Privacy policy

Only what's genuinely needed, and only when it's needed.

If you book an activity

• First name, last name, email and phone: to confirm your booking and let you know if anything changes.
• Italian tax code: we ask it of people in Italy, because the receipt requires it.
• Date of birth and sex: only of people outside Italy, and for the same reason. They have no Italian tax code, so we work it out from those two details: it is what the receipt is made out to.
• Names of the participants going in the water with you, and wetsuit size if requested.
• Acceptance of the waiver and declaration of fitness for the activity.

Payments

Card payments are handled by Stripe. We never see or store your card details.

• To deliver the service you asked for: a booking is a contract.
• Legal obligations: receipts and accounting records.
• Safety: the waiver and fitness declaration.

We don't profile anyone, we don't sell data to anyone, and we don't send you marketing unless you ask for it.

• Booking data: the current season plus the time needed for the club's own reporting.
• Accounting records: for the period required by tax law.
• Membership data: as required by the sports body.

The tax code is visible only to whoever runs the club: it never appears on the panel the instructors use on the dock, which shows only name, level and wetsuit size.

• Stripe, for payments.
• The hosting provider running the site.
• The sports federation, only for those who take out membership.
• The accountant, for tax compliance.

And Google, for visit statistics, but only if you consented: without your yes it receives nothing, not even your IP address.

You can ask us to access, correct, delete, restrict or export your data at any time. Write to the address above: a human answers, not a form. You also have the right to complain to the Italian data protection authority.

This is a translation of the Italian notice. In case of discrepancy, the Italian version prevails.

(on privacy under the GDPR - EU Regulation no. 679/2016)

With this notice, the sports club will process your personal, identifying and registry data under article 13 of the GDPR, in the ways and with the precautions set out below:

1) Parties involved in the processing

• Data subject – The person who provides their personal data and to whom this notice is addressed;
• Controller – the sports association that collects the data and processes, stores or transmits it;
• Processor – Any person appointed to process the data;
• Third party receiving the data – The party to whom the data is provided by the sports club.

2) How data is processed

Your personal data will be collected and processed after you have given your consent. Processing may also take place using paper, electronic, IT or web-based means, for the operations set out in art. 4 of the Code and art. 4(2) of the GDPR, such as: recording, organisation, consultation, processing, alteration, extraction, use, communication, erasure.

3) Purposes of processing

Following your consent, processing serves to record your payment and send the payment receipt.

Where an application for membership has been made, it serves to manage your application for admission as a Member of the ASD (amateur sports association)/registration as set out in the body's Statute, your participation in the activities offered, and your registration with Sports Promotion Bodies or CONI Federations, as well as entry in the C.O.N.I. Register for recognition for amateur sports purposes. Communications on the management of the membership itself, including communications about the activities carried out with the above sports club, will be sent to the e-mail address you give when applying.

4) Whether providing data is mandatory

Providing the data is necessary and mandatory for the purposes stated, and refusal will make it impossible to join the sports club, to take out membership and to send the data to the CONI Register.

5) Communication of data

The data you provide will be processed by us and communicated, for the stated purposes of processing, to FISSW – Federazione Italiana Surfing Sci Nautico e Wakeboard (the Italian Surfing, Water Ski and Wakeboard Federation), to CSEN (Centro Sportivo Educativo Nazionale – a Sports Promotion Body recognised by CONI), and through them to CONI Servizi S.p.A. and Coninet S.p.A., for the institutional purposes following from membership. They will act with full autonomy as Processors for their respective obligations. The data will also, on request, be communicated to Public Administrations for legal purposes.

6) Where and how data is kept

Personal data is kept by the Controller on paper and/or on computer servers, in places normally located within the European Community. On request by the data subject, the storage addresses as at that date will be communicated.

7) How long data is kept

Your data will be kept for the period set out by the CONI rules in force. After that period it will be archived in protected files for the period required by law, and then destroyed.

8) Rights of the data subject

By specific request sent to the above sports club, as Controller, by registered letter or e-mail, you may find out which of your personal data the body holds, and ask for it to be amended, rectified or destroyed. You may also complete or update it, or request a copy. Requests for paper copies not collected at the body's premises will be subject to a contribution towards postage. In the same way you may also withdraw your consent, object to the processing of all or part of the data, or ask for it to be sent to third parties you indicate. You may lodge complaints with the Garante per la protezione dei dati personali (the Italian Data Protection Authority) if you believe your rights have been infringed.

9) Control measures

Functional security checks will be put in place for IT and web systems through:

• Access control and traceability through IDs and Passwords at different levels;
• Encoding of Processing with identification and partitioning of processes;
• A Malware protection system;
• Minimisation of the data processed.

Physical security checks will be put in place through:

• Keeping paper records in protected places accessible only to authorised staff;
• Keeping the server hardware in a protected place, and data Backups;
• Careful contracts on the processing of personal data.

Organisational checks will be put in place through specific training of staff who have access to personal data.