Privacy and Cookie Policy

In brief

• You do not have to give us any data to browse the site.
• Google's statistics work only if you accept them.
• If you write to us or sign up, we use your data to reply and to manage your request.
• We do not sell data to anyone.

Who we are (data controller)

The data controller is NOA APS, a Third Sector entity: a social promotion association registered in the RUNTS (the Italian National Register of Third Sector Entities), register no. 181457 of 7 October 2026, and a club affiliated to ARCI. Registered office: Via Ferrarese 169, 40128 Bologna (BO), Italy. Tax code and VAT number 04401911203.

For any question about your data, write to leggerestrutture.ferrarese@noa-aps.it.

When you visit the site

The site is hosted on Cloudflare, which records some technical connection data (IP address, browser type, pages visited, date and time) to keep the site secure and working. We also use Cloudflare Web Analytics to count visits in aggregate form: Cloudflare states that for these statistics it does not use cookies or other tools in your browser. We process this data for our legitimate interest in keeping the site secure and in knowing whether it is used (Art. 6(1)(f) GDPR). Cloudflare keeps it for the period stated in its privacy policy (cloudflare.com/privacypolicy).

Cookies and similar tools

If you choose "Essential only" or close the banner, Google Analytics stays off and sends nothing to Google. You can change your mind at any time with the "Cookie preferences" link at the bottom of every page. Deleting only the cookies from your browser is not enough, because your choice is kept in local storage: use the link, or delete the site's data from your browser settings.

To find out how Google processes data: policies.google.com/privacy.

Events calendar and map

On the Events page and on the pages of the individual courses the calendar is loaded directly from Google's servers (Google Calendar), which for this reason receive your IP address and some technical data from your browser. We do this because it is necessary to show you the scheduled events and free trials (Art. 6(1)(f) GDPR). To find out how Google processes this data: policies.google.com/privacy.

On the Contact page the Google Maps map loads only if you click "Show the map". At that moment Google receives your IP address and some technical data from your browser and may use cookies.

When you write to us, call us or message us on WhatsApp

If you contact us by email, telephone or WhatsApp we use the data you give us (name, email or telephone number, content of the message) to reply. Basis: your request (Art. 6(1)(b) GDPR, pre-contractual measures) or, for a general question, our legitimate interest in replying (Art. 6(1)(f)).

The Italian pages of this site have forms; the English pages do not. The contact form on the Contact page of the Italian site asks for first name, surname, email, date of birth, city, postcode, your message and, if you wish, your mobile number. The date of birth is used to tell whether the person writing is a minor: in that case the form also asks for a parent's details. If you do not give us the mandatory data we cannot reply.

Sign-up forms for evenings, free trials and courses

Our courses, gyms and events, and the sign-up forms for them, are in Italian.

To sign up for an evening, a free trial or a course we ask for first name, surname, email, mobile number, city, postcode and province, plus any other data shown on the sign-up form. We use them to manage your registration, organise the activities and communicate with you about what you have signed up for (Art. 6(1)(b) GDPR). If the person signing up is under 18, the form also asks for the details of a parent or of whoever holds parental responsibility, who must fill it in or authorise the registration. When you sign up for a paid course we also keep receipts and payment data for legal obligations (Art. 6(1)(c)).

Some forms also include ticks that are needed in order to take part: the liability waiver for injuries and consent to images (see "Photos and video"). If you do not tick them, you cannot sign up for the event. The newsletter tick is optional: if you do not tick it, you can still take part.

The forms are managed with the WinDoc service, provided by GMV Software S.r.l.s. (Rimini, Italy), which keeps the data on behalf of NOA as data processor. GMV states that it does not transfer data outside the European Union.

Requests from companies

If you fill in the form on the Companies page, we receive the data you enter: first name, surname, email, mobile number (optional), date of birth, city, postcode and your message. We use them to reply to you (Art. 6(1)(b) and (f) GDPR). The form is the same as the one on the Contact page, and the date of birth is used only to tell whether the sender is a minor. It is run with WinDoc, like the others.

