Skip to content
Savino Del Bene Volley
Shop
🇬🇧|🇮🇹

Privacy Policy

Privacy notice

Under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), this page explains how the site handles the personal data of its visitors. Last updated 24 October 2026.

Data controller

Pallavolo Scandicci Savino Del Bene Società Sportiva Dilettantistica a Responsabilità Limitata — Via Benozzo Gozzoli, 5/6 — 50018 Scandicci (FI), Italy
VAT 06271460484 — Tax code 94217750481
Email: [email protected] — Certified email: [email protected]

What we collect, why, and on what legal basis

  • Browsing data (IP address, requested page, browser, time of visit): recorded by the server to run and protect the site. While your session is open, IP address and browser are also held in the sessions table, which is what keeps the cart and the account area working. Legal basis: the controller's legitimate interest in providing and securing the service.
  • Contact form (name, email, subject and message) and press accreditation requests (name, email, phone, outlet, role, match and notes): used to reply to you, and forwarded by email to the club offices that handle them. Legal basis: responding to your request.
  • Newsletter subscription (email, your first name if you give it, date and IP address of the request, date of confirmation and version of the consent text you accepted, which together prove consent): only if you ask for it and confirm it from the link we send you. We send the newsletter with ActiveCampaign, and it contains a tracking pixel and tracked links that tell us whether you opened the message and which links you clicked: they help us understand which content interests readers and keep the list clean. Legal basis: the consent you give when subscribing, which covers both the sending and this measurement. From the link at the bottom of every newsletter you can withdraw, at any time, just the tracking — you keep receiving the newsletter, without pixels or tracked links — or everything, by unsubscribing. Service emails (order confirmations, receipts, password resets) contain no tracking pixels.
  • Shop purchases and auction bids: data, purposes and legal bases are in the section Shop purchases and auctions, below.
  • Shop account (name, email, phone if you give it in an order, password kept as a non-reversible hash, order history and, for auctions, the outcome of the card verification): only if you register. We also keep a fingerprint of the passwords you used before, to stop you reusing one. Legal basis: performance of the contract.
  • Site statistics (Google Analytics 4): only with your consent to statistics cookies.
  • Advertising measurement (Meta pixel): only with your consent to marketing cookies.
  • Proof of your cookie choice (what you chose, when, against which version of the texts, the browser used, the language, and a pseudonymised fingerprint instead of your IP address): described in the Cookie Policy. Legal basis: the obligation to demonstrate consent, Article 7 GDPR.

Shop purchases and auctions

When you order from the shop or pay for a lot you won at auction we process: first and last name, email, phone, shipping address and, if different, billing address, your Italian tax code (we ask for it on orders shipped to Italy, and it appears on the receipt), any notes you add to the order, the items bought, the bids made at auctions and any withdrawal notices you send from the site. Without the required fields of the form the order cannot be completed.

  • Completing and fulfilling the purchase: recording the order, reserving the goods, handling payment and shipping, sending you service emails (confirmation, bank transfer instructions and reminders, status changes, shipment, refund). Legal basis: performance of the contract (Article 6(1)(b) GDPR).
  • Notifying the club of the new order: the shop staff receive the order summary by email, with your contact and shipping details, to prepare it. Legal basis: performance of the contract.
  • Keeping proof of what you accepted: with the order we record the version of the Terms of sale in force and a fingerprint of the text, which we also attach to the confirmation. Legal basis: legal obligation (Italian Consumer Code) and the controller's legitimate interest in being able to prove the contract.
  • Withdrawal, warranty, refunds and payment disputes: handling your requests and defending the club's rights if a payment is disputed. Legal basis: legal obligation (Italian Consumer Code) and the controller's legitimate interest in protecting its rights.
  • Tax and accounting obligations: keeping orders and documents for as long as the law requires. Legal basis: legal obligation (Article 6(1)(c) GDPR).
  • Card verification for auctions: to bid you must verify a payment card. Stripe receives your name, email and card details (which the site never sees) and creates a customer profile for you, deleted together with your account. Legal basis: performance of the contract.
  • Advertising measurement: only if you have accepted marketing cookies, the Meta pixel receives the items, quantities and value of what you add to the cart and buy. Once payment is confirmed, we also report the same purchase to Meta from our server (Conversions API), so that it is counted once even if the browser blocks the pixel: order number, amount, items, your email and phone number in irreversibly encrypted form (SHA-256), the identifiers of Meta's cookies (_fbp, _fbc) and the browser type. We record on the order that consent was given, and which choice on the banner proves it. Legal basis: consent, which applies to orders placed after giving it; withdrawing it from "Cookie preferences" stops the sending for later orders.
  • Shop statistics: we count shop pages viewed, orders started and orders completed, without IP address or session identifier, to learn which items interest people. Legal basis: the controller's legitimate interest.

Order data is not used to send you promotions: the newsletter only arrives if you subscribe separately and confirm. Payment is handled by PayPal or Stripe, which receive the amount and the order number (Stripe also your email); delivery by the courier. Both act as independent controllers, as explained below. How long we keep orders and withdrawals is set out in How long we keep it.

Photographs and face recognition

The site publishes photographs of matches, training sessions, events and club activities. Players, staff, opponents, referees, guests and, usually in the background, the crowd at the arena appear in them.

