Data controller
A.S.D. Busa Boda Team
Via Marocco, 18 - 38066 Riva del Garda (TN)
VAT no. 02254510221
Park: Via al confine, 16/A - 23823 Colico (LC)
comolakecable@gmail.com · +39 324 996 7509
What data we process
If you only visit the site
No data that identifies you as a person. The site uses Google Analytics to count visits and see which pages are read; it profiles nobody and never joins those figures to your account. The server records requests in its technical logs, which keep it running and defend it from abuse.
If you open an account
Email address, password (kept only as a cryptographic hash, never in the clear), first and last name, and the date you last signed in.
If you register yourself or someone else
The association’s membership form, which is what the federation’s insurance requires:
- first and last name, citizenship, date and place of birth
- Italian tax code, for Italian citizens
- home address, telephone
- an identity document: type, number and expiry
- a photograph, if you upload one
- for minors, the details of whoever holds parental responsibility
This is data about someone who goes on the water, so we also process it for safety at the facility. The photograph and the document are never public: only the park’s administration sees them, through a protected page.
If you book, buy or top up your balance
Bookings, balance movements, passes, cards and receipts. Receipts carry a name and address because that is what an accounting document must carry.
Your card details never pass through us and we never see them. Payment happens on a Stripe page; only the outcome comes back to us.
If you write to Claudia, the site’s assistant
We keep the conversation - what you write and what she answers - so it can be continued, and to learn what the site does not explain well enough. If you are signed in, Claudia can read a summary of your balance, your cards and your bookings in order to answer about you: that summary is not saved into the conversation.
To limit abuse we keep a cryptographic fingerprint of the writer’s IP address, never the address itself.
Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Running the account, bookings and purchases | Performance of a contract |
| Membership and federation insurance | Performance of a contract and association obligations |
| Receipts and accounting | Legal obligation |
| Site security and abuse prevention | Legitimate interest |
| Answering questions put to the assistant | Legitimate interest |
| Counting visits to the site (Google Analytics) | Consent, which you can withdraw whenever you like |
Who we share it with
We sell and hand over data to nobody. Only the suppliers we need in order to run the service process it on our behalf, as processors:
| Supplier | What it does | Where |
|---|---|---|
| Stripe | Takes card payments | Ireland / United States |
| Twilio SendGrid | Delivers the service’s email | United States |
| Anthropic | The model that generates Claudia’s answers | United States |
| DigitalOcean | The server the site runs on | European Union |
| Google Analytics | Counts visits, only if you accept the analytics cookies | Ireland / United States |
| Google Fonts, YouTube | The site’s typefaces and videos | United States |
Transfers to suppliers outside the European Union take place on the basis of the safeguards provided for by the GDPR.
For how long
- Conversations with Claudia: 90 days from the last message, then deleted automatically.
- Activation and password-reset links: 48 hours, and each works once.
- Account, membership and booking data: for as long as the account exists.
- Receipts and accounting documents: for the period required by law, even after the account is closed.
When an account is deleted, the data of the people registered on it, their photographs and the documents held are deleted with it. Receipts stay on file, no longer linked to the account, for the ten years required by law, and are then deleted.
Your rights
You may ask us at any time to access your data, correct it, delete it, restrict its processing, receive it in a readable format, or object to processing based on legitimate interest. Write to comolakecable@gmail.com and we answer you ourselves, with nobody in between.
If you think something is wrong, you can contact the Italian data protection authority, the Garante (www.garanteprivacy.it).
If you are writing from Switzerland
The park is a few kilometres from the border and some of the people who come here live in Switzerland. For them, alongside the GDPR, the revised Swiss Federal Act on Data Protection (nFADP) applies too: it covers processing that has an effect in Switzerland, even when whoever carries it out is based in Italy.
The rights are the ones listed above - access, correction, deletion, objection - and they are exercised by writing to the same contacts. What changes is the authority to turn to if something is wrong: anybody resident in Switzerland can go to the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) as well as to the Italian Garante.
Cookies
The site uses technical cookies, needed to make it work, and - only if you accept them - Google Analytics cookies to count visits. What they are and what they are for is written in the Cookie policy.