Privacy policy
How Cloud Nine a.s.d. handles the personal data of people who visit www.cloudnineasd.com. The site asks for no data, sells nothing, and uses no analytics or profiling tools.
Last updated:
What this notice covers
This page explains how the personal data of people visiting www.cloudnineasd.com is handled. It covers the website and nothing else.
The association's activities that do not go through this site — membership, sports registration, medical certificates, running the classes, events and competitions — are handled separately and come with their own notice at the moment the data is collected. This page neither replaces nor describes them.
There are no forms to fill in on this site, no student accounts, no sales, no payments and no newsletter sign-up. Anyone who wants to get in touch uses the published contact details and picks their own channel.
Who is responsible
The data controller is:
- Cloud Nine a.s.d.
- Registered office: Via dei Frentani, 2A — 66023 Francavilla al Mare (CH), Italia
- Tax code: 93062100693
- Email: cloudnineasd@gmail.com
- Phone: +39 371 384 1717
The controller has not appointed a Data Protection Officer. Any request about personal data can be sent to the email address above.
What data is involved
The site does not ask you to identify yourself and collects nothing you have not chosen to give. Four categories of information remain:
- Technical connection data. Every time a browser requests a page or an image, the providers that serve the site record in their logs the IP address, the browser and operating system, the address requested, the date and time, and the outcome. This is what makes the site work and keeps it protected.
- Preferences stored in your browser. The language you chose, whether you chose to load the map, and whether you have already seen a workshop notice. They stay on your device; the Cookie policy lists each one.
- Whatever you write or say to us. Only if you decide to get in touch by email, phone, WhatsApp or social network.
- The credentials of whoever administers the site. These concern the association, not visitors.
The site does not handle special categories of data — health, beliefs, biometric data — and never asks for them through these pages.
Purposes, legal bases and retention
Every processing operation connected to the site, why it happens and how long it lasts.
| Purpose | Data | Legal basis | Nature | Retention | Recipients |
|---|---|---|---|---|---|
| Serving the site's pages, images and video, and protecting it from abuse and malfunction | Technical connection data: IP address, user agent, address requested, date and time, outcome | The controller's legitimate interest in delivering and securing its own website (Art. 6(1)(f) GDPR) | Necessary: without this data the browser cannot receive the pages | The logs stay with the providers, who keep them as long as their contracts require for security and diagnostics. The controller does not consult them routinely and keeps no copy | Vercel, ImageKit |
| Remembering whether you are reading the site in Italian or English | NEXT_LOCALE technical cookie | Technical tool necessary to deliver the service you requested (Art. 122 of the Italian Privacy Code); no consent required | Necessary for a bilingual site to work | Lasts as long as the browser session: cleared when you close it | None: it stays between your browser and the site |
| Not showing you a workshop notice twice in the same visit | cn-special-seen value in sessionStorage | Technical tool (Art. 122 of the Italian Privacy Code); no consent required | Necessary to avoid repeating the same notice | Until you close the browser tab | None: it stays on your device |
| Remembering that you chose to load the map, so you are not asked every time | cn:map-consent value in localStorage | Technical tool storing a choice you made explicitly (Art. 122 of the Italian Privacy Code) | Created only if you switch the map on | Until you withdraw the choice or clear the site's data in your browser | None: it stays on your device |
| Showing the interactive Google Maps map on the “Where we are” page | What your browser sends Google when the map loads: IP address, user agent, Google cookies and similar identifiers | Your consent, given by pressing “Show the map” (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code) | Optional: the map stays blocked until you ask for it, and the address and directions remain available without it | Your choice stands until you withdraw it. Data collected by Google is handled by Google under its own policies | |
| Replying to people who write, call or message us | The contact details you write from and the content of your message | Responding to your request and pre-contractual steps (Art. 6(1)(b) GDPR); for enquiries unrelated to joining, the legitimate interest in replying (Art. 6(1)(f)) | Optional: you decide whether, when and through which channel to contact us | For as long as it takes to handle your request and the conversations attached to it. If you then join as a member or student, retention follows the separate notice you receive at that point | The operator of the channel you pick: Meta for WhatsApp, Instagram and Facebook; your email provider and ours for email |
| Letting whoever runs the site update its content in a protected area | The administrator's email address and technical session cookies | The controller's legitimate interest in keeping its own site up to date and its access protected (Art. 6(1)(f) GDPR) | Restricted: it concerns site administrators, not visitors | The session lasts while the administrator stays signed in and ends when they sign out | Supabase |
How the site actually works
Pages are generated by servers operated by Vercel. Your browser's request enters through a European point of presence and is processed in the project's execution region, which is currently Vercel's default one, in the United States (Washington, D.C.).
Editable content — courses, timetable, texts, contact details — is held in a Supabase database hosted in Ireland. Photographs and video are delivered by ImageKit: the browser requests them straight from ImageKit's servers, which therefore see the IP address of whoever is looking at the page.
Typefaces are served by the site itself rather than by Google's servers: opening a page does not make your browser contact Google Fonts.
The site uses no Google Analytics or other statistics package, no advertising pixel, no profiling tool, no heatmaps and no session recording. There is no embedded third-party content other than the map, which stays blocked until you ask for it. The links to Instagram, Facebook and WhatsApp are ordinary links: they load nothing until you open them.
If you write or call
The contact details published on the site are links, not forms: nothing is sent until you write or call. We use what you send only to reply to you and to handle your request. We do not use it to send you promotional messages and we do not pass it to anyone.
Getting in touch is not a general consent to the processing of your data: the legal basis is responding to your request, and it covers only that.
If you choose WhatsApp, Instagram or Facebook, your message passes through Meta's systems, which Meta operates as an independent controller under its own terms (WhatsApp, Meta). If you would rather not use them, email and phone remain.
The administration area
The site has an administration area behind a login, which the association uses to update content. Access is limited to expressly authorised accounts and public sign-up is switched off: visitors do not have and cannot create an account.
The technical detail of the protections is not described here, because publishing it would weaken them.
Who else handles this data
The site relies on external providers to work. Some act on the controller's behalf and on its instructions (processors); others decide for themselves how to use the data they receive (independent controllers), and in that case the relationship is between you and them.
| Provider | Service | Role | Where |
|---|---|---|---|
| Vercel | Hosting and delivery of the site | Processor | US company. European point of presence, processing in the default region in the United States |
| Supabase | Content database and authentication for the administration area | Processor | Database hosted in Ireland |
| ImageKit | Storage and delivery of photographs and video | Processor | International delivery network; the company states safeguards for transfers (see below) |
| Embedded map, loaded only at your request | Independent controller | Under Google's own policies | |
| Meta | WhatsApp, Instagram and Facebook, only if you choose that channel | Independent controller | Under Meta's own policies |
Data is not sold, traded or disclosed for marketing purposes, neither to these providers nor to anyone else.
Transfers outside the European Economic Area
The content database is hosted in Ireland, and therefore inside the European Economic Area.
Page rendering, on the other hand, runs on Vercel infrastructure in the United States. Vercel is a US company and acts as a processor under its own data processing addendum, which incorporates the European Commission's Standard Contractual Clauses (Vercel's DPA).
ImageKit states that it uses the Standard Contractual Clauses and participates in the EU-U.S. Data Privacy Framework (ImageKit's GDPR notice). Supabase states the Standard Contractual Clauses in its data processing addendum.
If you choose to load the map, the data your browser sends to Google is handled by Google under its own privacy policy and the safeguards stated there.
No profiling, no automated decisions
The site builds no profiles, does not track visitors' behaviour from one visit to the next, and makes no automated decisions producing legal effects or similarly significantly affecting people within the meaning of Art. 22 GDPR.
Your rights
To the extent they apply to the individual processing operation, you have the right to:
- know whether we handle data about you and obtain a copy of it (Art. 15);
- have it corrected or completed if it is inaccurate (Art. 16);
- ask for it to be erased (Art. 17);
- ask for it to be restricted (Art. 18);
- receive it in a machine-readable format, where the processing is based on consent or on a contract and is carried out by automated means (Art. 20);
- object to processing based on legitimate interest, on grounds relating to your particular situation (Art. 21).
Where a processing operation is based on your consent — on this site, only loading the map — you can withdraw it at any time and as easily as you gave it, from the Cookie policy or from the map page. Withdrawal does not affect the lawfulness of processing that already took place.
One thing should be said about technical browsing data: it does not identify you and we have no way of linking it to you. If you ask to exercise a right over that data we may have to ask you for further details to locate it, and where that is not possible some rights cannot be exercised (Art. 11 GDPR).
To exercise your rights, write to cloudnineasd@gmail.com. We reply without undue delay and in any case within one month, extendable in the cases set out in Art. 12 GDPR.
If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority or go to court.
Updates to this notice
If the site changes the way it handles data — a new provider, a new tool, a new feature — this page is updated and the date at the top changes. Earlier versions are not kept online: the current one is the one that applies.