Privacy Policy

1. Introduction

SCUB (Sports Club University of Bolzano) is committed to protecting your privacy and personal data in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and Italian data protection laws (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

Data Controller: SCUB - Sports Club University of Bolzano, Piazza Università, 1, 39100 Bolzano, Italy. Email: scub@unibz.it

Legal Representative and privacy contact: Paolo Lancellotti, Email: scub@unibz.it. Data Protection Officer of the University of Bolzano: dpo@unibz.it

2. Information We Collect

2.1 Personal Information

We may collect the following personal information:

• Name and surname
• Email address
• Student ID number
• Username and password (the password is stored only as a secure hash)
• Profile picture, if you upload one
• University affiliation (from your email domain)
• Membership status and swimming extra (from the club roster)
• Event bookings, waitlist places, check-ins and whether you paid at the stand
• Friends and friend requests, chat messages and notifications

2.2 Usage Information

We automatically collect certain information when you use our service:

• IP address, used for security and to limit repeated requests (for example login attempts)
• Browser and device type of each logged-in session, so you can see and close your sessions
• The cookies and local storage described in our Cookie Policy

We do not use analytics, advertising or tracking tools: we do not record which pages you visit.

3. How We Use Your Information

We use the collected information for the following purposes:

• To provide and maintain our service
• To match your account with the membership roster (by university email, student ID or name) and activate your membership
• To manage event bookings, waitlists and entrance check-in (no payment data is processed online)
• To send important notifications and updates
• To improve our website and services
• To prevent fraud and ensure security, including telling people apart from automated booking bots
• To comply with legal obligations
• To communicate with you about events and activities

4. Legal Basis for Processing

Under Article 6 of the GDPR, we process your personal data based on the following legal grounds:

• Contract (Art. 6(1)(b)): To provide your account, membership status, bookings, chats and the other features you use
• Legitimate Interest (Art. 6(1)(f)): To keep the service secure, prevent abuse and automated booking, and improve the website
• Legal Obligation (Art. 6(1)(c)): To comply with applicable laws and regulations

Special Categories of Data: We do not collect health data or other special categories of personal data (Art. 9 GDPR). The swimming extra only records that you bought it.

5. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following circumstances:

• With other logged-in users, limited to what the features need: your name, username and profile picture appear in user search, friends lists, chats and on events your friends are attending
• With the service providers that run the website on our behalf (data processors, Art. 28 GDPR), listed below
• When required by law or to protect our rights and safety

Service providers: Vercel (website hosting), Railway (application server in the EU, and database), Cloudflare (Turnstile human check when booking), Google (the membership roster spreadsheet) and the University of Bolzano mail server (emails).

6. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encrypted connections (HTTPS/TLS) between your browser, our servers and the database
• Passwords stored only as a secure hash (bcrypt), never in readable form
• Login cookies that page scripts cannot read (HttpOnly) and sessions you can close from your profile
• Admin-only access to the management tools, checked on every request
• Limits on repeated requests and a human check on bookings against automated abuse

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account and profile (name, email, username, student ID, picture): as long as your account exists. You can ask us to delete your account at any time by writing to scub@unibz.it; we delete it within one month, together with the data below that is linked to it.
• Bookings, waitlist places and check-ins: kept with your account, so you can see your history. No payments are processed online, so we keep no accounting records about you.
• Membership roster (the list of people who bought a membership): replaced every season and deleted at the start of the new season (15 August).
• Friends, chat messages and notifications: as long as your account exists; you can delete your own private messages.
• Login sessions (browser and device type): deleted 30 days after they expire or you close them.
• Server and security logs (including IP addresses): kept by our hosting providers for a short period, normally no longer than 30 days.
• Emails you send us: as long as needed to answer and handle your request.

8. Your Rights Under GDPR

Under Chapter III of the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15): Request copies of your personal data and information about processing
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing (Art. 18): Limit how we use your data
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time without affecting lawfulness of processing
• Right to Lodge a Complaint (Art. 77): Complain to the Italian Data Protection Authority

How to Exercise Your Rights: To exercise any of these rights, please contact us at scub@unibz.it or dpo@unibz.it. We will respond to your request within one month (Art. 12(3) GDPR). We may require identity verification before processing your request.

9. Cookies and Tracking Technologies

We only use the cookies and browser storage that the website needs to work (keeping you logged in, remembering your theme). We do not use analytics, advertising or tracking cookies. The full list is in our Cookie Policy.

10. Third-Party Services

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

11. International Data Transfers

Some of our service providers (Vercel, Railway, Cloudflare, Google) are based in the United States, so your data may be processed outside the European Economic Area. These transfers rely on the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses (Art. 45–46 GDPR).

12. Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

14. Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay (Art. 34 GDPR). We will also notify the Italian Data Protection Authority within 72 hours of becoming aware of the breach (Art. 33 GDPR).

15. Contact Information

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

Supervisory Authority: You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) if you believe your data protection rights have been violated: