Privacy Policy

Who processes your data

The data controller is Borghese Social Club E.T.S., an association for social promotion with registered office at via Pandolfini 25, 50122 Firenze, tax code 94318160481. For any privacy request you can write to tessere@circoloborghese.it.

This notice, provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), covers the circoloborghese.it website, membership and participation in the association's events.

What data we process and why

Browsing and website security

When you visit the site, the server and the security system record technical data such as your IP address, browser, pages visited, date and time. We use this data to run the site and protect it from unauthorised access and cyber attacks.

• Legal basis: the controller's legitimate interest in website security (Art. 6(1)(f) GDPR).
• Retention: for as long as strictly necessary for security purposes, unless needed to establish any unlawful conduct.

Statistics and marketing

The site is set up for statistics and marketing tools, such as Google Analytics, Google Ads or the Meta pixel, activated through Google Tag Manager only if you consent to the corresponding category in the cookie banner. None of these tools is active at present: when we activate them we will update this notice and the Cookie Policy.

• Legal basis: consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code), which you can withdraw at any time from the Cookie Policy.
• Retention: according to the periods of each tool, set out in the Cookie Policy.

Membership and bookings

To become a member you fill in the application on the members' portal, giving your first name, surname, place and date of birth, home address and email. Your email is your membership card code: we use it to send you your personal QR code, onto which your bookings for tours and events are loaded. At event entrances, authorised staff and volunteers check your card and booking.

• Purposes: managing the membership relationship and the register of members, issuing the membership card, managing bookings and entry, and sending service communications to members.
• Legal basis: performance of the membership relationship (Art. 6(1)(b) GDPR) and compliance with legal obligations applicable to Third Sector entities (Art. 6(1)(c) GDPR).
• Retention: for the entire duration of the membership and, after it ends, for the period required by law, normally 10 years for accounting records.

The data requested for membership is required: without it you cannot join the association or take part in its events. The members' portal is managed by N4o S.r.l., to which the association has entrusted the management of the members' area. Membership fees are paid on the portal and processed by Stripe: the association neither receives nor stores your card details.

Email enquiries

If you write to us, we process the data contained in your message in order to reply. Legal basis: responding to your request (Art. 6(1)(b) GDPR). Retention: for as long as necessary to handle your request.

Who we share data with

Data is processed by persons authorised by the association and may be disclosed, solely for the purposes stated, to:

• N4o S.r.l., via delle Chiassatelle 37, 50053 Empoli (FI), VAT no. 07076940480, which manages the members' portal for membership and bookings, appointed as data processor;
• Aruba S.p.A., which provides the website hosting on servers in Italy;
• Stripe Payments Europe, Ltd. (Ireland), which processes membership fee payments on the members' portal;
• Google Ireland Ltd, for Google Tag Manager and any statistics and marketing tools, only with your consent;
• Defiant Inc., which provides the Wordfence security system;
• advisers and authorities, where required by law.

Data is not sold or used for advertising or profiling.

Transfers outside the European Union

Some providers (Google, Stripe and Defiant) may process data in the United States. In such cases the transfer is based on the EU-US Data Privacy Framework, for certified providers, or on the Standard Contractual Clauses approved by the European Commission.

Your rights

You may at any time request access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest (Articles 15-22 GDPR). If you have given consent, you may withdraw it without affecting processing already carried out. Write to tessere@circoloborghese.it.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali,www.garanteprivacy.it).

Age of majority

Membership and events are reserved for adults. We do not knowingly collect data from minors.

Linked websites

The site contains links to external websites, including palazzoborghese.it, which belongs to a different controller, and Google Maps. Data collected on those sites is governed by their respective privacy notices.

Changes

We may update this notice, for example following changes in the law or to the site. The date of the last update is shown at the top.