Information provided under Articles 12 and 13 of Regulation (EU) 2016/679 (GDPR). Revision: 9 November 2026.
1. Data controller
The controller of personal data processed through www.sportlawintegrity.it is Professor Luigi Melica. Contact details: luigi.melica@unisalento.it; telephone +39 339 782 4077. The same contacts may be used for requests concerning personal data protection.
2. Purpose of the website and scope of this notice
Sport Law Integrity is a research, education and outreach portal on law, management and integrity in sport. This notice covers browsing the website, communications sent directly by email, the administration of academic publications and events, and access by authorised users. External websites linked from this portal are governed by their own privacy notices.
3. Categories of personal data
Browsing: IP address, technical data from HTTP requests, date and time, browser, device, requested resources, response codes, and error or security logs, within the limits of the systems’ configuration.
Contacts: email address, name and other information voluntarily provided in messages sent to the controller.
Academic content: names, roles, professional affiliations, images and relevant information about lecturers, researchers, authors, speakers and persons involved in projects or events.
Authorised users: account details, contact information, role, credentials and technical data relating to access to and administration of the portal.
4. Purposes and legal bases for processing
The website processes technical browsing data to deliver its pages, maintain information security, prevent unauthorised access and ensure continuity of service. The legal basis is the controller’s legitimate interest in the secure operation of the website (Article 6(1)(f) GDPR), subject to the rights and freedoms of data subjects. Processing required by law is based on the applicable legal obligations (Article 6(1)(c)).
Information received by email is processed to handle and respond to enquiries and communications on the basis of the legitimate interest in managing contacts (Article 6(1)(f)), or, where an enquiry relates to a contract or steps taken at the data subject’s request before entering into a contract, Article 6(1)(b) GDPR.
Information about authors, speakers, researchers and participants is processed where relevant to document and communicate scientific projects, publications and events, based on the legitimate interest in academic, cultural and informational outreach (Article 6(1)(f)), without prejudice to other legal bases applicable to individual activities. Administrative staff access and related credential management are undertaken for service operation and security.
Special categories of data under Article 9 GDPR are not requested through the website and should not be sent voluntarily by email unless strictly necessary and legally permitted.
5. Email communications
The website does not use a contact form. To contact the controller, visitors may email luigi.melica@unisalento.it directly. Processing covers the sender’s email address and any information freely included in the message. Messages may remain in mailboxes, transmission systems and email-service backups. Visitors are asked not to send unnecessary special-category personal data.
6. Publications, events and scientific activities
Articles, documents, photographs and information about events may contain personal data of people involved in the activities. Publication must comply with relevance and data-minimisation principles and any applicable legal requirements or authorisations. The custom events plugin publishes dates, locations and descriptions and does not itself manage registration or bookings.
If registration, newsletters, booking or payment systems are activated, this notice will be updated or specific information supplied before the relevant data are collected.
7. Cookies and similar technologies
The portal uses technical cookies and tools required for WordPress operation, security and authentication of authorised users, and language preferences. In particular, Polylang’s pll_language cookie remembers the browsing language. Strictly necessary technical cookies do not require consent but are described in this notice.
Google Analytics and the Jetpack Stats and Jetpack Newsletter modules are not used; these modules have been deactivated. The current functionalities described here do not include advertising analytics or visitor profiling.
Embedded content from third parties, if present, must be assessed on the relevant page. If non-technical cookies or similar tools are introduced, the controller will provide the necessary information and obtain prior consent where required. Users can also manage cookies through their browser settings. Blocking technical cookies may affect essential website functions.
8. Technical providers and recipients
Personal data may be processed, within their respective duties, by individuals authorised by the controller and by providers of hosting, technical website management, security, email and backups. The portal uses Aruba hosting infrastructure and WordPress with the technical components necessary for its operation, including Polylang and security tools.
Providers processing personal data on behalf of the controller are subject to the arrangements required by Article 28 GDPR, where applicable. Aruba may act as a processor for data hosted on behalf of the customer and as an independent controller for its own specific contractual processing, according to the service terms. Data may be disclosed to public authorities where required by law.
The SimplyBook.me booking system, Google Analytics and Jetpack Stats are not used. There is no public user-registration facility or visitor newsletter.
9. International transfers
Data may be processed by technical providers and their sub-processors in accordance with the locations and conditions applicable to the services used. Where personal data are transferred outside the European Economic Area, the controller applies the requirements of Chapter V GDPR, including adequacy decisions, standard contractual clauses or other permitted safeguards where necessary. More specific information on individual processing activities may be requested from the controller using the contact details in section 1.
10. Retention periods and criteria
Personal data are retained for as long as necessary for the stated purposes, taking into account security requirements, legal obligations and protection of rights.
- Enquiries and communications: as a general criterion, messages are retained for up to 12 months after the relevant matter is closed, unless further justified legal or documentary needs apply. Deletion from different email systems and backups may follow separate technical schedules.
- Browsing and security logs: these are retained according to the hosting provider’s technical cycles and the needs of operation, abuse prevention, incident detection and possible legal claims. The controller intends to limit ordinary logs to 30 days and logs concerning specific incidents to 90 days where technically and contractually possible, except where longer periods are justified or required. These are not declarations of periods already independently applied by the provider.
- Backups: automatic copies are retained according to the cycles of the Aruba service actually subscribed to. According to the public commercial terms, the Managed Hosting Premium plan provides web-space backup availability for up to 30 days. Manual backups may remain without automatic expiry and are subject to periodic review and deletion by administrators when no longer necessary.
- Authorised staff accounts: for the duration of the assignment and thereafter for any period justified by retention obligations or security and documentation needs.
- Articles, events and scientific materials: for as long as retention and publication remain justified by academic, informational, documentary and archival purposes, subject to assessment of data-subject requests.
For details of the criteria applicable to a particular processing activity, or to exercise rights under the GDPR, contact the controller.
11. Nature of data provision
Sending an email is optional. To receive a response, a valid email address must be supplied; the website has no mandatory data collection fields. Strictly necessary technical data are processed when the service is accessed. Additional functions, if introduced, will be accompanied by appropriate information where necessary.
12. Security of processing
The controller adopts technical and organisational measures proportionate to risk, including secure website connections, access controls for administrators, software updates, maintenance and recovery procedures. No technical measure can entirely eliminate risks associated with electronic communications.
13. External links and embedded content
The portal may link to universities, European projects, scientific websites and social networks. Opening external links subjects users to the relevant operators’ privacy notices. Embedded videos, maps or other third-party content may involve disclosure of data to third parties and require further checks or consent mechanisms.
14. Data-subject rights
Where and to the extent provided by Articles 15–22 GDPR, data subjects may request access, rectification, erasure, restriction, portability (where applicable), or object to processing. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing before withdrawal.
To exercise these rights, email luigi.melica@unisalento.it or telephone +39 339 782 4077. The controller responds within the time limits set by Article 12 GDPR.
15. Complaints
Data subjects may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), without prejudice to the right to seek judicial protection before the competent courts.
16. Automated decision-making
The custom features examined do not provide for decisions based solely on automated processing that produce legal effects or similarly significantly affect data subjects within the meaning of Article 22 GDPR. Anti-spam checks serve to prevent unwanted automated submissions.
17. Changes to this notice
This notice may be updated following changes in legislation, technology, organisation or the introduction of new functions. The current version will display the date of its latest update.