, Standard Contractual Clauses and, where necessary, transfer impact assessments and supplementary measures. You may request a copy of the relevant safeguards (for example, Standard Contractual Clauses) by contacting privacy@noonomy-wan.org.
6. Automated decision-making
WAN does not carry out fully automated decision-making producing legal or similarly significant effects. Admission decisions are made by the competent body of WAN in accordance with the Statute and internal rules.
7. Security
We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration. However, no system is completely secure, and we cannot guarantee the absolute security of your personal data.
8. Cookies
The WAN website uses cookies. Strictly necessary cookies are required for the operation of the website and are used without consent. Non-essential cookies (for example, analytics cookies) are activated only after receiving your consent through the cookie banner, in accordance with Article 122 of the Italian Data Protection Code (Legislative Decree 196/2003) and the Garante recommendations on cookies. A separate Cookie Policy describing the categories of cookies used, their purposes and retention periods is published on the website.
9. Rights of the data subject
You have the right to request access to your personal data and their rectification or erasure, restrict or object to processing, to data portability, and also to withdraw any consent at any time (without prejudice to the lawfulness of processing carried out before withdrawal), by contacting by email: privacy@noonomy-wan.org. You also have the right to lodge a complaint with the Garante per la protezione dei dati personali or another competent supervisory authority.
10. Changes to this Policy
WAN may update this Personal Data Processing Policy. The date of the last update will be indicated in the document. We recommend periodically reviewing this WAN Personal Data Processing Policy.
Date of update: 01.09.2026.