Privacy Policy

1. Data controller

The data controller is Aaacademy ASD, with registered office at Via Rassiche 24, 25048 Edolo (BS), Italia.

For any question about your data you can write to us at aaacademyasd@gmail.com — tel. +393396190345.

2. What data we process

• Browsing data: IP address, browser type, pages visited and access times, recorded automatically by the servers hosting the website to keep it running and secure.
• Data you give us when you contact us via WhatsApp, email or phone: name, phone number, email address and the content of your messages.
• Data needed to sign up for lessons, camps and season programmes: first and last name, date of birth, contact details, experience level and, for minors, the details of the parent or legal guardian.
• Data for club membership and competitive activity: the data required by FISI and the sports medical fitness certificate, which contains health information.
• Photos and videos taken during activities, only with your consent (or a parent's consent for minors).

3. Why we process it and on what legal basis

• Answering your requests for information and preparing a quote — pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• Organising and running lessons, camps and training sessions, and managing bookings and payments — performance of a contract (Art. 6(1)(b) GDPR).
• FISI membership, race entries and checking sports fitness — legal obligations and sports regulations (Art. 6(1)(c) GDPR); for health data, Art. 9(2)(b) and 9(2)(h) GDPR.
• Tax and accounting obligations — legal obligation (Art. 6(1)(c) GDPR).
• Website security and protecting our rights in the event of disputes — legitimate interest (Art. 6(1)(f) GDPR).
• Publishing photos and videos on the website and on our social channels — consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Providing data for contractual and legal purposes is necessary: without it we cannot sign you up for activities. Consent for photos and videos is optional and does not affect participation.

4. Minors

Many of our students are minors. Their data is collected through the parent or guardian, who also gives any consent for photos and videos. We do not knowingly collect data directly from children under 14 through the website.

5. How we process it and for how long

Data is processed with electronic and paper-based tools, by authorised people and with appropriate measures to protect it from unauthorised access, loss or disclosure.

• Requests for information that go no further: up to 12 months from the last contact.
• Registration and payment data: for the duration of the relationship and then for 10 years, as required by Italian civil and tax law.
• Medical certificates: for their period of validity and for as long as sports regulations require.
• Photos and videos: until consent is withdrawn.
• Technical website logs: for as long as strictly necessary for security, normally no more than 30 days.

6. Who it may be shared with

We do not sell or hand over your data. It may be received, only for the purposes stated above, by:

• the instructors, coaches and guides who run the activities;
• FISI and race organisers, for memberships and entries;
• insurance companies, in the event of an accident;
• our tax adviser and IT and hosting providers, appointed as data processors;
• public authorities, when required by law.

7. Transfers outside the European Union

If you contact us via WhatsApp, your messages pass through WhatsApp's (Meta's) systems, which may also process them outside the EU under its own privacy policy. Some technical providers may have servers outside the EU: in these cases the transfer is based on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or on Standard Contractual Clauses.

8. Cookies

This website does not use profiling cookies or third-party analytics or advertising tools. Only technical cookies and storage strictly necessary for the pages to work may be used, and these do not require consent.

Fonts are hosted on our own server, so displaying them does not send any data to third parties. Links to WhatsApp, Instagram, YouTube and TikTok lead to external websites, which apply their own privacy and cookie policies.

9. Your rights

At any time you can ask us to:

• access your data and receive a copy of it (Art. 15);
• correct or update it (Art. 16);
• erase it, when we are no longer required to keep it (Art. 17);
• restrict its processing (Art. 18);
• receive it in a format that another organisation can read (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw your consent, without affecting the lawfulness of processing carried out before.

To exercise your rights write to us at aaacademyasd@gmail.com: we reply within 30 days. If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

10. Changes

We may update this notice, for example if our services or the law change. The version in force is always the one published on this page, with the date of the last update.