Membership campaign and membership relationship management

Information pursuant to Articles 13 and, for data received indirectly, 14 of Regulation (EU) 2016/679. Version 01 of 03/10/2026

1 Owner and contacts

The data controller is the’Association Pescara Blue-White, CF 91185080685, with registered office in Via Milano n. 10, staircase B, first floor, 65122 Pescara, at the Ballone & Francione Law Firm, in the person of its legal representative pro tempore.

For information and to exercise your rights: info@pescarabiancazzurra.it, PEC associazione@pec.pescarabiancazzurra.it, or by communicating with the headquarters. It is not necessary to use certified email exclusively to exercise your privacy rights.

2 Data processed and origin

We process identification and personal data, contact details, tax code (if applicable), data of the minor's or legal representative, information strictly necessary to verify their legal authority, applications, declarations, resolutions relating to membership status, membership number, and correspondence. We also process amounts, reasons for payment, transaction references, and bank details necessary for reconciliation and any refunds, as well as any newsletter subscriptions.

The data comes from the applicant, their representative, and, for payments and refunds, from the bank or payment provider. If a third party pays, we receive their data from the applicant and the payment provider. For an entity's representative, the reference of their authority may come from the entity itself or from relevant public records. We do not collect contact lists from sponsors, nor do we routinely request copies of identity documents, health data, or data relating to convictions and criminal offenses.

If the data is not received directly from the data subject, we will provide this information within one month and, in any case, upon first contact or before the first disclosure to third parties, whichever is earlier, subject to the exceptions provided by law. The representative also receives the information for minors, for whom the information is made comprehensible according to their age.

3 Purposes and legal bases

Application and membership relationship. We process the request, communicate the results, manage registration, institutional activities and communications, contributions, and reimbursements. For the applicant (a natural person) and the minor represented, the basis is the execution of the requested measures and the membership relationship (Article 6, paragraph 1, letter b). For the contact details and activities of organization representatives and for the management of third-party payments, we operate on the legitimate interest of correctly managing relationships and reconciling transactions (letter f), limiting the data to what is strictly necessary.

3 Purposes and legal bases in detail

Regulatory obligations. We retain documents and make communications required by accounting, tax, or regulatory standards, where applicable (Article 6, paragraph 1, letter c). We do not require consent for these purposes.

Security and protection of rights. We prevent errors, unauthorized access, and fraud, and retain the documentation necessary to manage disputes regarding the Data Controller's legitimate interest (letter f), after assessing necessity and balancing the data. We do not perform generalized checks outside of the campaign.

Optional newsletter. Only with the separate consent of the adult who personally joins (letter a), we send information about initiatives, events, and fundraisers via email beyond the required communications. This choice does not affect membership; it can be easily revoked. It does not include third-party marketing.

4 Necessity of the transfer

Identity, contact information, required application statements, and payment details are required to process the application. If these information is not available, it will not be possible to complete the application if it impedes processing or reconciliation. Alternative information is permitted for the tax code if it is not available, subject to applicable receipt requirements. Telephone information is optional. We do not collect excessive data simply for the purpose of receiving contributions.

5 Recipients and access

Only administrators, secretarial staff, and authorized collaborators have access, according to their respective roles. Providers of IT, archiving, communications, and administrative assistance services, appointed as data processors pursuant to Article 28 when operating on our behalf, may process the data; banks, payment providers, and professionals operate as independent controllers for their respective independent activities. Authorities receive data only when the necessary conditions are met.

Data is not disclosed through public member lists or sold to sponsors. Public financial statements are aggregated. Review of the club's books by those entitled to access them is subject to controlled access and the restriction of data not relevant to the purpose. The sports club and vendors do not receive member data for commercial purposes; any communications required by specific obligations are limited to what is strictly necessary.

6 International Methods and Transfers

We use secure paper archives and electronic tools with individual access, authorization levels, and appropriate security measures. We do not use fully automated admission decisions or profiling; the Board of Directors makes decisions.

The campaign envisages the activation of services with processing and support within the European Economic Area, without transfers to third countries. Before adopting services that involve transfers, including remote access from abroad, the Data Controller will update the privacy policy, specifying the countries, recipients, the basis for the transfer, and the methods for obtaining a copy of the guarantees, where applicable. The mere location of the data center in Europe does not preclude transfers.

7 Storage times

Pending questions: for the investigation and until the decision, payments and any refunds, according to the terms of the Regulation. Applications rejected, withdrawn, or archived: Operational data not required for other purposes are deleted within 12 months of the closure of the case.

Associates: Active personal data and contact information for the duration of the relationship; after termination, any data no longer required is deleted, while essential records of admission, termination, obligations undertaken, and communications relevant to the protection of rights are retained for 10 years. The membership register is maintained as a historical record, containing only essential data for as long as necessary to document the organization's existence, with limited access. After termination of the organization, the required terms for liquidation and documentation requirements apply, with review as necessary.

Payments, receipts, contribution agreements and reimbursements: 10 years after the end of the financial year to which they refer, for documentation and defense purposes and for applicable obligations. The IBAN used only for a refund is removed from the operational lists within 90 days of the final reconciliation; it may remain in the accounting records subject to the previous deadline.

Newsletter: Until revoked and in any case no later than 24 months after consent is given, after which it must be renewed. The minimum proof of consent, revocation, and objection is retained for the time necessary to demonstrate the lawfulness of the communications and prevent further unwanted communications, with at least an annual review. Any identity document checks: Copy deleted within 30 days of verification, unless justified; only the outcome remains.

In the event of a dispute or a request from an authority, only relevant data may be retained beyond the deadlines until the case is resolved and for the additional period necessary to protect the rights. The Data Controller reviews the archives at least annually, eliminates duplicates, and limits access to retained data only for legal obligations or defense.

8 Rights and complaints

Within the limits and conditions of the GDPR, you may request access and copying, rectification, erasure, or restriction of processing. For data processed by automated means based on consent or contractual relationships, you may request data portability. You may object to processing based on legitimate interest for reasons related to your situation; you may object to direct marketing at any time. Withdrawing your consent does not affect the lawfulness of previous communications.

We typically respond within one month; any extensions, in the applicable cases, will be communicated within the first month, along with the reasons. To identify you, we only ask for proportionate information. These rights do not entail the deletion of documents we are legally required to retain.

You can lodge a complaint with the Italian Data Protection Authority using the methods published on www.garanteprivacy.it and appeal to the judicial authorities. Receipt of the information does not require general consent.

9 Site and updates

This notice concerns the campaign and the membership relationship. The site's technical processing and any cookies are described in the site's specific notices, made available before using the relevant services. Substantial changes will be communicated before the new processing begins; a new optional purpose is not authorized by the data subject's silence.