Privacy Policy

1. Data controller

OnStage APS, with registered office at Via Paolo VI 54, 73020 Botrugno (LE), Italy, Tax Code 92029150759, VAT number 04810190753.
Email: privacy@onstageaps.com - PEC (certified email): onstagebotrugno@pec.it

2. Personal data collected

We collect the following personal data:

• Personal details (first name, last name, date of birth)
• Contact details (email, phone)
• Authentication data (email, encrypted password)
• Data related to event registrations
• Data related to membership requests
• Payment data: NOT stored on our systems - handled directly by Stripe (see section 5)
• Anonymous/aggregate browsing data collected through Google Analytics, always on: there is no way to turn it off from the site (see section 9)
• Browsing data linked to you as a person, collected by the site's internal statistics: pages viewed, time spent, device used, actions taken and the text of the searches you run on the site (see section 9)
• Tax identification: Italian tax code or, if you don't have one because you are resident abroad, an explicit statement accompanied by an equivalent identifier (type of document, number and country of issue)
• If you have installed the OnStage app and authorised notifications: a technical identifier of your device (notification token) and, for chat, the text of the message you are notified about - see section 10 "If you use the OnStage app"

As of 25 August 2026 name, surname, date of birth, phone number and tax identification are mandatory data for anyone registering on the site, no longer only for those becoming a member of the association. If you do not provide them you cannot access the features of the members' area of the site: your profile remains always accessible (to complete them), the legal pages and operational stations during an event (e.g. entrance, accreditation, till), where staff must not be blocked by missing data.

3. Purpose of processing

Data is collected for the following purposes:

• Managing the user account and authentication
• Managing event registrations
• Processing membership requests
• Sending service communications (e.g. registration confirmations)
• Promotional communications, subject to explicit consent
• Processing payments through the Stripe provider
• Aggregate site usage statistics (Google Analytics), always on and with no opt-out function on the site
• Publication of participant names in the public leaderboard of games/activities organized during events (e.g. Bjørne Slam), subject to consent collected at event registration
• Direct and timely contact during an event or volunteer shift (phone number)
• The site's internal statistics, including those referring to a single person: understanding how the site is used, understanding what our members need, and understanding how to improve the way the site and the association work (see section 9)
• Unique identification of the person in the register of members, if and when they become a member, and administrative and tax obligations of the association (tax code, or the equivalent statement for those who do not have one)
• Recognising the person at the bar and at the entrance to events through the profile QR code, and attendance statistics in aggregate form (see sections 4, 7 and 8)
• Sending push notifications, if you have installed the OnStage app and authorised them from the phone's settings (see section 10)

4. Legal basis for processing

Data processing is based on the performance of a contract (Article 6(1)(b) GDPR) for managing accounts, sign-ups and payments, on the data subject's consent (Article 6(1)(a) GDPR) for promotional communications, and on legitimate interest (Article 6(1)(f) GDPR) for platform security and for the aggregate statistical measurement of the site (Google Analytics), always on: there is no function on the site to turn it off, but you can still exercise the right to object under Article 21 GDPR by writing to privacy@onstageaps.com.

The internal statistics described in section 9 - the ones that stay on our servers and that, if you are signed in, are linked to your account - are based on the same legitimate interest (Article 6(1)(f) GDPR) used for Google Analytics, and they are likewise always on: since 10 September 2026 there is no longer a switch that governs them in the cookie banner. Here too you can exercise the right to object under Article 21 GDPR by writing to privacy@onstageaps.com; unlike Google Analytics this processing identifies the individual person, which is why we declare it separately in our register of processing activities as a risk knowingly accepted by the data controller.

For some of the data the legal basis is instead a legal obligation (art. 6(1)(c) GDPR): keeping the register of members required by art. 15 of Legislative Decree 117/2017, and retaining the accounting records required by art. 2220 of the Italian Civil Code. No consent is given, or withdrawn, for these processing operations.

Phone number and tax identification (tax code or, alternatively, a statement from those who do not have one) are required from anyone registering, including those not joining as members: the legal basis is performance of a contract (Article 6 §1 (b) GDPR) for account management and to contact you in relation to an event or volunteer shift. If and when you become a member, the same tax code (or the same statement) also becomes the data with which you are identified in the register of members: for that specific part the legal basis is legal obligation (Article 6 §1 (c) GDPR, Article 15 Italian Legislative Decree 117/2017) described in section 7. Refusal to provide this data prevents access to the features of the members' area of the site.

