Privacy and Cookie Policy

PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA (Arts. 13-14 EU Reg. 2016/679 – GDPR)

Data controller
A.S.D. WE RIDE
Registered office: Via Cozzanello 23/A, 54038 Montignoso (MS), Italy
Tax Code: 92037860456
Contact details: info@weridesurfschool.com

Version and date: 10/10/2024

1) What this notice covers

This notice describes how A.S.D. WE RIDE processes the personal data of:

• members and registered card holders (including athletes and participants);

• parents/guardians of minors;

• participants in activities, events, courses, outings and competitions;

• prospective members and people requesting information;

• volunteers, collaborators and suppliers (to the relevant extent);

• users who interact with the Association's digital channels (e.g. email, social media, website if present).

2) Categories of data processed

Depending on the relationship with the Association, the following may be processed:

Common data

• personal and contact details (first name, surname, date and place of birth, address, email, phone);

• administrative and accounting data (fees, payments, IBAN if used, receipts, invoices);

• identification data for membership (card number, sports club, affiliating body).

Special categories of data (Art. 9 GDPR)

• health data only if necessary for sporting activity (e.g. sports medical certificate, fitness to practise, any information useful for safety during the activity).
  Such data are processed with enhanced measures and for the time strictly necessary.

Images and videos

• photos and footage taken during activities and events, which may be used for internal documentation and/or communication (according to the legal bases set out below).

Data of minors

• the minor's data and the parent/guardian's contact details; where necessary, collection of declarations/consents from the holder of parental responsibility.

3) Purposes of processing and legal bases

The Controller processes data for the following purposes:

A) Management of the association and running of sporting activities

• registration, admission as a member, membership/affiliation with sports bodies, management of member records, notices, organisation of courses/training/outings/competitions, attendance management, operational communications.
  Legal basis:

• performance of a contract or pre-contractual measures (Art. 6.1.b GDPR);

• compliance with legal obligations (Art. 6.1.c GDPR) connected with the management of the association and its sporting activities;

• the Controller's legitimate interest in organising and ensuring the proper running of activities (Art. 6.1.f GDPR), within the limits of compatibility.

B) Administrative, tax and accounting obligations

• management of membership fees, issuing of accounting documents, bookkeeping, tax obligations.
  Legal basis: compliance with legal obligations (Art. 6.1.c GDPR).

C) Protection of health and safety during sporting activity (special categories of data)

• checking and filing of fitness certificates, handling of any emergencies or accidents during the activity.
  Legal basis:

• obligations and rights under employment and social security law to the extent applicable and/or sports regulations (Art. 9.2.b GDPR, where relevant);

• reasons of public interest in the area of public health/safety and the management of amateur sporting activity where provided for (Art. 9.2.g / 9.2.i GDPR, within the applicable limits);

• alternatively and where necessary: explicit consent (Art. 9.2.a GDPR).
  (Practical note: for many amateur sports associations, processing the medical certificate is “necessary” to carry out the activity safely and in compliance with sports rules; if you prefer a more cautious approach, you may also provide for explicit consent at the time of collection.)

D) Insurance cover and claims handling

• activation/management of insurance policies, communications to companies/bodies, claims handling.
  Legal basis: performance of a contract (Art. 6.1.b) and/or legal obligation (Art. 6.1.c); for any special categories of data: Art. 9 GDPR as required.

E) Information about the association's activities

• sending of organisational communications (e.g. timetable changes, events, meetings) by email/phone/WhatsApp or similar channels.
  Legal basis: performance of the membership relationship (Art. 6.1.b) and legitimate organisational interest (Art. 6.1.f).

F) Promotion, newsletters and “marketing” communications (optional)

• sending of newsletters/promotions about initiatives and sponsors, and communications not strictly necessary for the membership relationship.
  Legal basis: consent (Art. 6.1.a GDPR).
  Consent may be withdrawn at any time.

