Privacy Policy

1. Data controller

OnStage APS, with registered office at Via Paolo VI 54, 73020 Botrugno (LE), Italy, Tax Code and VAT Number 04810190753.
Email: privacy@onstageaps.com — PEC (certified email): onstagebotrugno@pec.it

2. Personal data collected

We collect the following personal data:

• Personal details (first name, last name, date of birth)
• Contact details (email, phone)
• Authentication data (email, encrypted password)
• Data related to event registrations
• Data related to membership requests
• Payment data: NOT stored on our systems — handled directly by Stripe (see section 5)
• Anonymous/aggregate browsing data collected through Google Analytics, always on: there is no way to turn it off from the site (see section 9)
• Browsing data linked to you as a person, collected by the site's internal statistics: pages viewed, time spent, device used, actions taken and the text of the searches you run on the site (see section 9)
• Tax identification: Italian tax code or, if you don't have one because you are resident abroad, an explicit statement accompanied by an equivalent identifier (type of document, number and country of issue)

As of 25 August 2026 name, surname, date of birth, phone number and tax identification are mandatory data for anyone registering on the site, no longer only for those becoming a member of the association. If you do not provide them you cannot access the features of the members' area of the site: your profile remains always accessible (to complete them), the legal pages and operational stations during an event (e.g. entrance, accreditation, till), where staff must not be blocked by missing data.

3. Purpose of processing

Data is collected for the following purposes:

• Managing the user account and authentication
• Managing event registrations
• Processing membership requests
• Sending service communications (e.g. registration confirmations)
• Promotional communications, subject to explicit consent
• Processing payments through the Stripe provider
• Aggregate site usage statistics (Google Analytics), always on and with no opt-out function on the site
• Publication of participant names in the public leaderboard of games/activities organized during events (e.g. Bjørne Slam), subject to consent collected at event registration
• Direct and timely contact during an event or volunteer shift (phone number)
• The site's internal statistics, including those referring to a single person: understanding how the site is used, understanding what our members need, and understanding how to improve the way the site and the association work (see section 9)
• Unique identification of the person in the register of members, if and when they become a member, and administrative and tax obligations of the association (tax code, or the equivalent statement for those who do not have one)

4. Legal basis for processing

Data processing is based on the performance of a contract (Article 6(1)(b) GDPR) for managing accounts, sign-ups and payments, on the data subject's consent (Article 6(1)(a) GDPR) for promotional communications, and on legitimate interest (Article 6(1)(f) GDPR) for platform security and for the aggregate statistical measurement of the site (Google Analytics), always on: there is no function on the site to turn it off, but you can still exercise the right to object under Article 21 GDPR by writing to privacy@onstageaps.com.

The internal statistics described in section 9 — the ones that stay on our servers and that, if you are signed in, are linked to your account — are based on the same legitimate interest (Article 6(1)(f) GDPR) used for Google Analytics, and they are likewise always on: since 10 September 2026 there is no longer a switch that governs them in the cookie banner. Here too you can exercise the right to object under Article 21 GDPR by writing to privacy@onstageaps.com; unlike Google Analytics this processing identifies the individual person, which is why we declare it separately in our register of processing activities as a risk knowingly accepted by the data controller.

For some of the data the legal basis is instead a legal obligation (art. 6(1)(c) GDPR): keeping the register of members required by art. 15 of Legislative Decree 117/2017, and retaining the accounting records required by art. 2220 of the Italian Civil Code. No consent is given, or withdrawn, for these processing operations.

Phone number and tax identification (tax code or, alternatively, a statement from those who do not have one) are required from anyone registering, including those not joining as members: the legal basis is performance of a contract (Article 6 §1 (b) GDPR) for account management and to contact you in relation to an event or volunteer shift. If and when you become a member, the same tax code (or the same statement) also becomes the data with which you are identified in the register of members: for that specific part the legal basis is legal obligation (Article 6 §1 (c) GDPR, Article 15 Italian Legislative Decree 117/2017) described in section 7. Refusal to provide this data prevents access to the features of the members' area of the site.

