Privacy and Cookie Policy
Last updated: 2 November 2026
This notice describes how the personal data of people who visit the website and use the contact forms is processed. Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended).
1. Data controller
Comitato Territoriale A.C.S.I. Milano APS
Via Giuseppe Govone 100 — 20155 Milan, Italy
Tax code: 97404140150 — VAT number: 14351660965
Registered with RUNTS (Italian National Third Sector Register), file no. 106920
Legal representative: Giuseppe Garatti
Email: milano@acsi.it — Phone: +39 02 36725350 — Certified email (PEC): acsimilano@legalmail.it
The website uses the public name “ACSI Lombardia”.
2. Personal data collected and collection methods
The website is informational/institutional. No public accounts, newsletter subscriptions, comments, payments or profiling are provided.
Data provided directly by users is collected through the contact forms on the home page, on the Contacts page and on the training pages. The fields are:
- Name (required)
- Email (required)
- Phone (optional)
- Subject (required)
- Message (required)
- Sport/training context (technical/optional data, sent if the form is submitted from a specific page)
The message may freely contain any information the user decides to include. The website does not intentionally collect data about minors; if such data is voluntarily provided, it will be processed according to the rules of this notice.
Technical browsing data
Servers may record logs containing IP addresses and connection or email metadata, for security, abuse prevention and maintenance purposes. These logs are not used for profiling. The contact form’s anti-spam rate-limit mechanism (maximum 5 messages per IP in 10 minutes) operates in memory and does not store the IP address in the database.
No analytics tools, advertising pixels, embedded maps, third-party videos or social widgets are used.
3. Purposes and legal bases of processing
| Purpose | Legal basis | Notes |
|---|---|---|
| Replying to requests sent via the contact forms (contact, information about sports, training, events, etc.) | Art. 6(1)(b) GDPR for requests concerning services or pre-contractual measures; art. 6(1)(f) GDPR for general information requests (legitimate interest in replying to and assisting the user) | The applicable legal basis depends on the nature of the request |
| Website security, abuse and spam prevention, system log management | Art. 6(1)(f) GDPR (legitimate interest in the security and integrity of the service) | Logs limited to what is necessary for maintenance |
| Storing the light/dark theme preference and technical management of the administrative session | Art. 6(1)(f) GDPR (legitimate interest in ensuring service continuity and functionality) | Technical cookies, see Cookie Policy |
| Compliance with legal or statutory obligations of the association, where applicable to the requests received | Art. 6(1)(c) GDPR | Only if relevant to the content of the message |
No automated decision-making or profiling within the meaning of art. 22 GDPR is carried out.
4. Recipients of data and data processors
The data entered in the form is:
- stored in the database hosted on the same VPS as the website;
- sent by transactional email (via a self-hosted mail server) to milano@acsi.it and media@acsilombardia.com;
- made visible to authenticated administrators in the reserved area.
Technical suppliers and possible processors (art. 28 GDPR):
- Hostinger VPS hosting (application, database and self-hosted mail server), with datacenter in the European Union (Germany). Processing is governed by the supplier’s data processing agreement (Data Processing Addendum) (Hostinger International Ltd., Cyprus — EU).
- Cloudflare (currently DNS only). If the proxy/WAF is activated in the future, the processing of connection data would change and this notice will be updated.
- External technician/maintainer with operational access to the data for maintenance: Carlos H. P. Ross (self-employed professional, VAT registered).
No data is disclosed to third parties for marketing or profiling purposes. External links to committee, sports club, Facebook, Instagram or YouTube sites lead to third-party platforms, whose privacy notices apply.
Non-EU transfers: the main infrastructure is self-hosted on servers located in the European Union and no transfers of personal data outside the EEA are envisaged.
5. Retention period
- Contact messages: the reference retention period is 24 months from receipt; messages beyond this period are automatically deleted upon the next form submission or opening of the reserved messages area.
- System and security logs: retained for short technical periods with automatic rotation (system logs up to 7 days; web and email service logs with automatic size-based rotation; other operational logs up to 4 weeks).
- Backups: periodic security copies of the website (database and media) stored on the computer of the technician/maintainer (Carlos H. P. Ross) in Italy; the latest 14 daily backups and the latest 24 monthly backups are kept; excess copies are automatically deleted.
- Technical cookies: see Cookie Policy (theme: 1 year; admin session: 12 hours; language: session).
At the end of the period the data is deleted or anonymised, unless legal obligations require longer retention.
6. Data subject rights
Under articles 15-22 GDPR, the data subject may exercise the following rights:
- access to data;
- rectification;
- erasure (“right to be forgotten”);
- restriction of processing;
- portability (where applicable);
- objection to processing based on legitimate interest;
- withdrawal of consent (if given; consent is currently not required for the processing described).
To exercise your rights, write to milano@acsi.it. The controller will respond within one month (art. 12 GDPR), extendable by a further two months in complex cases.
You may also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of your habitual residence.
7. What this website does not do
- It does not use Google Analytics, Matomo, Plausible, Meta Pixel or other tracking tools.
- It does not carry out advertising or behavioural profiling.
- It does not embed Google Maps, YouTube videos, social iframes or third-party widgets.
- It does not make automated decisions producing legal or similarly significant effects.
- It does not require consent for profiling cookies, because it does not use any.
8. Changes to this notice
This notice may be updated. The current version is always published on this page. In case of substantial changes, the update date will be indicated.
Cookie Policy
Last updated: 2 November 2026
This Cookie Policy supplements the Privacy Notice and describes the client-side storage tools used by the website, in accordance with the Italian Data Protection Authority’s Guidelines of 10 June 2021 on the use of cookies and other tracking tools, and with art. 122 of the Privacy Code.
1. General principle
The website uses only technical cookies and tools strictly necessary for the operation of the service explicitly requested by the user or for the transmission of a communication over an electronic communications network.
Under art. 122, paragraph 1, of the Privacy Code and the Authority’s Guidelines (10 June 2021), technical cookies do not require the user’s consent, but must be described in the notice.
No profiling, advertising, third-party analytics cookies or other non-technical tracking tools are present.
2. Inventory of storage tools
| Name | Type | Purpose | Duration | Notes |
|---|---|---|---|---|
theme | Cookie | Light/dark theme preference, also read server-side to avoid a visual flash on load | 1 year | SameSite=Lax. Contains no identifying data. Technical. |
theme | localStorage | Client-side fallback for the same theme preference | Persistent until manually deleted | Not sent to the server as a separate cookie. |
acsi_admin | Cookie | Authenticated session of the reserved administrative area | 12 hours | HttpOnly, SameSite=Lax, Secure in production. Used by administrators only. |
NEXT_LOCALE | Cookie | Language preference, set when visiting the English pages | Session (expires when the browser is closed) | SameSite=Lax. Technical. Bilingual navigation mainly uses the paths / (IT) and /en. |
3. No consent banner
Since only technical cookies are used, no consent banner is required (Authority’s Guidelines, 10 June 2021: when only technical cookies are used, the information may be placed on the home page or in the general notice, without a pop-up banner).
If non-technical cookies are introduced in the future, a compliant banner will be implemented and this policy will be updated.
4. How to manage or delete cookies
You can delete cookies and localStorage data at any time from your browser settings. Deleting the theme cookie or the localStorage entry will restore the default theme. Deleting the acsi_admin cookie will sign you out of the administrative area.
General instructions:
- Chrome / Edge: Settings → Privacy and security → Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
5. Updates
This Cookie Policy may be amended in case of technical changes. The updated version will always be available on this page.