Privacy Policy

Last updated: May 2025

1. Data controller

APS OnStage, with registered office at Via [address], Botrugno (LE), Tax code [00000000000].
Email: privacy@onstageaps.com

2. Personal data collected

We collect the following personal data:

  • Personal details (first name, last name, date of birth)
  • Contact details (email, phone)
  • Authentication data (email, encrypted password)
  • Data related to event registrations
  • Data related to membership requests
  • Payment data: NOT stored on our systems — handled directly by Stripe (see section 5)
  • Anonymous/aggregated browsing data collected via Google Analytics, only with prior consent (see section 9)

3. Purpose of processing

Data is collected for the following purposes:

  • Managing the user account and authentication
  • Managing event registrations
  • Processing membership requests
  • Sending service communications (e.g. registration confirmations)
  • Promotional communications, subject to explicit consent
  • Processing payments through the Stripe provider
  • Aggregated site usage statistics, subject to explicit consent (Google Analytics)
  • Publication of participant names in the public leaderboard of games/activities organized during events (e.g. Beer Pong), subject to consent collected at event registration

4. Legal basis for processing

The processing of data is based on the performance of a contract (art. 6(1)(b) GDPR), the data subject's consent (art. 6(1)(a) GDPR) for promotional communications, and legitimate interest (art. 6(1)(f) GDPR) for platform security.

5. Data retention

Data may be shared, within the limits of the purposes indicated above, with the following third parties, appointed as data processors pursuant to Art. 28 GDPR where applicable:

  • Google Ireland Limited (Google Analytics 4) — aggregated browsing statistics, enabled only with explicit consent given in the cookie banner. See the Cookie Policy for details and to withdraw consent at any time.
  • Stripe Payments Europe, Ltd. — online payment processing. OnStage does not store or view full payment card data: the entire payment flow takes place on Stripe's systems (PCI-DSS scope is Stripe's responsibility).
  • IONOS SE — server provider (hosting) on which the site's and database's infrastructure is hosted.

<TO BE COMPLETED: verify/attach the Art. 28 GDPR data processing agreements (DPA) with each of the providers listed above; as of today they are not yet formalized in the register of processing activities.>

6. Rights of data subjects

Google and Stripe may process data outside the European Economic Area as well (in particular in the United States). In these cases the transfer takes place on the basis of the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR) and the additional safeguards provided by the respective providers. You can consult the data transfer notices of Google and of Stripe.

7. Cookies

Account personal data is stored for the time strictly necessary for the purposes of collection and in any case no longer than 5 years after the end of the relationship with the association. Marketing data is deleted upon withdrawal of consent.

Statistical data collected through Google Analytics is retained according to the period configured on the site's GA4 property: <TO BE COMPLETED: retention period set in Google Analytics — Admin > Data Settings > Data Retention>. Consent to statistics is requested again every 24 months, in accordance with the guidance of the Italian Data Protection Authority (Garante Privacy).

8. Changes to this Policy

You have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Request erasure ("right to be forgotten")
  • Restrict processing
  • Receive your data in a portable format
  • Object to processing
  • Withdraw consent at any time
  • Lodge a complaint with the Data Protection Authority (Garante)

If you have an account, you can export your data and request deletion directly from your profile: Export my data · Request account deletion.

Alternatively you can exercise these rights by writing to: privacy@onstageaps.com

If you believe that the processing of your data violates applicable law, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Piazza Venezia, 11 — 00187 Rome, Italy; email: garante@gpdp.it; certified email (PEC): protocollo@pec.gpdp.it; www.garanteprivacy.it), or with the supervisory authority of the EU member state where you habitually reside.

9. Cookies and tracking

This site uses technical cookies necessary for its operation (always active, no consent required) and, only with explicit consent given in the cookie banner, preference, statistics (Google Analytics 4) and marketing cookies.

The Google Analytics tag (gtag.js) is initialized in "Consent Mode": the script is not loaded and no event is sent to Google until you explicitly grant consent to statistics. You can consult the full list of cookies used, and give, change or withdraw consent at any time in the Cookie Policy.

10. Changes to this Policy

We reserve the right to update this Privacy Policy. Material changes will be communicated by email to registered users.

← Back to home