Privacy notice

Controller and contact details

The controller is [First name Last name], an individual organising First Name Social Club in a personal capacity. Postal contact: [address, postcode, city, country to be completed]. Privacy email: privacy.fnsc.482731@example.invalid (inactive placeholder: do not send requests or personal data to this address).

Real contact details must also be provided for requests relating to browsing. Organising this initiative personally does not, by itself, exempt the controller from data protection duties.

Browsing and current service status

This version introduces the project. The questionnaire is empty, submission is disabled, and accounts, payments and application collection are not active. Browsing nevertheless involves technical data processed through Cloudflare Pages, such as IP addresses, browser information and page requests, to deliver and secure the website. Browsing is therefore not necessarily anonymous.

Applications: data, purposes and legal bases

The future form is intended to be limited to name, age, email, requested event and information relevant to organising the evening. Actual fields and mandatory information will be identified before submission. Applications will be used to assess participation, communicate outcomes and manage invitations and confirmations, without creating an account.

For these steps necessary to respond to the individual’s request, the proposed basis is Article 6(1)(b) GDPR. Without essential information, the request cannot be handled; optional fields may be left empty. Applications will be assessed personally, without solely automated decisions or algorithmic scoring.

Website delivery and security rely on the legitimate interest in providing and protecting the service (Article 6(1)(f)), to be documented through a balancing assessment. Any processing required by law will rely on Article 6(1)(c), with the applicable duties identified before that processing begins.

Confidentiality and special categories

The future questionnaire should avoid asking about health, religion, sex life or other special categories of data. Please do not include such information in any free-text answers. Identity documents and social media profiles will not be requested by default.

The dating context and expressed preferences may nevertheless reveal sexual orientation, including indirectly. It is therefore not assumed that all information is ordinary personal data: fields, selection criteria and data flows must be assessed before activation. Where Article 9 GDPR applies, a valid condition under that article will be needed in addition to an Article 6 basis.

Mutual interest and future communications

The service for indicating whom you would like to see again is not active and is separate from applying. Its data, recipients, deletion periods and specific notice will be defined before it is offered. The proposed approach is a separate optional choice, with explicit consent where required under Article 9(2)(a), and permission from both people to share their chosen contact details. Declining this service will not prevent attendance.

No newsletter or promotional communications are active. Updates about future evenings would require a separate optional choice, with the ability to withdraw. Reading a privacy notice does not amount to blanket consent.

Recipients, providers and international transfers

Future application data will be accessible to the controller and, where necessary, authorised people bound by confidentiality. Any form and email providers will be identified before activation, their roles clarified and required Article 28 GDPR agreements put in place. Only information strictly necessary for admission would be shared with the venue, where envisaged and described beforehand. Applications will not be published or disclosed to other guests.

Cloudflare currently provides website hosting and delivery. The contracting entity, enabled services, log retention and any transfers outside the EEA must be checked against the actual account. Exclusive European storage is not guaranteed. For any transfers, countries and applicable grounds will be specified, such as adequacy decisions or standard contractual clauses with necessary safeguards; information about safeguards will be available from the controller’s real contact address.

Retention

Operational proposal to confirm and implement before opening: delete unsuccessful applications within 90 days of communicating the outcome or closing selection; delete participants’ organisational data within 90 days of the evening. Any waiting list will be limited to the requested event unless the individual makes a separate choice.

These periods are proposed project choices, not general statutory deadlines. Only data needed for legal duties or disputes may be retained separately for the applicable period, to be specified by category. Technical log and backup retention must be verified with providers. No permanent candidate database is envisaged.

Browser storage and cookies

The code stores the chosen language in the browser’s localStorage under “fnsc-language”, until the user or browser clears the site’s data. The sessionStorage entry “fnsc-invitation-seen” prevents the welcome invitation from reappearing during the tab session. These entries contain no application answers and are not sent by the code to a profiling service.

The website code does not integrate analytics, advertising pixels or profiling cookies. Any Cloudflare technical features, including security cookies, depend on the actual configuration and must be checked on the deployed preview. You can clear local data in browser settings: the language choice will be forgotten and the invitation may reappear. Any non-essential tools will require assessment and, where applicable, prior consent.

Rights and requests

Where applicable, you may request access, correction, deletion, restriction and portability, and object to processing based on legitimate interests. Any consent can be withdrawn without affecting the lawfulness of earlier processing. Requests should be sent to the controller’s real contact address, which remains to be inserted; the placeholder cannot receive messages.

Requests will normally be answered within one month; any permitted extension will be explained within that period. You may lodge a complaint with the Italian Data Protection Authority or the competent authority under Article 77 GDPR.

References

GDPR · Garante: informativa · Garante: cookie · Cloudflare Privacy Policy.