Privacy Policy (GDPR)

At IdeaBoosterLab, accessible at, one of our main priorities is the privacy of our visitors. This Privacy Policy document contains types of information that is collected and recorded by and the information related to the whole training program.

Privacy Notice

With the following privacy policy, the Università Commerciale Luigi Bocconi (hereinafter “University”) and Esade Business School inform you that - pursuant to and for the purposes of the provisions of Article 13 of the European Regulation 2016/679 on the protection of personal data (“GDPR”) - your personal data will be processed by electronic and manual means, in Italy and abroad.

This information is drafted on the basis of the principle of transparency and all the elements required by the GDPR and is divided into individual sections in order to make reading faster and easier to understand.

1. Joint Controllers

The Joint Data Controllers, pursuant to the Article 26 of the GDPR, are Università Commerciale Luigi Bocconi, with registered office at Via Roberto Sarfatti, 25, 20100 Milan and Esade Business School (hereinafter jointly referred to as “Joint Data Controllers”).

The Joint Data Controllers have entered into an agreement whereby they have committed to:

  • jointly determine how Your personal data will be processed for the purposes set forth below;

  • jointly determine, in a clear and transparent manner, the procedures for providing you feedback on the exercising of your rights, as provided in the GDPR;

  • jointly define the information in the parts of common interest, indicating all the information required by the GDPR.


2. Purposes of the processing

Your personal data will be processed for the purposes of analysis, study and research as part of the project called “Scientific Approach to Innovation Management” (hereinafter the “Project”), conducted by the Joint Data Controllers. The objective of this study is to observe what decisions entrepreneurs make in the early stages of the process of creating a new company with the aim of understanding what practices help to assess the feasibility of new business ideas.


3. Personal Data

The Joint Data Controllers, upon your form completion on the platform (hereinafter the “Platform”), will process the following personal data:

  • name, surname and email address used in submitting the application form


4. Lawfulness of processing

For the pursuit of the purposes indicated it is necessary, according to art. 6 letter. a) of the GDPR, to collect your free consent.

You have the right to revoke your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

5.Compulsory or optional nature of the conferment of data and consequences of a possible refusal to provide data.

The provision of your personal data is necessary for the achievement of the purposes mentioned above.

Failure to provide your personal data, or providing partial or incorrect data, will make it impossible for you to participate in the Project.

6. Communication of personal data

Your personal data will be processed exclusively by persons authorized to process them pursuant to art. 29 of the GDPR and by legal and natural persons appointed pursuant to art. 28 of the GDPR as Data Processors, in compliance with the GDPR regulations, in order to carry out all processing activities necessary to pursue the purposes detailed. Personal data may be communicated to public bodies or judicial authorities, where required by law or to prevent or repress the commission of a crime.


7. Data Retention

Your personal data, in accordance with the principles of purpose limitation and storage limitation, will be kept for the period strictly necessary for the pursuit of the purposes indicated. In particular:

  • for the estimated time of duration of the Project (5 years);

  • for a further period (of up to 5 years), limited to research purposes identified in the Project and not achieved by the estimated time of duration.


8. Area of the Processing

Your personal data will be processed by the Joint Data Controllers within the territory of the European Union.

Should it become necessary to process data outside the European Union, the subjects that process your data for the purposes pursued by the University will be appointed as Data Processors and the transfer of personal data to such subjects, limited to the performance of specific Processing activities, will be regulated in accordance with the provisions of the GDPR.

All necessary precautions will be taken in order to ensure the full protection of personal data basing such transfer on the evaluation of appropriate safeguards including, by way of example, adequacy decisions of third country recipients expressed by the European Commission; appropriate safeguards expressed by the third party recipient pursuant to Article 46 of the GDPR.

In any case, you may request further details from the Data Controllers if your personal data has been processed outside the European Union, requesting evidence of the specific guarantees adopted.


9. Data Subect's Rights

Pursuant to Art. 15 et seq. of the GDPR you may, at any time, exercise the rights expressly granted to the data subject and in particular obtain

  • confirmation that there is a processing of personal data concerning You and to obtain access to the data and the following information (purpose of processing, categories of personal data, recipients and/or categories of recipients to whom the data have been and/or will be communicated, storage period);

  • the rectification of inaccurate personal data concerning you and/or the integration of incomplete personal data, also by providing a supplementary declaration;

  • the cancellation of personal data, in the cases provided for by the GDPR;

  • the limitation of processing in the cases provided for by the privacy legislation in force;

  • the portability of the data concerning you and/or request the direct transmission of your data to another data controller;

  • the opposition to the processing at any time, for reasons related to your particular situation, to the processing of personal data concerning you in full compliance with the privacy legislation in force, as well as for purposes related to marketing and profiling;

  • the revocation of the consent given. In any case, the revocation of consent does not affect the lawfulness of processing based on the consent before revocation.


You may exercise your rights by contacting the following e-mail address, attaching a copy of your identity document:

In any case, you will always have the right to complain to the competent control authority, pursuant to art. 77 GDPR, if you believe that the processing of your data is contrary to the privacy legislation in force.

Individual Data Processing Information Form

Information Given To The Interested Party For Personal Data Processing According To The General Data Protection Regulation N. 679/2016



Purpose of the project


According to the General Data Protection Regulation n. 679 of 2016 on personal data and concerning research participants’ personal data collected for research and analysis purposes by Esade Business School and Università Commerciale “Luigi Bocconi” for the research project “Scientific Approach to Innovation Management”, we inform research participants of the following.