Every photograph added to the archive is analysed by a face recognition service running on a club server in Frankfurt, reachable only from our internal network: images are not sent to any third-party recognition service. The service finds the faces large enough to be recognisable and compares them with the numeric templates of the people the editorial team has enrolled — players and staff members — in order to tell who is pictured. Recognised names are attached to the photograph, appear in the photo archive as a per-person filter, and end up in the image title and description, which is also what search engines read.

Faces that are small relative to the photograph, such as those of the crowd in the background, are excluded from recognition: the service only detects where they are and covers them before the comparison, without computing any template. Other faces of people who are not enrolled, for example opponents, referees or guests, are compared there and then with the templates of the enrolled people and, if they resemble none of them, leave nothing behind: no template is created or kept for them. The only templates we keep are those of the people enrolled by the editorial team.

Legal basis: the explicit consent of the person concerned (Article 9(2)(a) GDPR), obtained by the club before enrolling their face; for players who are minors it is given by whoever holds parental responsibility. Consent can be withdrawn at any time: on withdrawal the editorial team deletes the template, the links made by recognition and the name in the titles and descriptions of the photographs. The photographs stay, without the name.

Recognition suggests, it does not decide: the link between a person and a photograph can always be changed by the editorial team, and it produces no legal effect and no automated decision about anyone.

If you appear in a photograph and would rather not, or would rather your name were not attached to it, write to [email protected]: we will remove the image or the link.

Who we share data with

Data stays with the club and with the providers that process it on our behalf, appointed as data processors under a written agreement (Article 28 GDPR):

  • DigitalOcean: site hosting, database and file storage, in the Frankfurt data centre (European Union). Traffic to the site goes through the Cloudflare network, which DigitalOcean uses as its sub-processor and which sees the visitor's IP address;
  • Resend: the site's emails — order confirmations and updates, auctions, withdrawal receipts, newsletter subscription confirmation, account verification and management, and forwarding to the club of messages written in the forms and of new order notices;
  • Sentry: error diagnostics, with the data held in the European region: the page address, the browser type and the technical trace of the fault. Errors that happen in your browser also go through our server before reaching Sentry, which therefore receives neither your IP address nor your identity;
  • ActiveCampaign: newsletter delivery, only to addresses that have confirmed their subscription, with the open and click measurement described above;
  • Google Ireland: site statistics (Google Analytics 4), only with your consent.

The following act instead as independent controllers, each with its own privacy notice: PayPal and Stripe, for shop and auction payments (card or account details go straight to them: the site never sees them); the courier handling shipments. Meta Platforms Ireland, for advertising measurement with the pixel and only with your consent to marketing cookies, is joint controller with the club for collecting and transmitting the data (Article 26 GDPR) and independent controller for what it does with it afterwards. The essence of the joint controller arrangement is set out in Meta's Controller Addendum. We do not sell or otherwise pass data to anyone else.

Some pages also carry content hosted elsewhere — the arena map, the videos: they only load if you ask with a click or if you have accepted marketing cookies, and from that moment your IP address reaches whoever hosts them. This is explained in the Cookie Policy.

Transfers outside the European Union

The site itself, its database, the photo archive, the face recognition service and the error diagnostics are on servers in the European Union. Some providers are, however, US companies or part of US groups: DigitalOcean and Sentry, which keep our data in Europe; Cloudflare, whose network the traffic goes through; Resend, ActiveCampaign, Google, Meta, PayPal and Stripe, which may process part of it in the United States; and, only if you load an embedded video, Vimeo and Twitch. For providers based in the United States the transfer relies on their certification under the EU-US Data Privacy Framework, which the European Commission has found adequate (Article 45 GDPR), and/or on the standard contractual clauses approved by the Commission (Article 46).

How long we keep it

  • Messages and accreditation requests: 24 months from sending.
  • Newsletter subscription: until you unsubscribe. After that, for 24 months, only your email and the dates of subscription, confirmation and withdrawal are kept as proof of consent; name and IP address are deleted at once. Requests never confirmed are deleted after 30 days.
  • Orders, auction bids and tax documents: 10 years, as required by law.
  • Withdrawal notices sent from the site: 10 years from sending when they refer to an order placed on the site, because they are the proof of withdrawal and the right to a refund lapses after ten years; 12 months when the order number given does not match any order.
  • Shop account: as long as it is active; after deletion only tax documents remain.
  • Carts left halfway: 7 days from creation.
  • Meta cookie identifiers and browser type stored with an order for the Conversions API: deleted as soon as the purchase is reported to Meta, and in any case after 7 days.
  • Browsing session: 8 hours from the last page opened.
  • Proof of cookie consent: 24 months — the 12 for which the choice is valid plus 12 to be able to answer any dispute.
  • Google Analytics 4 statistics: 14 months.
  • Record of who changed what in the editorial panel: 180 days.
  • Photographs and the names attached to them: as long as the image stays in the public archive.
  • Face templates of players and staff: as long as consent stands — on withdrawal, or when the person leaves the club, the editorial team deletes them along with the links made by recognition.

Your rights

You may ask at any time to access your data, correct it, erase it, restrict its processing, receive it in a readable format or object to the processing (Articles 15-22 GDPR), and you may withdraw any consent you have given. Write to [email protected]: we reply within one month. If you believe the processing breaches the Regulation, you may lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

Cookies

Which cookies the site actually uses, and what they are for, is set out in the Cookie Policy: that list is not written by hand — an automated scan of the site keeps it up to date.