5. Recipients and external data processors

Data may be shared, within the limits of the purposes indicated above, with the following third parties, who process it on our behalf as data processors pursuant to Article 28 GDPR, on the basis of the data processing conditions that each of them applies:

• Google Ireland Limited (Google Analytics 4) — aggregate browsing statistics, always on from the first visit. See the Cookie Policy for details, and section 4 above for how to exercise the right to object.
• Stripe Payments Europe, Ltd. — online payment processing. OnStage does not store or view full payment card data: the entire payment flow takes place on Stripe's systems (PCI-DSS scope is Stripe's responsibility).
• IONOS SE — server provider (hosting) on which the site's and database's infrastructure is hosted.

The internal statistics described in section 9 are not disclosed to anyone: we do not send them to Google, we do not share them with other associations or companies and we do not sell them. They stay on the association's server, hosted by IONOS like the rest of the site, and only the Board of Directors reads them.

6. Transfer of data to countries outside the EU

Google and Stripe may process data outside the European Economic Area as well (in particular in the United States). In these cases the transfer takes place on the basis of the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR) and the additional safeguards provided by the respective providers. You can consult the data transfer notices of Google and of Stripe.

7. Data retention

Account personal data is retained for as long as the account exists: we do not carry out any automatic deletion after a period of inactivity. It therefore remains available even to those who come back to the site years later. Deletion takes place at your request (see section 8, "Rights of data subjects") or when the association ends its relationship with you, and in both cases it covers only the data for which no retention obligation exists: the register of members and the accounting records described below remain, because the law requires it. Marketing data is deleted upon withdrawal of consent.

Phone and tax identification of those who are not (yet) members. If you register on the site without joining the association, this data follows the general account retention described above (for as long as the account exists, with no automatic expiry). If and when you are admitted as a member, the tax code (or the equivalent statement for those who do not have one) merges into the register of members and from that moment follows indefinite retention described below.

Register of members. The data entered in it (first name, surname, tax code, date of admission and of any cessation, and the reason) is kept indefinitely, in compliance with the obligation to keep corporate books laid down by art. 15 of Legislative Decree 117/2017: the legal basis is legal obligation (art. 6(1)(c) GDPR) and not consent, so erasure of these entries cannot be requested while that obligation stands. The register records membership events as they happen and is not rewritten afterwards: a request to delete an account does not alter it.

Accounting records and tax documents. Fee receipts, accounting entries and tax documents are kept for ten years from the last entry (art. 2220 of the Italian Civil Code), again as a legal obligation.

Data of whoever holds parental responsibility. For the admission application of a minor we collect the first name, surname, tax code and email address of the parent or guardian who countersigns it, as required by the Articles of Association: this is the evidence of the countersignature, it follows the same retention as the register of members, and it is not used for any other purpose, marketing communications included.

Statistical data collected through Google Analytics is kept for 14 months from collection, as set on the site's GA4 property, after which it is automatically deleted.

Internal browsing statistics. The sessions, page views and actions described in section 9 are kept for 14 months, then deleted automatically: a job runs every night and removes whatever has passed that limit. You do not have to ask for it to happen.

Member chat. The messages you write in the internal chat channels (text, reactions and any attachments) are kept indefinitely: there is no automatic deletion of messages by age. If this policy did not say so before, that is because the processing was not described at all, not because the opposite applied: no message has ever been deleted automatically on the basis of its age. If your account is deleted, your messages stay visible to the other participants in the channels you shared, but they are anonymised (the text is replaced by a placeholder and any attachments are removed): they are no longer linked to your identity.

8. Rights of data subjects

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure ("right to be forgotten")
• Restrict processing
• Receive your data in a portable format
• Object to processing
• Withdraw consent at any time
• Lodge a complaint with the Data Protection Authority (Garante)

If you have an account, you can export your data and request deletion directly from your profile: Export my data · Request account deletion.

Alternatively you can exercise these rights by writing to: privacy@onstageaps.com

We have not appointed a data protection officer (DPO): this is the person who, where required, oversees independently how an organisation processes personal data — which is precisely why an organisation cannot appoint itself, as that would be a structural conflict of interest. The GDPR (art. 37) requires this appointment only for public authorities or bodies, for organisations carrying out regular and systematic large-scale monitoring of individuals, or for those processing special categories of data (for example health data) or criminal-record data on a large scale: none of these cases applies to OnStage APS. For any question or report concerning your personal data you can therefore contact us directly, the data controller, by writing to privacy@onstageaps.com or by certified email (PEC) to onstagebotrugno@pec.it.

