Cart 0
Privacy Policy
Personal Data Protection Notice
Pursuant to Articles 13 and 14 of EU Regulation 2016/679 (GDPR)
8th LLRN Conference — Cagliari, 28–30 June 2027
Last updated: 30/07/2026
1. Data Controller
The Data Controller, as defined by Article 4(7) of the GDPR, is:
Fondazione Giacomo Brodolini SRL SB
Registered address: Via Goito 39, 00185 Rome, Italy
VAT number (P. IVA): 12102591000
Tax code (Codice Fiscale): 12102591000
Privacy contact e-mail: privacy@fondazionebrodolini.eu
The LLRN8 Conference is organised by Fondazione Giacomo Brodolini SRL SB and the Department of Law of the University of Cagliari, which provides local operational support for the event.
For data protection purposes, the role of each organisation involved in the Conference shall be determined according to the actual purposes and means of processing.
For any questions or requests regarding the processing of your personal data, please contact the Data Controller at the e-mail address above.
2. Scope of This Notice
This Privacy Policy applies to all personal data collected through the following channels and activities operated by the Data Controller in connection with the LLRN8 Conference:
- Conference Registration Form, including payment processing and invoicing;
- Contact Form;
- Panel / Abstract Submission Form;
- requests for visa invitation letters, where this service is made available;
- optional consent forms for photographs and video recordings;
- communications and operational activities necessary for the organisation and management of the Conference.
Data subjects include conference attendees and their accompanying persons, speakers and panel applicants, co-authors and panellists whose data are submitted by an applicant, members of the organising and scientific committees, and any individual who contacts the organisation via the contact form.
3. Categories of Personal Data Collected
3.1 Conference Registration Form
The following data are collected for the purpose of registration, event management, payment processing and invoicing:
- Full name;
- Organisation / Institution;
- E-mail address;
- Postal address (street address, city, province, postal code, country);
- Phone number;
- Professional role (Professor, Researcher, Post-doc, PhD, Other);
- Proof of PhD enrolment (document upload — collected solely to verify eligibility for the reduced registration fee);
- VAT number and/or tax identification number (collected for the purpose of issuing invoices and fulfilling fiscal obligations);
- Payment and order information, including proof of payment of the registration fee, order number, invoice number and, where applicable, refund details.
The following data are collected on a strictly voluntary basis and are not required to complete registration. Providing them is optional and their absence will have no impact on your participation:
- dietary preferences and/or food intolerances (for the data subject and, where applicable, for their accompanying person);
- disability or accessibility requirements.
Please note: the provision of data marked as mandatory in the registration form is a contractual requirement necessary to complete your registration. Failure to provide such data will make it impossible to process your registration and issue the relevant invoice.
3.2 Contact Form
The following data are collected when you submit a general enquiry:
- Full name;
- Organisation / Institution;
- E-mail address;
- Subject of the enquiry;
- Content of the message.
Please note: the provision of name and e-mail address is necessary to respond to your enquiry. Failure to provide these data will make it impossible to process your request.
3.3 Panel / Abstract Submission Form
The following data are collected for the scientific evaluation of proposals:
- Full name;
- Organisation / Institution;
- E-mail address;
- Professional role;
- Country of residence or institutional affiliation — collected solely to assess eligibility for financial support reserved for scholars from Global South countries. Providing this information is optional and has no bearing on the scientific evaluation of the submitted proposal;
- Abstract / panel proposal (text submission);
- names, affiliations, professional roles, e-mail addresses and contribution details of co-authors, panellists or other persons included in the submitted proposal, where provided by the applicant.
Please note: the provision of name, affiliation, e-mail address, and abstract/proposal is necessary to participate in the selection process. Failure to provide these data will make it impossible to evaluate your submission.
3.4 Personal Data Relating to Third Parties
Where a participant, speaker or applicant provides personal data relating to another individual, including an accompanying person, co-author, panellist or other participant, the person submitting the data confirms that they have informed that individual of the content of this Privacy Policy and, where required, has obtained the necessary consent or authorisation to provide such data to the Data Controller.
In such cases, the source of the personal data is the participant, speaker or applicant who provided the data to the Data Controller.