Newsletter and messages

Our forms have an optional tick box to receive the newsletter and WhatsApp messages. If you tick it, we use your email or your number only to send you communications about NOA's activities, on the basis of your consent (Art. 6(1)(a) GDPR and Art. 130 of the Italian Privacy Code). If you do not tick it, we do not send you the newsletter. You can unsubscribe at any time with the link at the bottom of every email or by writing to us. The newsletter is sent with Brevo, a service that processes data on behalf of NOA.

WhatsApp groups for courses

Each course has a WhatsApp group, which you join yourself by clicking the link we send you by email. In the group all participants, teachers included, see your name and your telephone number, as in any WhatsApp group. You can leave the group whenever you like. The WhatsApp service is run by WhatsApp Ireland Limited, under its own privacy policy.

Members and the ARCI card

To become a member you fill in the pre-membership form on the ARCI portal or in the Tessera ARCI app, or NOA fills it in for you. The data are processed by ARCI under its privacy notice, which you can find on the ARCI portal and in the Tessera ARCI app, and are passed to NOA for entry in the register of members, which the law requires us to keep (Art. 15 of the Italian Third Sector Code; Art. 6(1)(b) and (c) GDPR). The register of members is kept with WinDoc.

Donations with PayPal

If you make a donation with the "Donate now with PayPal" button, the payment takes place entirely on PayPal. NOA receives the confirmation, the amount and the data that PayPal sends us (normally name and email); we do not receive your card or account details. For the payment, the controller is PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.), under its own privacy policy. We issue you a receipt for the donation. If you need a certificate with your tax code for tax relief, write to us: we will use your tax code only for that. We keep the donation data for 10 years, for accounting and tax obligations (Art. 6(1)(c) GDPR).

Photos and video

During our programmes and events we may take photos and video. For evenings and events with online sign-up, consent to images is a condition of taking part: you give it with the tick on the sign-up form, and anyone who does not wish to be filmed cannot take part (Art. 6(1)(a) GDPR). For programmes we use a release form, where you choose separately between internal archive, website and social media, and promotional material. We use these materials only on NOA's channels. You can withdraw your consent at any time by writing to us: we will remove without delay the materials published by us; to take part in later events, consent will be needed again.

Minors

For young people (for example in the Theatre for Teens course) the forms and the release form are signed by a parent or by whoever holds parental responsibility; from the age of 14 the young person also signs the release form. We do not publish the surnames or contact details of minors. If you are a parent and have doubts, write to us.

Who we share data with

Data is seen only by those in NOA who need it for the activities (members, teachers and volunteers in charge) and by suppliers who work for us: Cloudflare (hosting and site statistics), GMV Software (WinDoc: forms, register of members, management), Brevo (newsletter), Google (Google Analytics, only if you accept; the calendar), WhatsApp (groups), the professionals who assist us with accounting and tax matters, and ARCI for membership. PayPal is an independent controller for payments. Public authorities may also see the data, if the law requires it. We do not sell data.

Data outside the European Union

Some suppliers (for example Google and Cloudflare) are based, or have servers, in the United States too. The transfer is made to companies certified under the EU-US Data Privacy Framework, which the European Commission has recognised as adequate, or with the European Commission's standard contractual clauses.

How long we keep data

If you ask us to delete your data, we delete what we no longer need to keep; what the law requires us to keep (for example receipts) stays for the required time, with restricted access.

Your rights

You can ask us at any time for access to your data, rectification, erasure, restriction of processing and portability, and you can object to the processing, by writing to leggerestrutture.ferrarese@noa-aps.it. We reply within one month. Where the processing is based on consent, you can withdraw it whenever you like, without affecting what was done before. You can also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of the country where you live or work.

Changes to this page

If we change the way we process data, we update this page and the date at the top.