If you believe that the processing of your data violates applicable law, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Piazza Venezia, 11 — 00187 Rome, Italy; email: garante@gpdp.it; certified email (PEC): protocollo@pec.gpdp.it; www.garanteprivacy.it), or with the supervisory authority of the EU member state where you habitually reside.

9. Cookies, tracking and browsing statistics

This site uses technical cookies necessary for it to work (always on, they do not require consent) and statistical cookies (Google Analytics 4), always on: since 10 September 2026 there is no longer, in the banner or anywhere else on the site, a function to turn them off. Preference, marketing and social embed cookies, on the other hand, stay off until you explicitly switch them on.

In practice: on your first visit the Google Analytics tag (gtag.js) is loaded and statistical cookies are written without waiting for you to make a choice, and they stay active even if you choose "Necessary only" in the banner: that choice only applies to preference, marketing and social embed cookies. You can check the full list of cookies used, and change or withdraw consent for preferences/marketing/social embeds at any time, in the Cookie Policy.

The statistics we keep on our own servers

Besides Google Analytics, the site keeps statistics of its own, which stay on the association's servers. Unlike Google Analytics they are not anonymous: if you are signed in, what we record stays linked to your account; if you are not, it stays linked to a random number assigned to your browser (we explain it below).

In practice we record:

• The visit: when it begins, when it ends, how long it lasts and how many pages it covers.
• The pages you open: the page address, its title, how long you stay on it and in what order you visit them.
• Where you come from: only the name of the referring site (for example «google.com»), never the full address of the page that brought you here — so whatever you may have searched for elsewhere does not end up with us — and any campaign parameters in the link you clicked.
• The device you use: whether it is a phone, a tablet or a computer, the operating system, the browser, the screen size and the language.
• A random number assigned to your browser, which lets us recognise that you have already been here even if you do not have an account. It is a randomly drawn number saved in your browser: it is not derived from your name, your email or any other personal data of yours, and it is not derived from the characteristics of your device (so it is not a browser «fingerprint»). It is automatically deleted from your device after the fourteen months of retention described below.
• The actions you take on the site: signing in and out, starting and completing registration, signing up for an event activity, adding and removing products from the basket, starting a payment, completing an order, a failed payment, searches run on the site, opening the guide, downloading a document and applying for membership.
• An encrypted, non-reversible version of your IP address (a «hash»): the address itself is never stored in the clear. It only serves to tell whether two visits come from the same connection.
• The link to your account, when you are signed in.

Searches made on the site are logged with the text you typed (up to 200 characters), together with the number of results found. We mainly use it to find out what people search for and don’t find, so we can add it. We tell you this openly because it is text you write yourself: this collection is always on, and if you don’t want it you can exercise the right to object described below.

What they are for. To understand the site's visit statistics, to understand what our members need and to understand how to improve the way the site and the association work. They do not feed advertising and they do not produce automated decisions about you.

On what basis we do this. On legitimate interest (Article 6(1)(f) GDPR), the same basis used for Google Analytics. Since 10 September 2026 this collection is always on: there is no longer, in the cookie banner or anywhere else on the site, a switch that governs it. You can still exercise the right to object under Article 21 GDPR by writing to privacy@onstageaps.com: unlike Google Analytics this processing identifies the individual person, it is not anonymous, which is why we declare it separately in our register of processing activities as a risk knowingly accepted by the data controller, not as a consent that no one could actually refuse.

Who reads them. Only the Board of Directors. Every time a member of the Board opens data referring to a single individual, that consultation is recorded in the association's personal data access log, with who looked, when and at whom: the pages that show aggregate figures only are not, because they concern no one in particular.

How long they stay. Fourteen months, then they are deleted automatically. If you ask for your account to be deleted, the link between these rows and you as a person is removed immediately: the figures remain, not who produced them. If you ask to export your data, your sessions, page views and recorded actions are included.

10. Changes to this Policy

We reserve the right to update this Privacy Policy. Material changes will be communicated by email to registered users.