Privacy policy

Data controller

The club uses the ClubPilot platform: its provider processes data on the club's behalf as data processor (art. 28 GDPR), under a written agreement.

What data we process

• Account: first and last name, e-mail, username, password (stored only in hashed form), preferred language.
• Member record: tax code, date and place of birth, contact details, address, federation cards, billing details, family group; for minors, the parent's or guardian's details too.
• Medical certificate: type, expiry date and check outcome (health data).
• Sports profile and activity: levels, preferences, availability, bookings, check-ins, matches, tournaments, rankings, courses and attendance.
• Internal public profile, if you fill it in: photo (without location metadata), nickname, bio and equipment.
• Financial data: fees, charges, payments, receipts and credits. Payment card data never passes through the platform.
• Communications: notifications, e-mails sent, preferences, consents with date and policy version; push subscriptions only if you turn them on.
• Technical and security data: sessions, sign-in attempts, management activity log, server logs.

The data comes from you, from the front desk or from the membership export of the Italian Tennis and Padel Federation (FIT). We do not profile you for advertising and make no automated decisions with legal effects (art. 22).

Purposes and legal bases

• Membership, federation registration, fees, digital card and app access — performance of a contract (art. 6.1.b).
• Bookings, waiting lists, check-ins, matches, tournaments and school — performance of a contract (art. 6.1.b).
• Checking fitness for sport with the medical certificate — legal obligation (arts. 6.1.c and 9.2).
• Payments, receipts and accounting — legal obligation (art. 6.1.c).
• Service messages (confirmations, reminders, receipts, due dates) — performance of a contract (art. 6.1.b).
• Promotional messages, push notifications, pictures on the website and a profile photo visible to other members — consent (art. 6.1.a), which you can withdraw at any time.
• Access security, activity log, abuse prevention, backups and aggregate internal statistics — legitimate interest (art. 6.1.f).

Account and member data are needed for membership and to use the app; the medical certificate when the law requires it; promotional consents are optional.

Who can see the data

• Club staff, according to their role and permissions (front desk, coaches, administrators); every management operation is logged.
• Other club members: your name or nickname in lists, rankings and draws; your profile photo only with your consent.
• Providers processing data on the club's behalf: the ClubPilot platform, hosting and backups, e-mail delivery, technical error reporting.
• The card payment provider, browser push services, the accountant, banks, sports federations and public authorities where the law requires it.

The data is never published or sold. When a provider processes data outside the European Economic Area, the transfer relies on the safeguards of the GDPR (adequacy decision or standard contractual clauses).

How long we keep the data

• Account and member record: for the duration of the membership, then anonymised.
• Medical certificates and documents: until expiry and for 6 months afterwards, then the file is deleted.
• Receipts, payments and accounting records: 10 years (art. 2220 of the Italian Civil Code and tax rules).
• E-mails sent: 90 days.
• In-app notifications: 180 days.
• Sales contacts: 12 months from the last contact.
• Activity log: 5 years; till and payment operations 10 years.
• Promotional consents: until withdrawn.
• Sign-in sessions: 30 days from the last renewal.

Your rights

You can exercise the rights of arts. 15-22 GDPR at any time: access, rectification, erasure, restriction, portability, objection and withdrawal of consent, without affecting processing already carried out.

In the app, under Profile › Privacy and account, you can download your data, delete your account and manage the optional consents; notification preferences are under Notifications › Preferences.

For any other request contact the club's front desk: we answer within one month. You may also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

Minors

Children under 14 do not create an account on their own: their data is entered by the front desk and managed by the parent or guardian, with the related consent.

Security

Hashed passwords, session cookies that scripts cannot read, progressive lockout after failed sign-ins, permissions checked by the server, encrypted connections and encrypted daily backups.

Changes

Changes to this policy are published on this page with a new version; for substantial changes we notify members by e-mail or notification.