Privacy Policy

The data controller is the association:

• A.S.D. Circolo Canottieri Sabaudia
• Tax code: 91008500596
• Registered office: Via Emanuela Loi, 1/7 — 04016 Sabaudia (LT), Italy
• Legal representative: Marco Lozito
• Email: info@canottierisabaudia.it

The controller is the association itself, not its legal representative in a personal capacity. No Data Protection Officer (DPO) has been appointed.

The website processes only the data that users voluntarily provide by filling in the available forms, together with the technical data strictly necessary for the operation of the application and of the restricted area.

• Contact and enquiry details submitted through the Contact form;
• Contact and organisational details submitted through the Training Camp request form;
• Browsing language (IT/EN) and the date and time of the submission;
• Technical authentication data relating only to users of the restricted administration area.

The website does not request or intentionally process special categories of personal data. Please do not include health information or other special data in free-text fields.

Data is processed for the following purposes:

• Handling and replying to enquiries sent through the forms: legal basis in pre-contractual measures taken at the data subject's request and/or in the controller's legitimate interest in replying to those who contact it (Art. 6(1)(b) and (f) GDPR);
• Ensuring the technical operation and security of the website and of the restricted area: legitimate interest of the controller (Art. 6(1)(f) GDPR);
• Complying with legal obligations to which the controller is subject (Art. 6(1)(c) GDPR).

Providing the data marked as required in the forms is optional, but without it the request cannot be processed.

The form on the Contact page collects the following data:

• first and last name;
• email address;
• phone number (optional);
• subject of the enquiry;
• message text;
• language used on the website and date and time of submission.

The data is used solely to receive and handle the enquiry and to contact the user back in relation to it.

The checkbox in the form represents acknowledgement of this privacy policy and the request to be contacted back: it does not constitute consent to marketing purposes or promotional communications, which are not carried out.

The Training Camp request form may collect the following data, depending on what the user chooses to provide:

• name of the contact person;
• team, club, university or organisation;
• email address;
• phone number, if provided;
• country;
• number of participants, if provided;
• period or indicative dates, if provided;
• message with additional needs or requests;
• language used on the website and date and time of submission.

The data is used to handle the request, assess the feasibility and organisation of the training camp and contact the requester back.

Here too the checkbox represents acknowledgement of this privacy policy and the request to be contacted back, not consent to marketing purposes.

Data is processed by electronic means and with logic strictly related to the purposes stated above. The controller adopts appropriate technical and organisational measures to reduce the risks of unauthorised access, loss, alteration or unauthorised disclosure of data.

Access to data submitted through the forms is restricted to authorised users of the website's restricted area, protected by authentication and by database-level access control rules.

Requests submitted through the Contact form and the Training Camp form are kept for a maximum of 24 months from receipt. The system automatically deletes, on the server/database side, records older than that period.

Longer retention periods may apply only where necessary to comply with legal obligations or in connection with any relationship subsequently established following the request.

Data is not disseminated or sold to third parties for commercial purposes. It may be processed on behalf of the controller, within the limits of the services provided, by the following technical providers:

• Lovable Cloud / Supabase — platform used for application hosting, database, authentication of the restricted area, storage and technical infrastructure;
• Resend — service used exclusively server-side to send the notification emails generated by the forms;
• Google Ireland Limited — provider of Google Analytics 4, used only with the user's prior consent for aggregate website usage statistics.

Data submitted through the forms is first recorded by the system and then used server-side to generate the email notification: the user's browser never contacts the email delivery service directly.

Data may also be disclosed to parties entitled to receive it under legal obligations.

The use of cloud providers and of the email delivery service, as well as the optional activation of the Google map and of Google Analytics, may involve a transfer of personal data to countries outside the European Economic Area.

Where such transfers occur, they take place on the basis of the safeguards provided for by applicable law (including adequacy decisions or standard contractual clauses) and in accordance with the terms and privacy notices of the respective providers. Further information can be requested at info@canottierisabaudia.it.

The website includes a restricted area available only to authorised users for content management. Access relies on a technical authentication system based on Supabase Auth.

To keep an authenticated session active, the browser's localStorage is used for strictly technical purposes necessary to operate the restricted area. This mechanism is not used for profiling, statistics or marketing and does not apply to visitors of the public website.

The Contact page offers a map provided by Google Maps. The map is not loaded automatically: a graphic placeholder is shown instead and no request is sent to Google's servers.

The external iframe is loaded only if the user explicitly selects the “Load Google Maps” button. After activation, Google may receive technical data such as IP address, user-agent and referrer, and may use its own technologies, including cookies or similar tools, in accordance with its own terms and privacy notices.

The website does not load any other external content automatically: the typefaces used are hosted directly by the website.

Google Analytics 4 (optional): with the user's consent, the website uses Google Analytics 4, provided by Google Ireland Limited, solely for statistical purposes (visits and pages viewed in aggregate form and a count of completed form submissions, without sending Google any name, email, phone number, message or other data entered). Legal basis: consent (Art. 6(1)(a) GDPR).

No request is sent to Google Analytics before consent. Users can refuse by selecting “Necessary only” in the banner, with no impact on browsing. The choice is stored in the browser and can be changed or withdrawn at any time from the Cookie Policy. Google advertising features are disabled. For details on the cookies used, please see the Cookie Policy.

Within the limits and conditions set out by applicable law, data subjects may exercise the following rights:

• access to their personal data;
• rectification of inaccurate or incomplete data;
• erasure of data;
• restriction of processing;
• objection to processing based on legitimate interest;
• data portability, where applicable;
• withdrawal of consent, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
• lodging a complaint with the competent supervisory authority (in Italy, the Garante per la protezione dei dati personali).

To exercise these rights, please write to info@canottierisabaudia.it, indicating the right you wish to exercise and providing the details needed to identify your request.

The controller replies to requests within the timeframes set out by applicable law and may ask for additional information needed to verify the requester's identity.

The controller may update this privacy policy to reflect changes to the website, to the services used or to applicable law. The current version is always published on this page, with the date of the latest update.