INFORMATION ON THE PROCESSING OF PERSONAL DATA
ART. 13 OF EU REGULATION 679/2016
(GENERAL DATA PROTECTION REGULATION - GDPR)
Dear User,
Conforming to art.13 of EU Regulation 679/2016 (hence “GDPR”) we inform you that your personal data, that you provided,
will be processed by Adda Viva Indomita Valtellina River S.S.D.R.L. acting as data controller (hereinafter “Data
Controller”), and could be subject to processing in the manner described by this Privacy Policy and in accordance with the
confidentiality principle that guides the activity of the Federation.
1. LEGAL BASIS AND PURPOSE OF THE PROCESSING
The legal basis of the processing (by way of example) is based on the permission of personal data processing, Legislative
Decree n. 242/1999 and subsequent amendments and integration, on the existing rules on suitability for the sports practice
Ministerial Decree on 18/02/1982 and Ministerial Decree on 24/04/2013) and on the CONI statute.
The personal data of the undersigned and those for whom he/she books, acquired at the time of the booking, will be
processed for institutional purposes, for example:
- implementation of the booking activities;
- implementation of the activities related to the relationship established over the booking process, including the
activities related to the management of relations with insurance companies;
- requirements connected and obligations under the law, regulations, statute and federal regulations and, in general,
national and international regulations, from time to time in force.
2. METHOD OF TREATMENT
The data will be processed in the following way: on manual spreadsheets, made with the help of electronic means, stored in
enclosed places with reserved and selected access, with a computerized system providing support against cyber risks
(firewall, antivirus, periodic backup of data); the data could be processed by internal or external entities, that are specifically
authorized and had undertaken to confidentiality.
See art. 4, paragraph 2, GDPR for the definition of “treatment”.
3. PROVISION OF DATA AND REFUSAL
The provision of “ordinary” personal data (for example name, phone number and email address) is strictly necessary for the
purpose of performing the activities referred to in point 1a. It may also happen that the provision of specific “sensitive”
personal data (for example health data and personal data regarding the state of health, also in relation to necessary
treatment about national health emergencies) is necessary for the purpose of performing the activities referred to in point 1.
Any refusal of the party concerned to provide personal data makes it impossible to perform the activities referred to in point
1.
4. DATA COMMUNICATION
The personal data may also be processed on behalf of the owner, for the purposes referred to in point 1a, by third-party
companies that work on behalf of co-owners, in their capacity as external managers of the processing (this includes but is
not limited to: lenders, professional offices, suppliers/consultants who manage and/or participate in the management and/or
maintenance of the electronic and/or telematic tools that we use, insurance companies for the time strictly necessary to the
successful execution of that service, contractors). Your personal data will be made accessible only to those who need it due
to their job of hierarchical position. These parties will be properly instructed to avoid data loss, destruction, unauthorized
accesses or unauthorized processing of the data. The affiliate will operate as autonomous owner of the processing. Without
your express consent, the holder may communicate your data to supervisory bodies, legal authorities as well as to all the
parties to which a mandatory release is expressly provided by the law.
5. DISCLOSURE OF YOUR DATA
Personal data are not subject to disclosure, without the prior express consent of the data subject.
6. TRANSFER OF DATA ABROAD
The personal data can be transferred towards Countries belonging to the European Union and towards third party countries
outside the European Union, exclusively under the purposes stated in point 1. In such a case the data controller assures
hereby that the transfer of data outside the EU will be done in accordance with the art. 44 et seq. of the Regulation and with
applicable legal provisions, stipulating, if necessary, agreements that guarantee an adequate level of protection.
7. DATA RETENTION
The data are kept for the time strictly necessary to the performance of the activity referred to in point 1a, in accordance with
the civil code, the fiscal legislation and the CONI and WRF rules and regulations, for a period not exceeding 10 years. The
verification of the obsolescence of the data stored in relation to the purposes for which they were collected is regularly
carried out. There is absolutely no automatic decision-making process or profiling activity, referred to in the art.22, GDPR
paragraphs 1 and 4.
8. RIGHTS OF THE DATA SUBJECT
As an interested party to the data treatment, we inform you that you have the possibility to exercise the rights required by the
Regulation, precisely:
a. The right, in accordance with art.15, to obtain confirmation that there is or there is not an ongoing treatment
of personal data concerning you and, if there is, to obtain the access to personal data and the following
information: i) purpose of the processing ii) categories of personal data processed iii) recipients or
categories of recipients to whom the data have been or will be communicated, especially if third-countries
or international organizations iv) personal data retention period, whenever possible, or, if it is not possible,
the criteria used to determine that period v) the existence of your right to request from the data controller
the rectification or deletion of personal data, or the restriction of the processing of your personal data, or to
object to their processing vi) the right to complain at the authorities, in accordance with art.77 et seq. of the
Regulation vii) in the event that personal data are not collected from the data subject, all available
information regarding their origin; viii) the existence of an automated decision-making process, including the
profiling mentioned at art.22 paragraphs 1 and 4 of the Regulation and, in such cases at list, meaningful
information about the logic used, as well as the importance and the consequences of this processing
concerned for the interested party ix) the right to be informed about the existence of appropriate guarantees
in accordance with the art.46 of the Regulation regarding the data transfer, if the personal data are
transferred to a third country or an international organization;
b. The person concerned will also have (whenever possible) the possibility to exercise the rights foreseen by
the art.16-21 of the Regulation (right of rectification, right to oblivion, right of treatment limitation, right to
data portability, right of opposition)
We inform you that the owner commits to answer your requests no later than one month from the date of receipt. The term
could be extended depending on the complexity and number of the requests and the data controller will arrange to explain
the reasons for prolonging within one month of your request. The outcome of your request will be provided in written or in
electronic format.
9. DATA CONTROLLER
The data controller is Adda Viva Indomita Valtellina River S.S.D.R.L. with registered office in Largo Pedrini 3, 23100
Sondrio (SO) - Italy, P.I. 00951040146, tel. +39 345 1422823 - E-mail:
The updated list of data processors is available, by sending an Email to