3.5 Photographs and Video Recordings
During the LLRN8 Conference, photographs and video recordings may be taken by the organisers or by authorised third parties. Such images and recordings constitute personal data within the meaning of Article 4(1) GDPR to the extent that individuals are identifiable therein.
Two distinct processing activities are envisaged:
- Internal documentation and institutional archive (e.g. keeping a record of the event for internal use): processed on the basis of the Data Controller’s legitimate interest pursuant to Article 6(1)(f) GDPR.
- External publication (e.g. on the conference website, social media channels, printed or digital institutional communications of Fondazione Giacomo Brodolini SRL SB and/or the Labour Law Research Network): processed on the basis of the data subject’s explicit consent pursuant to Article 6(1)(a) GDPR.
Consent to the external publication of photographs and video recordings is entirely optional and may be given or withheld independently of your conference registration. You may withdraw your consent at any time by writing to privacy@fondazionebrodolini.eu, without affecting the lawfulness of any publication made prior to withdrawal. Where consent is not given or is withdrawn, the organisers will use reasonable efforts to ensure that images in which you are identifiable are not published externally or are removed from online materials under the Data Controller’s control.
Withdrawal of consent may not affect materials already printed, lawfully published before withdrawal, archived for compliance purposes, or further disseminated by third parties outside the Data Controller’s control.
4. Purposes of Processing and Legal Basis
4.1 Conference Registration and Event Management
Purpose: to process your registration, manage attendance lists, issue invoices and receipts, organise catering and logistics (including dietary and accessibility requirements), manage refunds where applicable, issue badges, communicate event-related information before, during, and after the Conference, and provide assistance connected with participation.
Legal basis: performance of a contract or pre-contractual measures at the request of the data subject (Article 6(1)(b) GDPR). Where special category data are involved (dietary preferences that may reveal religious beliefs or health conditions; disability or accessibility information), the legal basis is the data subject’s explicit consent (Article 9(2)(a) GDPR), freely given and revocable at any time without affecting the lawfulness of prior processing.
4.2 Invoicing, Accounting and Fiscal Obligations
Purpose: to issue invoices and fulfil legal accounting and tax obligations under Italian law.
Legal basis: compliance with a legal obligation to which the Data Controller is subject (Article 6(1)(c) GDPR).
4.3 Scientific and Organisational Evaluation of Panel / Abstract Submissions
Purpose: to transmit submitted proposals to the members of the international organising committee, international scientific committee, and local organising committee for peer review, evaluation, and acceptance decisions, and to share participant details and panel content with the Labour Law Research Network (LLRN) for internal conference coordination purposes.
Legal basis: legitimate interest of the Data Controller in organising the scientific programme of the Conference (Article 6(1)(f) GDPR), balanced against the rights and interests of the applicants.
4.4 Publication of the Scientific Programme
Purpose: for accepted speakers, panellists and chairs, to publish limited professional information, such as name, affiliation, paper or panel title, abstract, session details and role in the Conference programme, website and related printed or digital materials.
Legal basis: legitimate interest of the Data Controller in organising, publicising and documenting the scientific programme of the Conference (Article 6(1)(f) GDPR), balanced against the rights and interests of the persons concerned.
4.5 Contact Form
Purpose: to respond to general enquiries submitted through the contact form.
Legal basis: legitimate interest in responding to communications addressed to the organisation (Article 6(1)(f) GDPR).
4.6 Photographs and Video Recordings
Purpose (internal documentation): to maintain an institutional archive of the event.
Legal basis: legitimate interest of the Data Controller (Article 6(1)(f) GDPR).
Purpose (external publication): to publish images and footage on the conference website, social media channels, and institutional printed or digital communications.
Legal basis: explicit consent of the data subject (Article 6(1)(a) GDPR), collected via a dedicated optional checkbox in the registration form or another appropriate consent mechanism.
5. Data Processors and Third-Party Recipients
Your personal data may be shared with the following categories of recipients, each acting either as a data processor pursuant to Article 28 GDPR, as an independent data controller, or as a person authorised to process personal data under the authority of the Data Controller, as specified below.