G) Publication of photos/videos to communicate and showcase the activity

• publication on the website (if present), social media, posters, press releases and institutional materials.
  Legal basis:

• consent (Art. 6.1.a GDPR), especially when the image clearly identifies the person and is intended for public distribution;

• in limited cases: legitimate interest (Art. 6.1.f) for internal documentation or non-prejudicial reporting, without prejudice to the right to object.
  For minors: consent of the parent/guardian where required.

H) Handling of disputes and protection of rights

• handling of complaints, disputes, debt recovery and legal defence.
  Legal basis: legitimate interest (Art. 6.1.f) and/or legal obligation (Art. 6.1.c).

4) Provision of data: compulsory or optional

• Providing the data needed for registration, membership, management of activities and legal obligations is compulsory: failure to provide them may prevent the membership relationship from being established or continued and/or participation in activities.

• Providing data for marketing/newsletter purposes and for publication of photos/videos is optional and any refusal does not affect participation in activities (except where filming is an essential part of the event, and in any case with adequate information).

5) Processing methods and security measures

Processing is carried out using paper and digital tools, in compliance with the principles of lawfulness, fairness, transparency, data minimisation and storage limitation.
The Controller adopts appropriate technical and organisational measures (e.g. access control, credentials, backups, limiting authorised persons, protection of archives).

6) Recipients of the data

Data may be disclosed, to the relevant extent, to:

• sports promotion bodies/federations/affiliation and membership organisations (for managing cards and activities);

• insurance companies and intermediaries (for cover and claims);

• professionals and consultants (accountant, employment consultant, lawyers, IT consultants) bound by confidentiality;

• service providers (hosting, email, payment processing, management platforms, messaging services) appointed, where necessary, as Data processors under Art. 28 GDPR;

• Public Authorities where required by law or by order of the Authority.

The up-to-date list of Data Processors may be requested using the Controller's contact details.

7) Transfer of data outside the EEA

As a general rule, data are processed within the European Economic Area (EEA).
Where certain providers (e.g. cloud services, email, social media, messaging tools) involve a transfer outside the EEA, it will take place in compliance with the GDPR by means of adequacy decisions, Standard Contractual Clauses (SCCs) and/or other safeguards provided for by Arts. 44–49 GDPR. Further information can be obtained by contacting the Controller.

8) Retention periods

Data are kept for the time necessary for the purposes stated and, in particular:

• membership and administrative data: for the duration of the relationship and afterwards in accordance with legal time limits (e.g. accounting/tax obligations);

• accounting records: in accordance with applicable civil and tax law;

• membership card data: for the duration of the membership and according to the rules of the affiliating body;

• medical/fitness certificates: for the period needed to verify fitness and for the time required by sports rules/regulations and/or for protection in the event of disputes, with restricted access;

• photos/videos: until consent is withdrawn or erasure is requested, except where non-prejudicial historical archiving or legal protection is needed.

9) Rights of the data subject

The data subject may exercise, where applicable, the rights set out in Arts. 15–22 GDPR:

• access to the data and to information about the processing;

• rectification of inaccurate data;

• erasure (“right to be forgotten”);

• restriction of processing;

• data portability (where applicable);

• objection to processing on grounds relating to their particular situation (for processing based on legitimate interest);

• withdrawal of consent at any time (without affecting the lawfulness of processing carried out before withdrawal).

To exercise your rights: write to [inserire e-mail/PEC del Titolare].

10) Complaint to the supervisory authority

If you believe the processing breaches the GDPR, you have the right to lodge a complaint with the Garante per la Protezione dei Dati Personali (the Italian supervisory authority) and/or to take legal action before the competent courts.

11) Source of the data (Art. 14 GDPR)

As a rule, data are collected from the data subject. For minors, data may be provided by the parent/guardian. Some data may come from affiliation/membership bodies or insurers, to the extent necessary.

12) Automated decision-making

The Controller does not carry out processing based solely on automated decision-making, including profiling, which produces legal or similarly significant effects.

Cookies