Their personal data (hereafter “Data”) provided during the research activities mentioned above will be collected and stored with correctness, lawfulness, transparency and protection of their confidentiality. We will use digital tools to store the data collected and data will be kept on electronic files (password protected).


Data regarding racial and ethnical origin, religious, philosophical or other beliefs, political opinions, membership of political parties, labour unions, associations or religious, philosophical, political or labour union organizations, as well as personal data regarding your health state and sexual life and other biometric data, will not be collected.


Data will be collected for the goal of observing what decisions entrepreneurs make in the early stages of the process of new venture creation intending to understand what practices help to assess the feasibility of new business ideas. We will also observe the impact these decisions have over time, as the data collection process will continue for over a year up to two years.

Procedures and duration 


Data will be analysed in aggregated form since the interests of research are in aggregated responses, not individual responses. The participation in the research activities involve data collection until December 31st, 2024 that will be treated in conformity with the duties required by General Data Protection Regulation n. 679/2016 in the subject of personal data (Privacy Code).


The data collection procedures include structured interviews and surveys. After completing the required surveys, a member of the research team will contact each research participant to confirm receipt and to ask some follow-up questions based on the responses provided.


Please note that, as part of this project, we will ask each participant to provide a brief update on the data (every month for the subsequent 15 months). To conduct this update, a member of our team will call each participant. The call will approximately last 20-30 minutes. Research participants will be contacted in advance to set up a time of their convenience for the calls. Our team is flexible and can accommodate participants’ preferences, including setting up the monthly call during working hours but also in the evening or weekends if that works best.


The call will be set up by our research team, at no cost for participants, and use software or applications that conform to General Data Protection Regulation n. 679/2016. The content of the call will be transcribed and analyzed in aggregate form since the interests of research are in aggregate responses, not individual responses. The consent given can be revoked at any time. The full transcribed text of the interviews is accessible to those who are part of the research project.


The results of the analyses and the textual and anonymous citations from the interviews are used exclusively in the context of the research activity. These results constitute empirical material for the development and the publication/dissemination of scientific articles, books, and, more generally, scientific material. All data collected in the context of this project will be used exclusively in anonymized and aggregated form for academic research purposes and the public interest. None of the research participants’ data will be shared with other parties except the ones directly involved in the project. All data will be encrypted and stored on a (restricted-access) IT infrastructure.

Expected benefits and foreseeable risks

By participating in this study, participants will not experience any foreseeable risks beyond those ordinarily encountered in daily life or during routine physical or psychological examinations or tests. Specifically, participation in this study: i) will not, in any way, damage participants; ii) will not, in any way, imply the involvement in dangerous or injurious activities; and iii) will remain confidential.

In terms of benefits, participants will benefit from accessing a high-quality training program free of charge. Participation in the training program and data collection process also allows participants to access additional resources, events, and activities. Participation in all these activities is offered free of charge.

Voluntary Participation

Participation in the surveys, interviews and all the other activities of the present study is voluntary. Participants do not have to answer questions they prefer not to answer and may withdraw from the study at any time. However, withdrawal will prevent participants from accessing the resources and the remaining events and activities of the program.


Participants will not be paid for their participation, but they will receive free training and free access to all events and activities. Participants who will complete the program, and attend at least 80% of the training sessions, will also obtain a free-of-charge certificate that confirms successful completion of the course.


Taking part in this study as a participant does not give any right or claim of any nature over the research or/and over its results.


Confidentiality of data

Data will be communicated by research participants to the research staff of Esade Business School and Università Commerciale “Luigi Bocconi”, but only and exclusively for the goals described above. Data will not be shared with subjects different from the ones indicated in this document, nor they will be transferred to third parties.


All appropriate precautions will be adopted to maintain the secrecy and confidentiality of data. To this aim, data will be ‘pseudonymised’, dividing the research data collected through questionnaires, surveys and interviews from direct identifiers’ data. Direct identifiers will be segregated from the other research data, i.e., kept and stored in different physical and virtual locations.


We remind research participants that they may exercise at any moment the rights in the articles 15, 16, 17 and 18 of General Data Protection Regulation n. 679 of 2016. Therefore, they are entitled to obtain the update, rectification, deletion or the integration of data. They can do so by submitting their request to the data control office at Università Luigi Bocconi, via Sarfatti 25, 20136, Milan, clearly indicating that they are requiring access to data collected as part of this project.


If they wish to have their data erased, they might request that the data related to their participation in this project be deleted. UNIVERSITA’ COMMERCIALE “LUIGI BOCCONI” (hereinafter referred to as “Bocconi University”), having its registered office in Milano at via Sarfatti 25, hereby declares that it falls within the field of application General Data Protection Regulation n. 679/2016 dealing with the protection of personal data (hereinafter referred to as the “Law”), regarding the use of the data subject’s personal data (hereinafter referred to as “Data”) that is specifically indicated above.



The true or complete objectives of the research will not be described in advance to participants, as doing so might influence the outcomes. Participants will have an opportunity to receive a complete explanation of the study following its completion.


For queries related to this project you might contact the research team:


For feedback or comments, you may contact the Principal Investigator or Chair of the Institutional Review Board/Ethics Committee at



Declaration of Consent


The undersigned confirms that he/she received the information that precedes and declares to have read and understood its content. The undersigned confirms that he/she is 18 years of age or older, and volunteers to take part in this research. Taking note that Data are processed in full compliance with the Law, the undersigned freely consents to his/her Data to be used in the manner and uses described. The undersigned also declares to have understood his/her rights and limitations, as well as how to exercise them.