Privacy Notice — Event participants

Pursuant to Arts. 13-14 of Regulation (EU) 2016/679 (GDPR).

Data Controller

A.S.D. W.C.S. Roma (Amateur Sports Association (ASD)), registered at Via benigno crespi 30, Tax Code 96606380580. Contact for exercising rights: lucio.ughi@gmail.com.

Data Processor (platform provider)

The technical management of the platform is entrusted to Luca Fornaciari, appointed Data Processor pursuant to Art. 28 GDPR, who processes data exclusively on the Controller's instructions for the provision of the service.

Data Processed

Data provided during registration and throughout the event: first name, last name, email address, role (leader/follower), dance level, any WSDC ID/category, registration notes, date and place of birth (city and country), tax code, attendance and participation in event activities.

No online payments are collected through the platform.

Partner data provided at sign-up

Someone signing up for a pass that allows couple participation may enter another person's first name, last name and email address (the "partner") they intend to attend with — mandatorily on passes reserved for couples, optionally on passes that allow both solo and couple sign-ups — solely to let the organisation manually match the two registrations. This data is provided by the person signing up, not by the person named as partner, who is not asked for any consent at this stage and may never register for the event themselves.

• Purpose and legal basis: matching couple registrations — the Controller's legitimate interest (Art. 6.1.f GDPR).
• Retention: these three fields remain on file as historical registration information even if the person named as partner never completes their own registration, for the same period set out in the "Retention" section below.
• The person named as partner can exercise the rights described in the "Data Subject Rights" section by writing to lucio.ughi@gmail.com, specifying that they were named as a partner by another attendee.

Registering for intensives from the site and link to the registration page

From the site you can request, by entering your email address, that an email be sent with the link to your registration page. The email is only sent if that address matches a registration for the event; the site always shows the same message, without indicating whether the address is registered. The address entered is not retained beyond the time needed to respond to the request, except for the technical count of requests (maximum 3 per hour per address, 10 per hour per connection) needed to prevent abuse.

From the registration page you can register for intensives and, for couple ones, enter the email address of the partner you intend to attend with. The same rules as the previous paragraph apply: the data is provided by the person registering, is used solely for manual matching by the organisation, and is visible to staff for this purpose.

• Legal basis: performance of the contract (Art. 6.1.b GDPR) for sending the link and registering for intensives; organisational legitimate interest (Art. 6.1.f) for naming the partner and for the technical anti-abuse limits.

Purposes and Legal Basis

• Management of registration and participation in the event — legal basis: performance of a contract/pre-contractual measures (Art. 6.1.b GDPR).
• Enrolment with the sports promotion body and activation of the insurance cover linked to participation — legal basis: performance of a contract (Art. 6.1.b GDPR).
• Organisational obligations and service communications related to the event — legitimate interest of the Controller (Art. 6.1.f) and/or contract.
• Security and correct functioning of the service (technical logs, error monitoring) — legitimate interest (Art. 6.1.f).
• Usage statistics for the site (sign-up funnel, navigation, performance/Web Vitals, device type) in anonymous and aggregate form (PostHog), to improve the service — consent (Art. 6.1.a GDPR), only after acceptance in the banner.

Recipients and External Processors

Data is processed by the platform Processor and the following sub-processors (all EU-based), appointed pursuant to Art. 28 GDPR:

• Sentry (Functional Software Inc., EU infrastructure) — technical error monitoring, without user profiling. Legal basis: legitimate interest (Art. 6.1.f GDPR).
• PostHog (PostHog Inc., EU region) — usage statistics for the site (sign-up funnel, navigation, performance/Web Vitals, device type) in anonymous and aggregate form, activated only after consent. Legal basis: consent (Art. 6.1.a GDPR).

Birth data and the tax code are disclosed to the sports promotion body with which enrolment is carried out and to the related insurance company, to the extent necessary for the enrolment and for the activation of the related insurance cover.

Other than as described above, data is not disclosed or sold to third parties. No commercial profiling, no marketing processing without further consent.

Retention

Data is retained for the duration necessary for event management and legal obligations, and in any case deleted/returned at the end of the relationship with the platform pursuant to the DPA. Specifically, data is retained for the duration of the event and for up to 10 years for administrative, accounting and legal obligations, unless longer retention is required by law; thereafter it is deleted or anonymised.

Data is included in encrypted backups retained for a maximum of 14 days for business continuity purposes. Where the right to erasure is exercised, data is removed from active systems immediately and from backups within the rotation window (max 14 days); any restores re-apply pending erasures.

Transfers Outside the EU

No transfers outside the EU are envisaged. Hosting, error monitoring and statistical analytics (PostHog) run on infrastructure within the European Union.

Data Subject Rights

You have the right to access, rectification, erasure, restriction, objection and portability (Arts. 15-22 GDPR) and to lodge a complaint with the Data Protection Authority. To exercise them: lucio.ughi@gmail.com.

Cookies

The use of cookies and similar technologies is described in the Cookie Policy of the site/application.