Your profile QR code and the attendance statistics. The QR code holds only a random code, without your name or any other details: anyone who photographs it learns nothing about you. It is there to recognise you at the bar and at the entrance to an event, so that the member price can be applied and the membership card checked where it is a condition of entry: the legal basis is the performance of the relationship with you (art. 6 §1 lett. b GDPR). Every time somebody reads your QR code, the system records who read it, when and where, but not the code itself. The attendance statistics (how many people come to our nights and how many come back, so that shifts, purchases and nights can be planned and an account given to the general assembly) rest on the association's legitimate interest (art. 6 §1 lett. f GDPR). For those statistics we do not record what you consume, we do not build a profile of your consumption and we do not take decisions about you on the basis of this data. Whoever is at the bar sees your name and whether your card is valid, not your address or your Italian tax code.

5. Recipients and external data processors

Data may be shared, within the limits of the purposes indicated above, with the following third parties, who process it on our behalf as data processors pursuant to Article 28 GDPR, on the basis of the data processing conditions that each of them applies:

• Google Ireland Limited (Google Analytics 4) - aggregate browsing statistics, always on from the first visit. See the Cookie Policy for details, and section 4 above for how to exercise the right to object.
• Stripe Payments Europe, Ltd. - online payment processing. OnStage does not store or view full payment card data: the entire payment flow takes place on Stripe's systems (PCI-DSS scope is Stripe's responsibility).
• IONOS SE - server provider (hosting) on which the site's and database's infrastructure is hosted.
• Google Ireland Limited/Google LLC (Firebase Cloud Messaging) - if you have installed the OnStage app for Android and authorised notifications, it delivers push notifications to your device. This is not a purely technical role: as of 17 September 2026 chat notifications include the text of the message, which therefore also passes through Google's servers. See section 10 below for details. Apple Inc. (APNs) will have the same role for iPhone the day the app becomes available on iOS - not before, because that channel does not exist yet.
• Google Ireland Limited/Google LLC (Google Wallet) - if you choose to add the card to your Google wallet, the card data is also saved in your Google account. Apple Inc. (Apple Wallet) will have the same role for iPhone on the day the feature is activated - not before. See section 10 for details.
• Google (Gemini, the AI assistant on the boards) - if a person working on a board of the executive committee uses the assistant, Google receives the text sent to it (see the paragraph “The AI assistant on the boards” below). The service can be switched off and usually is.

The internal statistics described in section 9 are not disclosed to anyone: we do not send them to Google, we do not share them with other associations or companies and we do not sell them. They stay on the association's server, hosted by IONOS like the rest of the site, and only the Board of Directors reads them.

The AI assistant on the boards

Those who work on the association's working boards (the executive committee and invited members) can ask an artificial intelligence assistant for help in three cases: suggesting the items of a task's checklist, summarizing the discussions on a board, drawing tasks from a written text. In every case it is sent only on the person's own action, after a notice that says what is sent. What is sent to Google is the title and description of the task, or the text of the most recent comments with the titles of the tasks, or the text written by the person. The name of the author of a comment is not sent; if a person writes a name or other data inside a comment or in the text, that data is sent along with the rest.

The text travels only within the request and is not used to train any model. The answers are not saved: they become data of the association only if the person turns them into an item or a task. No request is sent from the training practice boards. The legal basis is the legitimate interest of the association in organising the work of its volunteers (Article 6(1)(f) GDPR); you can object by writing to privacy@onstageaps.com.

You can also object on your own, at any time, from the "My data" page of the private area: from that moment the comments you have written are no longer sent to the assistant, on any task board. Anyone who asks for a summary is told that some comments were not included, without being told whose.

6. Transfer of data to countries outside the EU

Google and Stripe may process data outside the European Economic Area as well (in particular in the United States). In these cases the transfer takes place on the basis of the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR) and the additional safeguards provided by the respective providers. You can consult the data transfer notices of Google and of Stripe.

The same applies to the Gemini service of Google used by the AI assistant on the boards: the data sent may also be processed outside the European Economic Area, with the safeguards described above.

The same applies to Firebase Cloud Messaging, Google's service that delivers push notifications to anyone who has installed the OnStage app for Android and authorised them (see section 10): it is the same corporate group as Google Analytics, with the same data-transfer safeguards described above.