5.1 Payment Service Providers and Banks
Stripe, Inc. and PayPal Holdings, Inc. act as independent data controllers for payment transaction data processed through their respective platforms. Please refer to their own privacy policies for further information. Where payments or refunds are made by bank transfer, the relevant banks and payment institutions process transaction data as independent data controllers according to applicable banking and anti-money laundering rules.
5.2 E-commerce Platform
The registration system is operated via WooCommerce (Automattic Inc.), which processes registration and order data on behalf of the Data Controller as a data processor pursuant to a data processing agreement.
5.3 Organising and Scientific Committees
Members of the International Organising Committee, the International Scientific Committee, and the Local Organising Committee receive abstract and panel submission data (name, affiliation, professional role, country where applicable, and submitted proposal) solely for the purpose of peer review and scientific selection. Committee members act as data processors bound by confidentiality obligations and by instructions issued by the Data Controller.
5.4 Labour Law Research Network (LLRN)
The Labour Law Research Network (LLRN) (labourlawresearch.net), the international network co-sponsoring the LLRN8 Conference, receives participant details and panel/abstract content solely for internal coordination of the conference. LLRN acts as a data processor pursuant to Article 28 GDPR and processes data exclusively in accordance with the instructions of the Data Controller, without further independent use of the data received.
5.5 University of Cagliari
The Department of Law of the University of Cagliari contributes to the organisation of the Conference and provides local operational support for its management. In this capacity, the University of Cagliari may access and process relevant participant and logistical data for the purposes of organising, managing and delivering the Conference.
The University of Cagliari acts as a joint data controller, together with Fondazione Giacomo Brodolini SRL SB, for the processing activities connected with the organisation and management of the Conference, in accordance with Article 26 GDPR.
Participants may consult the relevant privacy notice at the following link: Privacy — Università di Cagliari.
5.6 Event, Logistics and Catering Providers
Personal data may be shared with event venues, catering providers, photographers, videographers, badge or printing service providers, interpretation or accessibility service providers, and other suppliers involved in the organisation of the Conference, only to the extent necessary for the performance of their services. Such providers process data either as data processors under Article 28 GDPR or as independent data controllers where required by the nature of their service or by applicable law.
5.7 Other Recipients
Personal data will not be sold, rented, or disclosed to third parties for commercial or marketing purposes. Data may be disclosed to competent public authorities, courts, legal advisers, auditors, insurers or other professional advisers where required by applicable law or where necessary to protect the rights and legitimate interests of the Data Controller.
6. International Data Transfers
Some of the third-party service providers and recipients listed above are established in countries outside the European Economic Area (EEA). In particular:
- Stripe, Inc., PayPal Holdings, Inc., Automattic Inc. and other relevant technology providers may be established in the United States. Where the recipient is certified under the EU-US Data Privacy Framework, transfers may be carried out on the basis of the relevant adequacy decision. Where the recipient is not certified or where the Data Privacy Framework does not apply to the specific transfer, transfers are carried out on the basis of Standard Contractual Clauses (SCCs) adopted by the European Commission or other safeguards pursuant to Chapter V GDPR.
- Members of the Organising and Scientific Committees, LLRN representatives and other recipients may be located in various countries around the world, some outside the EEA. Transfers to countries benefiting from an adequacy decision pursuant to Article 45 GDPR are carried out on the basis of such decision. Transfers to other third countries are carried out on the basis of SCCs or other appropriate safeguards pursuant to Article 46 GDPR, unless a derogation under Article 49 GDPR applies in specific and limited circumstances.
Upon request, the Data Controller will provide further information on the specific transfer mechanisms in place. Requests may be addressed to privacy@fondazionebrodolini.eu.
7. Data Retention
Personal data will be retained for the following periods:
- Invoicing and fiscal data (name, address, VAT/tax number, payment records): 10 years from the date of the relevant transaction, as required by Italian tax law and accounting obligations.
- Registration and event management data (attendance, dietary preferences, accessibility requirements, accompanying person data): 3 months after the conclusion of the Conference (i.e. no later than 30 September 2027), after which they will be securely deleted or anonymised, unless longer retention is necessary to manage disputes, claims, accounting obligations or legal requirements.
- Documents uploaded as proof of PhD enrolment: used solely to verify eligibility for the reduced registration fee and deleted within 60 days of verification, unless retention is necessary to handle disputes or legal obligations. The outcome of the verification may be retained with the registration records.
