Privacy Policy

This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (“Privacy Code”), as amended by Legislative Decree 101/2018, to everyone who visits www.modasportfolgaria.it (the “Website”). It applies only to this Website and not to other websites that may be reached through links.

Data controller

Moda Sport di Clignon Stefano & C. S.a.s. · VAT No. IT01077630224 · REA TN-113960
Loc. Costa di Folgaria, Via Andrea Maffei 161, 38064 Folgaria (TN), Italy
Phone: +39 0464 721321 · E-mail: info@modasportfolgaria.it

Where data are processed

The Website is hosted by Aruba S.p.A. (Ponte San Pietro, Bergamo, Italy) on servers located in Italy. Aruba acts as data processor under Article 28 GDPR, on the basis of the hosting service agreement. Data are processed by the controller’s authorised staff and, when necessary, by those responsible for the technical maintenance of the Website, who are also bound by confidentiality.

What data we process and why

1. Technical browsing data (server logs)

Like any web server, the servers hosting the Website automatically record some technical data for each request: IP address, date and time, requested page, response code, browser type and operating system. These data are used only to run the Website, keep it secure and detect any abuse or cyber attack, and are not used to identify visitors. They may be used to establish liability in the event of cyber crimes against the Website.

Legal basis: the controller’s legitimate interest in the security and proper functioning of the Website (Art. 6(1)(f) GDPR).
Retention: for the time strictly necessary as set by the hosting provider for security purposes, unless needed to investigate crimes.

2. Visit statistics

To understand how the Website is used and to improve it, we use a statistics system installed on our own servers, without third-party services. The system:

• does not use cookies or other technologies that store or read information on the user’s device;
• does not record the IP address;
• does not create profiles and does not track users over time or across other websites.

At the time of the visit, the IP address and browser type are used only for an instant, without being stored, for two purposes: to determine the country of origin through a database consulted on our servers, and to calculate a session code with a one-way cryptographic function and a random key that changes every 24 hours. The previous day’s key is destroyed: from that moment the code can no longer be linked to the IP address or to visits on other days, not even by the controller. The code is used only to understand which pages were viewed during the same visit.

The following are recorded: pages visited and visit duration, referring site (e.g. a search engine or social network), any promotional campaign code in the link, date and time, device type (computer, tablet, smartphone), browser and operating system in generic form, country, clicks on links to other websites and file downloads. The data are viewed only in aggregate form (for example “120 visits from smartphones”), are not disclosed to third parties and are not used for decisions concerning individual users.

Legal basis: the controller’s legitimate interest in knowing how the Website is used in order to improve it (Art. 6(1)(f) GDPR). Consent is not required: the system does not use cookies, is managed directly by the controller, produces only aggregate statistics and does not combine the data with other information, so it is comparable to the technical tools covered by the Italian Data Protection Authority’s Guidelines on cookies and other tracking tools of 10 June 2021.
Retention: 36 months, after which the data are deleted automatically. Backup copies are kept for a maximum of 12 months.
Users may object at any time: if the “Do Not Track” or “Global Privacy Control” option is active in the browser, the system records nothing. Alternatively, users can block scripts or write to the controller.

3. Requests by e-mail, phone or WhatsApp

If users write to the e-mail addresses shown on the Website, call us or send a WhatsApp message, we process their contact details and whatever they voluntarily tell us, only to reply to their request. WhatsApp messages pass through the service of WhatsApp Ireland Ltd., which processes them as an independent controller under its own privacy policy.

Legal basis: steps taken at the request of the data subject (Art. 6(1)(b) GDPR) and legitimate interest in replying to communications received (Art. 6(1)(f) GDPR).
Retention: for the time needed to handle the request and then for no longer than 24 months, unless required by law or to protect the controller’s rights.

4. Online ski rental quote and booking

The Online Quote & Booking page contains the booking form provided by WINTERSTEIGER AG (Ried im Innkreis, Austria), the management system we use for rentals. The form is loaded when that page is opened: from that moment the service receives the user’s IP address and may use the technical cookies it needs to work. The data entered in the form (for example name, contact details, dates and equipment requested) are used to calculate the quote and manage the booking.

Legal basis: pre-contractual steps and performance of the rental contract requested by the data subject (Art. 6(1)(b) GDPR).
Retention: for the time needed to manage the rental and then as required by tax and accounting obligations.

5. Google Maps

Some pages offer a Google Maps map (Google Ireland Ltd., Gordon House, Barrow Street, Dublin, Ireland). The map is not loaded automatically: it is shown only if the user clicks “Show the map”. Only from that moment does Google receive the user’s IP address and may use cookies and similar technologies, as an independent controller, according to its own privacy policy.

Legal basis: consent of the data subject, given by clicking (Art. 6(1)(a) GDPR). Users who do not wish to load the map can use the link to open the address directly on Google Maps.

Fonts and other external services

Fonts are hosted on our own servers and are not downloaded from external services. Links to social media pages (Instagram, Facebook), to Google Maps and to the padel court booking website (Playtomic) are simple links: no data are sent to those services until the user opens them.

Summary

Recipients of the data

Data are not disclosed to the public or sold. They may be processed, only for the purposes described above, by Aruba S.p.A., the hosting provider appointed as data processor, by WINTERSTEIGER AG, provider of the rental booking system, and by authorised staff. They may also be disclosed to the competent authorities where required by law.

Transfer of data outside the European Union

The Website and the statistics system are hosted on servers in Italy; the Wintersteiger booking system operates in the European Union. Transfers to the United States may occur only for:

• Google Maps, only if the user chooses to load the map;
• WhatsApp, only if the user chooses to contact us through this service.

Both providers participate in the EU-U.S. Data Privacy Framework.

Provision of data

Providing data by e-mail, phone, WhatsApp or through the booking form is optional; without these data, however, we cannot reply to the request or manage the booking. Technical browsing data and statistical data are collected automatically as described above. No automated decision-making or profiling takes place.

Security

Data are processed with IT tools and with appropriate technical and organisational measures to prevent loss, unlawful or improper use and unauthorised access: encrypted connection (HTTPS), password-protected reserved areas of the Website and of the statistics, data folders not accessible from the web, periodic backup copies.

Rights of the data subject

Users may exercise at any time the rights provided by Articles 15–22 GDPR:

• access to their data and information on how they are processed;
• rectification of inaccurate or incomplete data;
• erasure of data;
• restriction of processing;
• portability of the data provided, where applicable;
• objection to processing based on legitimate interest;
• withdrawal of consent, without affecting the lawfulness of processing carried out before.

For visit statistics, since the system does not keep the IP address or any other data that would allow users to be recognised, the controller is not able to identify the data of a specific person (Art. 11 GDPR), unless the data subject provides additional information that allows it.

Requests should be sent to info@modasportfolgaria.it or by post to the controller’s address. We will reply within one month, which may be extended in the cases provided by Art. 12 GDPR.

Users also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the country where they live or work.

Cookies

The Website does not use profiling or advertising cookies. The only third-party cookies are those of Google Maps, activated only if the user chooses to load the map, and the technical cookies of the Wintersteiger booking form, on its dedicated page. For details, see the Cookie Policy.

Changes

This notice may be updated, for example when new services are added or regulations change. The version in force is always the one published on this page.

Last updated: 30 October 2026