7. Data retention

Account personal data is retained for as long as the account exists: we do not carry out any automatic deletion after a period of inactivity. It therefore remains available even to those who come back to the site years later. Deletion takes place at your request (see section 8, "Rights of data subjects") or when the association ends its relationship with you, and in both cases it covers only the data for which no retention obligation exists: the register of members and the accounting records described below remain, because the law requires it. Marketing data is deleted upon withdrawal of consent.

Phone and tax identification of those who are not (yet) members. If you register on the site without joining the association, this data follows the general account retention described above (for as long as the account exists, with no automatic expiry). If and when you are admitted as a member, the tax code (or the equivalent statement for those who do not have one) merges into the register of members and from that moment follows indefinite retention described below.

Register of members. The data entered in it (first name, surname, tax code, date of admission and of any cessation, and the reason) is kept indefinitely, in compliance with the obligation to keep corporate books laid down by art. 15 of Legislative Decree 117/2017: the legal basis is legal obligation (art. 6(1)(c) GDPR) and not consent, so erasure of these entries cannot be requested while that obligation stands. The register records membership events as they happen and is not rewritten afterwards: a request to delete an account does not alter it.

Accounting records and tax documents. Fee receipts, accounting entries and tax documents are kept for ten years from the last entry (art. 2220 of the Italian Civil Code), again as a legal obligation.

Data of whoever holds parental responsibility. For the admission application of a minor we collect the first name, surname, tax code and email address of the parent or guardian who countersigns it, as required by the Articles of Association: they are the evidence of the countersignature, they follow the same retention as the register of members, and they are not used for any purpose other than those described here, marketing communications excluded in every case. The countersignature is asked for after the email address of the person joining has been confirmed, at the time of payment: this way those data are not kept in the browser while the person opens their mail.

Sign-up of a child under 14. Under the age of 14 a child cannot give consent to online services (art. 2-quinquies of the Privacy Code): it is given by whoever holds parental responsibility, and without it the account is not created. The first name, surname, tax code and email address of the parent or guardian are therefore requested together with the sign-up and kept as evidence. To the address provided we send a notice of what has been done in the minor's name, with the address of the account created and how to ask for its closure: it serves to make contestable, by whoever is entitled to contest it, a consent that in practice is declared by whoever fills in the form. That notice is the only message we send to that address; it does not enter any communications list.

Statistical data collected through Google Analytics is kept for 14 months from collection, as set on the site's GA4 property, after which it is automatically deleted.

Internal browsing statistics. The sessions, page views and actions described in section 9 are kept for 14 months, then deleted automatically: a job runs every night and removes whatever has passed that limit. You do not have to ask for it to happen.

Member chat. The messages you write in the internal chat channels (text, reactions and any attachments) are kept indefinitely: there is no automatic deletion of messages by age. If this policy did not say so before, that is because the processing was not described at all, not because the opposite applied: no message has ever been deleted automatically on the basis of its age. If your account is deleted, your messages stay visible to the other participants in the channels you shared, but they are anonymised (the text is replaced by a placeholder and any attachments are removed): they are no longer linked to your identity.

Rankings and scoreboards of the games. As long as your account exists, public rankings show your stage name or, if you have not given one, your real name. If you delete your account, your name (and the team name, if you were the only person using it) appears as «[Cancellato]» («[Deleted]») in the rankings and scoreboards already published as well: the score remains, because it is part of the other participants' result, but it is no longer linked to you.

Attendance at events and reads of your QR code. The attendance at events recorded in your name and the log of who read your QR code are kept for twenty-four months. After that time the link with you as a person is deleted and only numbers remain (how many people, how many reads per night), which no longer concern you. Bar orders are accounting documents and follow the retention described above: we do not use them to build statistics about you.

8. Rights of data subjects

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure ("right to be forgotten")
• Restrict processing
• Receive your data in a portable format
• Object to processing
• Withdraw consent at any time
• Lodge a complaint with the Data Protection Authority (Garante)

If you have an account, you can export your data and request deletion directly from your profile: Export my data · Request account deletion.

Alternatively you can exercise these rights by writing to: privacy@onstageaps.com

You can object to the attendance statistics. You have the right to object at any time, on grounds relating to your situation, to processing based on legitimate interest (art. 21 GDPR): you do it with a switch on your QR code page (My QR code) or by writing to privacy@onstageaps.com. If you object, the link between your attendance and your name is deleted within a day instead of after twenty-four months, and your attendance remains only in the count. Your discount and your entry do not change: the QR code works as before.

