Privacy Policy

1. Introduction

SCUB (Sports Club University of Bolzano) is committed to protecting your privacy and personal data in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and Italian data protection laws (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

Data Controller: SCUB - Sports Club University of Bolzano, Piazza Università, 1, 39100 Bolzano, Italy. Email: scub@unibz.it

Data Protection Officer: [Name of DPO], Email: dpo@unibz.it

2. Information We Collect

2.1 Personal Information

We may collect the following personal information:

• Name and surname
• Email address
• Student ID number
• Username and password
• Phone number (if provided)
• University affiliation and status
• Event booking and payment information

2.2 Usage Information

We automatically collect certain information when you use our service:

• IP address and device information
• Browser type and version
• Pages visited and time spent on our website
• Referring website information
• Cookies and similar tracking technologies

3. How We Use Your Information

We use the collected information for the following purposes:

• To provide and maintain our service
• To process membership applications and verify eligibility
• To manage event bookings and payments
• To send important notifications and updates
• To improve our website and services
• To prevent fraud and ensure security
• To comply with legal obligations
• To communicate with you about events and activities

4. Legal Basis for Processing

Under Article 6 of the GDPR, we process your personal data based on the following legal grounds:

• Consent (Art. 6(1)(a)): When you voluntarily provide information and give explicit consent
• Contract (Art. 6(1)(b)): To fulfill our obligations under membership agreements and service contracts
• Legitimate Interest (Art. 6(1)(f)): To improve our services, prevent fraud, and ensure security
• Legal Obligation (Art. 6(1)(c)): To comply with applicable laws and regulations
• Vital Interests (Art. 6(1)(d)): To protect your vital interests in emergency situations

Special Categories of Data: We may process special categories of personal data (such as health information for sports activities) only with your explicit consent (Art. 9(2)(a) GDPR) or when necessary for the establishment, exercise, or defense of legal claims (Art. 9(2)(f) GDPR).

5. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following circumstances:

• With University of Bolzano administration for verification purposes
• With service providers who assist us in operating our website
• When required by law or to protect our rights and safety
• In case of a merger, acquisition, or sale of assets
• With your explicit consent

6. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of sensitive data
• Secure servers and databases
• Regular security assessments
• Access controls and authentication
• Staff training on data protection

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account information: Until account deletion or 3 years of inactivity
• Event booking data: 7 years for accounting and legal purposes
• Communication records: 3 years from last contact
• Website usage data: 2 years maximum

8. Your Rights Under GDPR

Under Chapter III of the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15): Request copies of your personal data and information about processing
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing (Art. 18): Limit how we use your data
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time without affecting lawfulness of processing
• Right to Lodge a Complaint (Art. 77): Complain to the Italian Data Protection Authority

How to Exercise Your Rights: To exercise any of these rights, please contact us at scub@unibz.it or dpo@unibz.it. We will respond to your request within one month (Art. 12(3) GDPR). We may require identity verification before processing your request.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience on our website. Cookies are small text files stored on your device that help us:

• Remember your login status
• Personalize your experience
• Analyze website traffic and usage
• Improve website functionality

You can control cookie settings through your browser preferences. However, disabling cookies may affect the functionality of our website.

10. Third-Party Services

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

11. International Data Transfers

Your personal data may be transferred to and processed in countries other than your own. We ensure that such transfers comply with applicable data protection laws and implement appropriate safeguards to protect your data.

12. Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

14. Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay (Art. 34 GDPR). We will also notify the Italian Data Protection Authority within 72 hours of becoming aware of the breach (Art. 33 GDPR).

15. Contact Information

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

Supervisory Authority: You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) if you believe your data protection rights have been violated: