PRIVACY POLICY
Information notice on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679
1. Introduction
This notice describes how ASD Flamingo Surf Club Puglia processes the personal data of users who visit the website www.flamingosurfclub.it, fill out contact forms, request information, membership or bookings, take part in the Club’s activities, or interact with the Club through the channels indicated on the site.
This notice is drafted in compliance with Regulation (EU) 2016/679, Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, the measures of the Italian Data Protection Authority, and the applicable legislation on cookies and tracking tools. The text is written in a discursive style to allow the data subject to clearly understand who processes the data, for what purposes, on what legal bases, for how long, and with what rights.
2. Data controller and contact details
The data controller is ASD Flamingo Surf Club Puglia, tax code and VAT number 08615610725, with its registered office or place of activity at Contrada Paludi, 76125 Trani (BT). The controller can be contacted at the email address flamingosurfclub@gmail.it or at the number +39 388 9415868, subject to subsequent updates of the contact details published on the site.
As of the date of this notice, no Data Protection Officer is indicated on the site. Should the Club appoint a DPO, the relevant contact details will be published in this notice or communicated by suitable means.
3. Categories of data processed
When the user browses the site, the Club and its technical suppliers may process browsing data, such as IP address, online identifiers, browser and device information, date and time of access, pages visited, technical data necessary for the operation of the site, and information collected through cookies or similar tools, as also indicated in the cookie policy and in the consent management panel.
When the user fills out a contact form, requests information, membership, bookings or collaboration, the Club processes the data voluntarily entered by the user, such as first and last name, email, phone number, message content, contact preference, information relating to the discipline or course of interest, and any further data spontaneously communicated.
When the user proceeds with membership, booking, purchase or participation in the activities, the Club may process identification data, contact details, payment data, tax or accounting data, information on participation in lessons, technical level, age, data of the parent or guardian in the case of minors, documentation required for access to the activities, and, where provided for by sports regulations or safety requirements, information relating to fitness for sports practice or medical certifications.
The Club invites users not to enter unnecessary data, data belonging to special categories, health information, personal opinions, or third-party data into the online forms, unless this is essential for the specific request and the user is entitled to communicate it.
4. Purposes of processing and legal bases
Browsing data is processed to allow the technical functioning of the site, ensure system security, prevent abuse, derive technical statistics, and comply with legal obligations. The legal basis is, depending on the case, the need to make the service requested by the user available, the fulfilment of legal obligations, and the controller’s legitimate interest in the security and correct functioning of the site.
Data entered in contact forms is processed to respond to user requests, provide information on courses, lessons, membership, collaborations, or other Club activities, as well as to manage the resulting communications. The legal basis is the performance of pre-contractual measures requested by the data subject or, in cases of a mere request for information, the Club’s legitimate interest in responding to those who contact it.
Data processed in relation to bookings, purchases, lessons, courses, packages, and membership is used to organize and provide the requested services, manage the calendar, payments, documentation, insurance, operational communications, membership relations, and administrative fulfilments. The legal basis is the performance of the contract or pre-contractual measures, the fulfilment of legal obligations, the management of the membership relationship, and the Club’s legitimate interest in the correct organization of the activities.
Should the Club process medical certificates, information on fitness for sports practice, or other health-related data, the processing will take place only when necessary to fulfil obligations provided for by sports regulations, to protect the safety of participants, or to allow participation in the activities under adequate conditions. In such cases, processing will be limited to what is strictly necessary and will be based on the applicable legislation and, where required, on the explicit consent of the data subject or of the person exercising parental responsibility.
Any promotional communications, newsletters, information campaigns not strictly connected to a user request, or direct marketing activities will be carried out only in the presence of a suitable legal basis, and in particular the consent of the data subject when required. Consent may be withdrawn at any time, without prejudice to the lawfulness of the processing carried out before the withdrawal.
Any images, photographs, or videos collected during events, lessons, or Club activities may be used for documentary, membership, promotional, or communication purposes only in compliance with the applicable legislation and, when necessary, subject to obtaining specific, separate, and documentable consent, especially in the case of minors.
5. Provision of data
The provision of technically necessary browsing data is essential to allow access to the site. The provision of the data requested in the contact forms is necessary to receive a response to the request sent; failing this, the Club may not be able to contact the user back or provide the requested information.
The provision of the data necessary for membership, booking, payment, or participation in the activities is necessary to establish and manage the relevant relationship. Failure to provide it may prevent admission to the Club, confirmation of the booking, provision of the service, or participation in the activity. The provision of data for promotional purposes or for the use of non-technical cookies is instead optional, and any lack of consent does not prevent browsing the site or using the essential services.
6. Methods of processing and security measures
Processing is carried out using IT, telematic, and, where necessary, paper tools, according to the principles of lawfulness, fairness, transparency, minimization, accuracy, integrity, and confidentiality. The Club adopts technical and organizational measures appropriate to the risk, with the aim of protecting data from unauthorized access, loss, destruction, improper disclosure, or use not in line with the declared purposes.
Access to the data is permitted only to authorized persons or to suppliers operating on behalf of the Club, within the limits of their respective duties and according to instructions consistent with the applicable legislation. The Club does not use the data for automated decision-making processes capable of producing legal effects on the data subject or similarly significantly affecting them.
7. Recipients of the data
The data may be communicated to parties that support the Club in carrying out its activities, such as IT service providers, hosting providers, site maintainers, administrative, tax or legal consultants, payment institutions, insurance companies, sports promotion bodies, federations, membership organizations, instructors, collaborators, organizational partners, and public authorities, when this is necessary for the stated purposes or required by law.
Suppliers that process data on behalf of the Club are, where necessary, designated as data processors pursuant to Article 28 of Regulation (EU) 2016/679. The data is not disseminated indiscriminately. Any publication of images, videos, names, or content attributable to data subjects will take place only when an adequate legal basis exists and, where required, subject to consent.
8. Transfers to third countries
The Club aims to process data within the European Economic Area. However, the use of technology suppliers, social platforms, messaging services, analytics tools, hosting, or payment systems may involve transfers of or access to data from third countries. In such cases, the transfer will take place only in the presence of the conditions provided for by Regulation (EU) 2016/679, such as adequacy decisions, standard contractual clauses, supplementary measures, or other safeguards permitted by the legislation.
Users who interact with social pages, maps, messaging tools, or external platforms should consider that such services are managed by independent data controllers and are governed by their respective privacy notices.
9. Retention periods
Data is retained for the time necessary to achieve the purposes for which it was collected and, subsequently, for the period required or permitted by law for administrative, tax, accounting, evidentiary, or rights-protection purposes.
Data collected through contact forms is retained for the time necessary to handle the request and, as a rule, no longer than twenty-four months from the last contact, unless the communication gives rise to a contractual or membership relationship or a need for further retention. Data relating to bookings, payments, contractual relationships, and administrative documentation is retained for the period provided for by civil, tax, and accounting law, normally up to ten years from the end of the relationship or the last relevant entry.
Data relating to membership and associative participation is retained for the entire duration of the relationship and subsequently for the period necessary to fulfil regulatory, insurance, or tax obligations or to protect the rights of the Club and the data subject. Any health data or medical certifications are retained only for the time strictly necessary to verify fitness and according to the terms provided for by the applicable sports regulations. Data processed for promotional purposes is retained until consent is withdrawn or, in the absence of interactions, for a period proportionate to the purpose pursued. Data collected through cookies is retained as indicated in the cookie policy and in the consent management panel.
10. Cookies and tracking tools
The site uses cookies and similar technologies to ensure the technical functioning of the pages and, subject to consent when required, for preferences, statistics, marketing, or other purposes indicated in the banner and in the cookie policy. Technical cookies are necessary for browsing or for the provision of a service requested by the user and do not require consent, without prejudice to the information notice. Profiling cookies, marketing cookies, or non-technical tools may instead be used only after the user has expressed a free and informed choice.
The user can manage or modify their preferences through the consent panel available on the site. The cookie policy must indicate, in an up-to-date manner, the categories of cookies used, their duration, their purposes, the third parties involved, and the methods for withdrawing or modifying consent.
11. Minors
The Club pays particular attention to the processing of the personal data of minors, especially in relation to membership, bookings, lessons, sports activities, parental authorizations, and images. When the service concerns a minor, the data must be provided by the person exercising parental responsibility or by an entitled party, except in cases where the legislation allows otherwise.
The use of images or videos of minors for promotional, social, website, or external communication purposes requires particular caution and, where necessary, specific consent from the parents or those exercising parental responsibility, separate from the acceptance of the conditions of participation or from membership.
12. Rights of the data subject
The data subject may exercise, in the cases and within the limits provided for by Regulation (EU) 2016/679, the right of access to personal data, rectification, erasure, restriction of processing, objection, data portability, withdrawal of consent when the processing is based on consent, as well as the right not to be subject to decisions based solely on automated processing when the conditions exist.
Requests may be sent to the controller using the contact details indicated in this notice. The controller may request information necessary to identify the data subject and will respond within the terms provided for by the legislation. The exercise of rights is in principle free of charge, except in cases of manifestly unfounded, excessive, or repetitive requests, within the limits permitted by the Regulation.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority, with offices at Piazza Venezia 11, 00187 Rome, or to bring the matter before the competent judicial authority, should they believe that the processing of their data takes place in violation of the applicable legislation.
13. Updates to this notice
The Club may update this notice to adapt it to regulatory, technical, organizational, or operational changes or to the services actually offered through the site. The updated version will be published on the site with an indication of the date of the last update.
The user is invited to consult the privacy policy periodically, especially before sending personal data through the forms or taking part in new Club activities.
Last revised 11.06.2026