We have not appointed a data protection officer (DPO): this is the person who, where required, oversees independently how an organisation processes personal data - which is precisely why an organisation cannot appoint itself, as that would be a structural conflict of interest. The GDPR (art. 37) requires this appointment only for public authorities or bodies, for organisations carrying out regular and systematic large-scale monitoring of individuals, or for those processing special categories of data (for example health data) or criminal-record data on a large scale: none of these cases applies to OnStage APS. For any question or report concerning your personal data you can therefore contact us directly, the data controller, by writing to privacy@onstageaps.com or by certified email (PEC) to onstagebotrugno@pec.it.

If you believe that the processing of your data violates applicable law, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Piazza Venezia, 11 - 00187 Rome, Italy; email: garante@gpdp.it; certified email (PEC): protocollo@pec.gpdp.it; www.garanteprivacy.it), or with the supervisory authority of the EU member state where you habitually reside.

9. Cookies, tracking and browsing statistics

This site uses technical cookies necessary for it to work (always on, they do not require consent) and statistical cookies (Google Analytics 4), always on: since 10 September 2026 there is no longer, in the banner or anywhere else on the site, a function to turn them off. Preference, marketing and social embed cookies, on the other hand, stay off until you explicitly switch them on.

In practice: on your first visit the Google Analytics tag (gtag.js) is loaded and statistical cookies are written without waiting for you to make a choice, and they stay active even if you choose "Necessary only" in the banner: that choice only applies to preference, marketing and social embed cookies. You can check the full list of cookies used, and change or withdraw consent for preferences/marketing/social embeds at any time, in the Cookie Policy.

The statistics we keep on our own servers

Besides Google Analytics, the site keeps statistics of its own, which stay on the association's servers. Unlike Google Analytics they are not anonymous: if you are signed in, what we record stays linked to your account; if you are not, it stays linked to a random number assigned to your browser (we explain it below).

In practice we record:

• The visit: when it begins, when it ends, how long it lasts and how many pages it covers.
• The pages you open: the page address, its title, how long you stay on it and in what order you visit them.
• Where you come from: only the name of the referring site (for example «google.com»), never the full address of the page that brought you here - so whatever you may have searched for elsewhere does not end up with us - and any campaign parameters in the link you clicked.
• The device you use: whether it is a phone, a tablet or a computer, the operating system, the browser, the screen size and the language.
• A random number assigned to your browser, which lets us recognise that you have already been here even if you do not have an account. It is a randomly drawn number saved in your browser: it is not derived from your name, your email or any other personal data of yours, and it is not derived from the characteristics of your device (so it is not a browser «fingerprint»). It is automatically deleted from your device after the fourteen months of retention described below.
• The actions you take on the site: signing in and out, starting and completing registration, signing up for an event activity, adding and removing products from the basket, starting a payment, completing an order, a failed payment, searches run on the site, opening the guide, downloading a document and applying for membership.
• An encrypted, non-reversible version of your IP address (a «hash»): the address itself is never stored in the clear. It only serves to tell whether two visits come from the same connection.
• The link to your account, when you are signed in.

Searches made on the site are logged with the text you typed (up to 200 characters), together with the number of results found. We mainly use it to find out what people search for and don’t find, so we can add it. We tell you this openly because it is text you write yourself: this collection is always on, and if you don’t want it you can exercise the right to object described below.

What they are for. To understand the site's visit statistics, to understand what our members need and to understand how to improve the way the site and the association work. They do not feed advertising and they do not produce automated decisions about you.

On what basis we do this. On legitimate interest (Article 6(1)(f) GDPR), the same basis used for Google Analytics. Since 10 September 2026 this collection is always on: there is no longer, in the cookie banner or anywhere else on the site, a switch that governs it. You can still exercise the right to object under Article 21 GDPR by writing to privacy@onstageaps.com: unlike Google Analytics this processing identifies the individual person, it is not anonymous, which is why we declare it separately in our register of processing activities as a risk knowingly accepted by the data controller, not as a consent that no one could actually refuse.

Who reads them. Only the Board of Directors. Every time a member of the Board opens data referring to a single individual, that consultation is recorded in the association's personal data access log, with who looked, when and at whom: the pages that show aggregate figures only are not, because they concern no one in particular.

