Privacy & cookies
MYDA's notice on the processing of personal data, valid for enrolments, the MYDA app, the management system and the website www.myda.world.
IN SHORT MYDA uses data only to manage enrolment, courses, membership, safety, payments and necessary communications. Photos, videos and marketing require separate, optional consents.
1. Data controller
The data controller is MYDA SSD a r.l., with registered office at Via delle Olimpiadi 89, 67051 Avezzano (AQ), VAT no. 02120230665, tax code 90055030663, telephone +39 0863 420650, email [email protected], PEC [email protected].
Requests relating to the protection of personal data may be sent to the email address above or delivered to the MYDA premises at Via G. E. Palanza 91, Avezzano.
2. Data subjects
This notice concerns adult students, minor students, parents, guardians, persons authorised to collect students, emergency contacts and any other persons whose data is provided during enrolment or participation in MYDA activities.
3. Data processed
MYDA may process, within the limits necessary for the stated purposes:
- personal, tax and contact details of the student and of the parent or guardian;
- data relating to enrolment, the courses chosen, attendance, level and activities carried out;
- data necessary for CSEN membership, insurance coverage and sports administrative requirements;
- data relating to payments, due dates, receipts, and any refunds or credits;
- data of the persons authorised to collect the minor and of emergency contacts;
- information strictly necessary to verify fitness for sports activity and the validity and expiry of the medical certificate;
- communications sent to MYDA, support requests, reports and any attached documentation;
- images, voice and audio-video recordings solely in the cases and for the purposes covered by a specific notice and, where necessary, a separate consent;
- electronic signature data for documents (date and time, email address to which the code was sent, IP address, device type, fingerprint of the signed document);
- technical and usage data of the MYDA app, the website and the management system (logins, security logs, device identifier for notifications).
4. Purposes and legal bases
4.1 Enrolment and delivery of courses
Data is processed to manage enrolment requests, assignment to courses, the calendar, attendance, service communications, payments, receipts, withdrawals and any activity necessary for the performance of the relationship with MYDA. The legal basis is the performance of pre-contractual measures and of the contract, pursuant to art. 6(1)(b) GDPR.
4.2 Membership, insurance and legal obligations
Data is processed for CSEN membership, insurance coverage, administrative, tax and accounting requirements and those connected with the National Register of Amateur Sports Activities, as well as to respond to requests from the competent authorities. The legal bases are the performance of the sports relationship and compliance with legal obligations, pursuant to art. 6(1)(b) and (c) GDPR.
4.3 Protection of health and safety
Information on sports fitness and the validity of the medical certificate is processed solely to the extent necessary to verify the health requirements for participation. The processing is based on the applicable obligations on the health protection of sports activities and on the conditions set out in arts. 6 and 9 GDPR and in national law. MYDA avoids collecting unnecessary clinical information and limits access to authorised persons only.
4.4 Safety, protection of rights and handling of reports
Data may be processed to prevent risks, handle injuries or emergencies, protect people and property, establish or defend a legal claim and handle disciplinary or safeguarding reports. The legal bases are legal obligation, MYDA's legitimate interest in safety and in protecting its rights and, for special categories of data, the applicable conditions under art. 9 GDPR.
4.5 Photos, videos and promotional communications
Promotional publication of photos or videos and the sending of commercial communications not necessary for running the courses take place only on the basis of specific, separate and optional consents. Refusing consent does not prevent enrolment or attendance.
5. Nature of the provision of data
Providing the data necessary for enrolment, membership, safety, payments and legal obligations is mandatory. Failure to provide it may make it impossible to complete enrolment, activate membership or allow participation in activities. Providing data for photos, promotional videos and marketing is optional.
6. Processing methods and security
Processing is carried out with paper and digital tools, in compliance with the principles of lawfulness, fairness, transparency, minimisation, accuracy, storage limitation and security. MYDA adopts appropriate organisational and technical measures and authorises access to data according to the duties actually performed: for example, teachers see only the data of their own courses and front desk staff do not see amounts and documents.
7. Digital tools and suppliers
MYDA manages enrolments, records, documents, signatures, consents, calendar, communications, payments and receipts with its own tools: the MYDA app, the website www.myda.world and the MYDA management system. To operate them it uses the following suppliers, which process data on behalf of MYDA as data processors (art. 28 GDPR):
- Supabase: database, document archive and functions of the management system and the app, with servers in the European Union (Frankfurt);
- Cloudflare: hosting of the website and the management system, network security and images;
- Resend: sending of service emails (signature codes, copies of documents, receipts, notices);
- Expo, together with the Apple and Google notification services: sending of app notifications;
- Google Workspace: the front desk email inbox;
- Anthropic: internal assistant used only by staff to consult management system data. Minors' names are not sent: a code is used instead.
Online payments and card payments on the premises are handled by Stripe e SumUp, which process payment data as independent data controllers under their own privacy notices. Card data is never stored by MYDA.
Communications via WhatsApp take place only if the data subject has chosen them. The supplier's privacy notice applies to the operation of the WhatsApp (Meta) service.
8. Recipients of data
Data may be disclosed, within the limits of their respective responsibilities, to:
- MYDA staff, teachers and collaborators expressly authorised;
- the IT suppliers listed in section 7, appointed as data processors;
- CSEN, and bodies in charge of membership, insurance coverage and management of the National Register of Amateur Sports Activities;
- payment institutions (Stripe, SumUp) and banks;
- accountant, consultants, legal advisers, insurers, photographers, videomakers and service providers, within the limits necessary and according to the applicable privacy role;
- healthcare facilities, emergency services, and judicial, administrative or sports authorities in the cases provided for by law.
Data is not sold. The updated list of data processors can be requested from MYDA.
9. Transfers outside the European Economic Area
The main database is located in the European Union. Some of the suppliers listed in section 7 (for example Cloudflare, Resend, Expo, Google, Anthropic, Stripe) are based in, or have infrastructure in, the United States or use sub-processors outside the European Economic Area. In such cases the transfer takes place on the basis of the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), standard contractual clauses or other safeguards provided for by arts. 44 et seq. GDPR. Updated information can be requested from MYDA.
10. Retention periods
- contractual, administrative, tax and payment data: for the duration of the relationship and, as a rule, for ten years after its end, unless there are disputes or different legal obligations;
- signed documents and electronic signature data: for the same period as the documents to which they refer;
- membership and insurance data: for the period provided by the rules of the sports body, the Register and the insurance coverage;
- information on the medical certificate: for the time necessary to verify its validity and expiry and, afterwards, only where necessary for legal obligations or the protection of rights;
- data contained in safeguarding or disciplinary reports: for the time necessary for handling them and protecting the persons involved and MYDA's rights, with strictly limited access;
- trial class data of those who do not enrol: 12 months; health notes given for the trial are deleted immediately after the class;
- data processed for marketing: until consent is withdrawn and in any case subject to periodic review, as a rule not beyond twenty-four months from the last interaction;
- photos and videos: according to the periods stated in the relevant release and, for future uses, until withdrawal.
11. Rights of the data subject
In the cases provided for, the data subject may request access, rectification, erasure, restriction, data portability and object to processing. They may also withdraw at any time any consent given, including from the MYDA app, without affecting the lawfulness of processing carried out before the withdrawal. Requests can be sent to [email protected].
12. Complaints
The data subject may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), as described on the website www.garanteprivacy.it, or apply to the competent judicial authority.
13. Minors
For minor students, the information is provided to those exercising parental responsibility or guardianship. MYDA asks parents and guardians to provide only accurate, up-to-date data relating to persons they are authorised to indicate.
14. Updates
This notice may be updated due to legislative, organisational or technological changes. Significant changes will be communicated through the MYDA app, email or other official MYDA channels. The version in force is always available at www.myda.world/privacy and in the app.
MYDA website and app: practical details
These notes complement the notice above for those who use the MYDA website and app.
Website forms and newsletter. With the contact, trial class and newsletter forms we collect your name, phone, email and message, only to respond to your request. The newsletter is sent only if you ask for it and you can unsubscribe at any time. For shop orders and tickets we use your name, email, phone and, if you choose shipping, your address.
Login with an email code. No password is needed to enter the app: enter your email and receive a code that is valid for a short time. We use your email only to recognise you and link you to your students.
Tax code. At enrolment we collect the tax code of the student and of the parent or whoever pays. It is needed for enrolment, membership and receipts, which the parent can use to claim the deduction for sports expenses of children aged 5 to 18.
Notifications. If you allow them, the app receives notifications about classes, due dates, payments and communications. You can turn them off at any time from your phone settings.
WhatsApp notices. Only if you choose it (optional consent, which you give or withdraw in the app or at the front desk) we send you school notices on WhatsApp. You can withdraw it from the app, by replying STOP to one of our messages or by writing to [email protected]. Without consent, notices arrive in the app or by email.
Medical certificate. The certificate uploaded from the app is kept in a private archive, accessible only to the MYDA front desk and management.
Account deletion. You can delete your account from the app, in your profile, or by writing to [email protected]. We delete app access, devices registered for notifications and data no longer needed; only the data we are legally required to keep remains, for the period provided (section 10).
Internal assistant. The Anthropic assistant mentioned in section 7 is used only by authorised MYDA staff to consult management system data. It does not make decisions about you or your children: every communication is reviewed and sent by a person. You can object by writing to [email protected].
Cookies and local storage
The website uses only technical tools necessary for its operation (for example to remember the cart). Visit statistics are anonymous and cookie-free (Cloudflare Web Analytics). Fonts are hosted on the site: no visitor data goes to Google. We do not use advertising profiling cookies.