- Refund and cancellation records: for the period necessary to process the request and, where relevant, for the retention period applicable to accounting and payment records.
- Contact form data: until the enquiry is resolved and for a reasonable period thereafter (up to 12 months), unless a longer retention period is required by applicable law.
- Panel / abstract submission data: for the duration of the evaluation process and, in the case of accepted proposals, for the duration of the Conference and up to 3 months after its conclusion (i.e. no later than 30 September 2027), unless longer retention is justified for scientific programme documentation or dispute management.
- Published scientific programme information: for the period during which the Conference programme remains available as part of the scientific and institutional documentation of the event, unless the data subject validly objects and there are no overriding legitimate grounds for continued processing.
- Photographs and video recordings: images used solely for internal documentation will be retained for the period necessary for institutional archiving purposes. Images published externally on the basis of consent will be retained until consent is withdrawn, and in any case no longer than is proportionate to the original publication purpose. Upon withdrawal of consent, the Data Controller will use reasonable efforts to remove or anonymise online materials under its control within a reasonable timeframe.
Upon expiry of the applicable retention period, data will be securely deleted or irreversibly anonymised.
8. Your Rights as a Data Subject
Pursuant to Articles 15 to 21 of the GDPR, you have the following rights with respect to your personal data:
- Right of access (Art. 15): to obtain confirmation of whether your data are being processed and to receive a copy thereof.
- Right to rectification (Art. 16): to request the correction of inaccurate or incomplete data.
- Right to erasure (Art. 17): to request the deletion of your data (“right to be forgotten”), subject to applicable legal retention obligations.
- Right to restriction of processing (Art. 18): to request that processing be restricted in certain circumstances.
- Right to data portability (Art. 20): to receive your data in a structured, commonly used, machine-readable format and to transmit them to another controller, where technically feasible.
- Right to object (Art. 21): to object to processing based on legitimate interest, including processing connected with publication of programme information or internal documentation, where applicable.
- Right to withdraw consent (Art. 7(3)): where processing is based on consent (in particular for special category data such as dietary preferences and disability information, for newsletters/future communications, and for the publication of photographs and video recordings), you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
To exercise any of the above rights, please send a written request to: privacy@fondazionebrodolini.eu. We will respond within 30 days of receipt of your request, as required by Article 12 GDPR. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests, in which case you will be notified of the extension within the initial 30-day period.
9. Right to Lodge a Complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the competent supervisory authority. In Italy, the competent authority is:
Garante per la Protezione dei Dati Personali
Piazza Venezia 11, 00187 Rome, Italy
Website: www.garanteprivacy.it
E-mail: garante@gpdp.it
You may also lodge a complaint with the supervisory authority of the EU Member State of your habitual residence, place of work, or place of the alleged infringement, pursuant to Article 77 GDPR.
10. Security Measures
The Data Controller implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, in accordance with Article 32 GDPR. These measures include, inter alia, encrypted data transmission (TLS/SSL), access controls restricted to authorised personnel, role-based access to conference management tools, secure storage of uploaded documents, and regular security assessments of the systems used.
In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, the Data Controller will notify the competent supervisory authority within 72 hours of becoming aware thereof, and will inform affected data subjects without undue delay where required.
11. Automated Decision-Making and Profiling
No automated decision-making or profiling within the meaning of Article 22 GDPR is carried out in connection with the processing activities described in this notice. All decisions regarding the acceptance of abstracts and panel proposals are taken by human members of the organising and scientific committees.
12. Cookies and Tracking Technologies
The Conference website may use technical cookies and, where applicable, analytics or other tracking technologies. Technical cookies necessary for the functioning of the website may be used without consent, in accordance with applicable law.
Detailed information on cookies, similar technologies, retention periods, third-party providers and consent management will be provided in a separate Cookie Policy made available on the Conference website.
13. Changes to This Privacy Policy
The Data Controller reserves the right to update or modify this Privacy Policy at any time in order to reflect changes in applicable law, processing activities, service providers, cookie tools, or organisational structure. The most current version will always be made available on the Conference website (www.llrn8cagliari.it). Where changes are material, data subjects who have already provided their data will be informed by e-mail where appropriate.