How long they stay. Fourteen months, then they are deleted automatically. If you ask for your account to be deleted, the link between these rows and you as a person is removed immediately: the figures remain, not who produced them. If you ask to export your data, your sessions, page views and recorded actions are included.

The web server access log

Every time your browser or our app asks our servers for a page or for data, the web server writes a line in a log. The line contains your IP address, the date and time of the request, the address of the requested page, the outcome, the page you come from (if your browser reports it) and the program you use (browser or app, with version and operating system). It does not contain the content of the forms you fill in, nor passwords, nor the text of your messages.

Before a line is written in the log, the tokens contained in addresses (for example those in the links to verify your email, reset your password or unsubscribe from communications) are replaced by a placeholder, and email addresses appearing in requested addresses are not written: when an address carries parameters that could contain a credential or personal data, the log keeps the page and hides all the parameters.

Why, on what basis and for how long. They serve the security of the site (recognising abusive access attempts and attacks) and understanding what went wrong when something breaks: this is the association's legitimate interest (art. 6(1)(f) GDPR). They are not used to profile you, nor for statistical or marketing purposes. The log is rotated every day and lines are kept for 14 days, then deleted automatically. Only the people in charge of maintaining the servers read them. You can exercise the right to object under art. 21 GDPR by writing to privacy@onstageaps.com.

Technical diagnostics: when something breaks

If the OnStage website or app run into an unexpected technical error (for example a page that fails to load correctly), a short technical description of the error is collected on your device: the type of error, a technical message from which we automatically remove emails, tax codes, phone numbers and other recognisable identifiers before it ever leaves your device, the operation you were performing, and a short unique code. We never collect the content of network requests or responses, cookies, access tokens, the content of forms you are filling in, or the full page address when it contains parameters.

That short code always stays visible in the error notice, together with a "Send report" button that tries to send immediately only that report to our servers: you can press it at any time, regardless of your choices about preference or marketing cookies. A report that cannot leave straight away (for example because there is no network, or because sending is not active) stays in a queue on your device and is sent at the first opportunity, without being lost. The association may also turn on automatic sending, which does not require any action from you: in both cases only what is described above is sent, cleaned in the same way. This collection does not require and does not depend on any consent, for the reason explained below.

Why we do this. On the basis of legitimate interest (art. 6(1)(f) GDPR): understanding when and why the website or app break is necessary for the security and functioning of the service. This is not a statistical or marketing treatment, and it does not feed profiling: we group reports by type of fault, not by person. You can still exercise the right to object under art. 21 GDPR by writing to privacy@onstageaps.com.

How long they are kept. Individual reports are kept for 30 days, aggregated groupings by type of fault for 180 days; once these periods elapse they are automatically deleted. The full technical message is read only by the people in charge of maintaining the website and the app; the rest of the Governing Board sees only an aggregated summary (how many faults, what trend), without messages or traces.

Emails: how many are opened, which links are opened

What we count. In the communications the association sends by email we count how many times they are opened and how many times each link is opened. The opening is detected through an invisible image inside the message; links go through an address of ours that counts the visit and takes you straight to the destination. These are overall figures for the single communication: we do not record who opened nor who clicked, and we cannot work it out: the counting tables contain no reference to the recipient, and the address that counts the visit is identical for everyone who receives that communication. So we do not know whether you have read it, we cannot write to you because you have not read it, and we do not use these figures to split people into groups. The number of openings, given how it is obtained, is not even a number of readings: some email programs load the image by themselves, others never load it.

A single consent, to receive and to be counted. From 30 October 2026 consent to the association's communications and consent to be counted in opens and in links opened are the same consent, recorded in a single place, with the date and the version of the text. It is given and withdrawn from the box in your personal area, or with the link at the bottom of each communication. Those who do not give it do not receive promotional communications or the newsletter and are not counted; organisational communications (dates, places, notices) arrive anyway and are never counted. The legal basis is consent (art. 6 para. 1 letter a GDPR), which can be withdrawn at any time without consequences for the rest of your relationship with the association.

Acts required by the Statute do not depend on consent. The convocation of the assembly and the reminder to pay the fee always go out, even if you have not given consent, because they are based on the membership relationship (art. 6 para. 1 letters b and c GDPR) and without them you could not exercise your right to vote. They contain no invisible image or links that count the click-through: they are never counted. The consent you gave before 30 October 2026 did not mention the count: it continues to apply for receiving, not for being counted, until you confirm it from your personal area. The link to stop receiving anything is never counted. If you prefer not to have the invisible image loaded, it is enough to keep automatic image loading turned off in your mail program.

Communications to a few recipients are not counted. If a communication is sent to fewer than ten people, we count neither opens nor opened links, and we show no figure at all: on a group this small, even an aggregate figure would say something about one specific person.

How long they are kept. The figures for a communication are kept for fourteen months from sending, the same period as the site's browsing statistics, and are then deleted automatically. While they are kept, they remain aggregate figures: we derive no information about you from them.

10. If you use the OnStage app

The OnStage app for Android (and, once available, for iPhone) is the same website inside a container installed on your phone: almost everything you have read so far applies identically. Some things genuinely change, and they are described here.

Push notifications

If you install the app and authorise notifications, your phone receives alerts even when the app is closed: for example that your order at the bar is ready, that you are called on stage, or that you have a new chat message. For chat, as of 17 September 2026, the notification also shows the text of the message (who wrote it and what they wrote), not just the alert that one arrived.

To deliver the notification to your phone we go through a provider: Google (Firebase Cloud Messaging) for Android, Apple (APNs) for iPhone the day the app becomes available on that platform. With the message text inside the notification, that text also passes through their servers: they do not read it for other purposes, but technically the content passes through them to reach you. See section 5 for their formal role and section 6 for the transfer of data outside the European Union.

You can turn off notifications at any time from your phone's settings (OnStage app permissions): by denying the permission, your device stops receiving any notification, without having to uninstall the app or close your account.

When you sign out of the app (logout), the device is removed from the list of those receiving your notifications, so that whoever signs in afterwards on that same phone does not receive yours. If that step does not succeed right away (for example you have no network at the moment you sign out), the operation is retried the next time the app opens instead of staying half-done - see the entry os:d:push:revoche-in-sospeso in the Cookie Policy.

If your membership fee expires, you keep receiving the service notices (the order is ready, the renewal reminders, the chat of an event's channels) but no longer those reserved for members: assigned activities, board life, recognitions. Anyone holding a position on the board keeps receiving the board notices. Anyone who has never been a member is not affected by this rule.

If you have allowed notifications, the app can schedule reminders on your phone: the evening before and one hour before a shift assigned to you at an event, and seven days before your membership card expires. The phone works them out from the data the app reads from your account when it is open; they stay on the phone, do not pass through Google and are not sent to us. They show only the name of the event and your role, or the expiry date. They are withdrawn from the phone when you leave the app. There is no reminder for events you have only signed up for.

The session token, kept on the phone

On the website, the token that keeps you signed in sits in a cookie that JavaScript cannot read. In the app, which has no browser with that mechanism, the same kind of token is stored in the phone's encrypted operating-system keychain (Keychain on iPhone, encryption protected by the Android KeyStore on Android): it cannot be read by other apps installed on the phone, and it is deleted when you sign out. Technical details in the Cookie Policy.

Your sessions, and who can see them

Every time you sign in, on the website or in the app, a session is opened. For each one we keep the name of the device (derived from the program you use, for example "OnStage app on Android"), the date of the last access and, for the security of the account, the IP address and the program used at the time of sign-in. On the "My devices" page of your profile you only see the device name and the last access (never the IP address) and you can close one session at a time. The site administrators can see the same list, and close a session, to help you if you lose a phone or to block a suspicious access: every consultation and every closure is logged with the name of whoever did it.

The app lock with fingerprint, face or PIN

It is optional and starts off: you turn it on yourself, only on your phone, from the "My devices" page. When it is on the app asks the phone to unlock. OnStage does not see or keep your fingerprint or your face: the phone's system checks them and we only receive the outcome. Only one piece of data stays written on the phone, whether the lock is on or off (see the entry os:d:app-lock:enabled in the Cookie Policy).

Till orders waiting for the network

If you work at an event's till or at the bar, the app can queue a receipt on the phone when the connection is missing or unstable, so it can be sent as soon as the network comes back. That queue contains the chosen products, quantities, the payment method and - for bar receipts, when a member is recognised for the discounted price - that member's identifier: not their name or email, but a code that would identify you if someone read it from the device. In the app that queue is written on the phone in encrypted form (AES-256), with a key kept by the operating system's encrypted keychain: a backup of the phone or a copy of its files does not contain readable text. On the website, where that keychain does not exist, it stays written without its own encryption, protected only by the fact that other apps and other sites cannot read our data: as soon as the order is sent successfully, usually within seconds, it is deleted automatically; if the server rejects it permanently it stays visible to whoever is at the till until they remove it after checking it. Full list of fields in the Cookie Policy, entry os:d:outbox.

To avoid losing payments that have already been collected and to avoid leaving your data to whoever uses the device after you, the app refuses to let you leave until those operations have been sent, and explains why. If you really have to leave you can give up the unsent operations, in two steps: they are deleted from the device and the exit is logged (only how many they were, not what they contained).

Entries at the entrance and the reminder

If you manage the entrance of an event with the app, the same queue also holds the entries registered when the connection is missing: the scanned QR code and, for a new registration at the door, the data of the completed form (first name, last name, email, date of birth, consents and, for a minor, the data of the person with parental responsibility). They stay written on the phone in encrypted form until sent, that is for a few seconds or, if the network is missing, until it returns: then they are deleted from the phone. If on resend a code turns out not to be valid (expired or revoked card, unknown code) the entry stays registered, and the phone keeps only a note of what time the person came in and what the problem is, without their name, until whoever manages the entrance has read it. If you leave the app with receipts or entries queued, after about fifteen minutes the phone may show a notification that says only how many there are (for example «2 receipts not yet sent»): never amounts, names or codes.

The camera, only to read QR codes

The app uses the phone's camera only to read QR codes (for example a member's card or an event ticket, depending on who is using it). The image is processed exclusively on your device: it is never sent to us or saved anywhere, only the text encoded in the QR code is used to complete the operation.

The membership card in your phone's wallet

If, from the "Your card" page, you tap "Add to Google Wallet", the card is saved in the wallet of your Google account. The pass holds your first and last name, your membership number, your category, the validity period and the QR code of the card (the same one you see on the page). We do this only at your request, to keep the card always at hand on your phone, even without opening the website or the app (legal basis: performance of the membership relationship and your choice to use the feature).

The pass is created and kept by Google, which in turn becomes the controller of the data it saves in your account, under its own privacy policy. We send Google the data of the pass and, when the card changes (it expires, is renewed, the QR code is revoked or replaced, or the application is not accepted), we send the update so that the pass on your phone shows the true status. We receive no data about you from Google: we do not know what else you keep in your wallet, nor whether or when you open the pass. For Apple Wallet the same scheme will apply, with Apple in place of Google, when the feature is activated.

How to remove it: open Google Wallet on your phone, choose the pass of the OnStage membership card and tap "Remove". After removal we no longer send updates to that pass. If you ask for your account to be deleted, we withdraw the pass (it becomes "Card cancelled", without your data) and you can still remove it yourself from the wallet. If we revoke the QR code, the pass stays on the phone but is marked as not valid: the old code no longer works.

11. If you do not have an account: external contacts

This section concerns people who are not registered on the site, do not have an account and did not ask for the newsletter, but whose email address is in the lists the association uses to write with invitations to initiatives and surveys. You did not give it to us on this site, so we tell you here where we have it from and for how long we keep it (art. 14 GDPR).

Which data. The email address and, if you gave it to us, your name.

Where it comes from. You left it yourself, on the occasion of an event or an activity of the association, asking to be contacted again; or they are institutional contacts of bodies and partners the association works with, such as the address of an office or of a contact person.

Why we use it. To invite you to the association's initiatives and surveys.

On what basis. If you yourself asked to be contacted again, on the consent you gave with that request (art. 6 par. 1 letter a GDPR). For contacts of bodies and partners, on the association's legitimate interest in communicating with bodies and partners within the activities provided for by its statute (art. 6 par. 1 letter f GDPR).

How long we keep it.90 days from the last message sent to you: after that, the address is deleted from the list automatically, without you having to ask. If you ask us not to write to you any more, we keep only the address in an exclusion list, precisely so as not to write to you again.

How to say stop. At the bottom of every email there is a link to stop receiving anything from us: just open it. Or write to info@onstageaps.com.

Your rights. The same ones listed in section 8 apply, including the complaint to the Garante: to exercise them, write to the same addresses.

13. Changes to this Policy

We reserve the right to update this Privacy Policy. Material changes will be communicated by email to registered users.