Privacy Policy
How personal data is handled when you visit this website or send a message through the contact form.
Data controller
The controller of the personal data collected through the website sportmentalcoaching.org is Fausto Donadelli, a self-employed professional based in Lugano, Switzerland.
For questions about data protection or to exercise your rights, write to info@sportmentalcoaching.org. The same address is used for general inquiries.
What this policy covers
This policy describes how personal data is processed when you visit the website, send the contact form or write by email. Information on cookies and similar technologies is in the Cookie Policy.
This policy does not describe how data is processed during an ongoing coaching engagement, which is part of the professional relationship with the controller. If you have questions about that data, write to info@sportmentalcoaching.org.
Applicable law
The controller works in Lugano, Switzerland. Processing is governed by the Swiss Federal Act on Data Protection (FADP) and its Ordinance (DPO).
The website is also aimed at people in the European Union. If and to the extent that the EU General Data Protection Regulation (GDPR) applies to specific processing, the GDPR provisions referred to in this policy also apply.
What data is processed
- Usage data: when you visit the website, the server hosting it automatically logs technical data such as your IP address, the date and time of the request, the page requested, the result of the request, your browser and operating system, and the referring page.
- Data sent through the contact form: first and last name, email address, who is writing if you choose to say (athlete, coach or technical staff, team or club, parent, other), the text of your message, the language of the form, and your confirmation that you have read this policy, together with the version you read.
- Data used to protect the form from misuse: a pseudonym derived from your IP address and the times of your requests (see “Contact form”).
- The content of emails you send directly to info@sportmentalcoaching.org.
The website does not use analytics, advertising, profiling or social plugins, and it does not store any information in your browser.
In the contact form, you only need to include the information required to submit your request. Please do not include health data or other particularly sensitive information. If you share it anyway, for example in the free-text field or in an email, it is used only to respond to your request; in the controller’s practice, it is not collected in dedicated records.
Contact form
Before sending, you are asked to confirm that you have read this policy and would like to be contacted regarding your inquiry. This confirmation records that you have read the policy and that you asked to be contacted: it is not consent to receive promotional communications and does not authorize indefinite storage of your data. The legal basis for the processing is set out in the “Purposes and legal bases” section.
When you submit the form, the data is sent over an encrypted connection to the server that hosts the website, operated by Keliweb S.r.l. (Italy). A program on the server checks the data and sends the message, by signing in to the mail server, to info@sportmentalcoaching.org. No external form-processing service is used, and the message is not stored on the website’s server.
The info@sportmentalcoaching.org mailbox is hosted by Keliweb. Requests are not entered into a CRM system or stored in a dedicated database.
To protect the form from automated submissions and misuse, the server limits how many messages can be sent within ten minutes. For this purpose it does not store your IP address in plain form, but a code derived from it with a cryptographic function (HMAC-SHA-256) and a secret key kept only in the server configuration, together with the times of your requests. This code is a pseudonym, not encryption or anonymization: it does not directly reveal your IP address, but anyone who has the key can check whether a given IP address matches the code.
This data is kept in an area of the server that cannot be reached from the web and is not used for any other purpose. Records older than ten minutes are deleted automatically the next time any visitor submits the form; until then, they may remain on the server.
Minors
Coaching services may also involve minors, for example young athletes. Minors do not normally contact the controller directly through the website: contact is initiated by their parents or legal guardians, and the professional agreement is made with them.
If you are writing on behalf of your minor child, include only the information needed to submit your request. A minor’s data is processed for the same purposes and with the same care described in this policy. The fact that the agreement is made with the parents does not remove the protection of the minor’s personal data.
Purposes and legal bases
| Purpose | Data | Legal basis (GDPR, to the extent it applies) |
|---|---|---|
| Responding to your request and assessing a possible coaching engagement | Contact form, email | Steps taken at your request before entering into a contract (Art. 6(1)(b)); for follow-up communications, legitimate interest in handling correspondence (Art. 6(1)(f)) |
| Running the website, keeping it secure and preventing misuse | Usage data | Legitimate interest (Art. 6(1)(f)) |
| Protecting the contact form from automated submissions and misuse | IP address pseudonym, request times | Legitimate interest in the security of the website (Art. 6(1)(f)) |
The FADP does not generally require a legal basis for each processing activity, but it requires compliance with its principles, including lawfulness, good faith, proportionality, a recognizable purpose, accuracy and data security.
Service providers and recipients
The data is accessible to the controller and, to the extent needed to provide its services, to the following provider:
- Keliweb S.r.l. (Italy): hosting of the website and of the info@sportmentalcoaching.org mailbox, sending of contact form messages, server logs.
Data may be disclosed to authorities only where required by law.
International data transfers
Data may be disclosed to Italy (Keliweb). The Swiss Federal Council recognizes Italy as providing an adequate level of data protection (Annex 1 to the Data Protection Ordinance). If the GDPR applies, Italy is a member state of the European Union.
Data retention
Personal data collected through the contact form is retained for as long as necessary to handle your request and any related follow-up communications, unless a longer retention period is required by applicable law.
Any logs, backups or other technical copies held by the provider are retained according to the settings and terms of its service. According to its privacy policy, Keliweb keeps email traffic data for six months for ordinary operations and for up to six years for the detection and prosecution of crimes.
Usage data is retained by the hosting provider for the period set in its configuration. Data used to protect the form from misuse is deleted as described in the “Contact form” section.
Your rights
Under the FADP, you can in particular:
- ask whether personal data about you is being processed and receive the related information (right of access);
- ask for inaccurate data to be corrected;
- ask for your data to be deleted, or object to its processing;
- ask to receive the data you provided, or to have it transferred, in a common electronic format, where the law provides for this.
To the extent that the GDPR applies, you also have the right to restrict processing, to object to processing based on legitimate interest and to receive your data in a structured format (data portability).
In Switzerland, you can contact the Federal Data Protection and Information Commissioner (FDPIC). If the GDPR applies, you can lodge a complaint with a supervisory authority in the European Union, in particular in the country where you live or work or where the alleged infringement took place.
How to exercise your rights
Write to info@sportmentalcoaching.org describing your request. To protect your data, your identity may need to be verified. You will receive a response within the time limits set by applicable law.
Security
The website is served over an encrypted connection (HTTPS). It consists of static pages and a single program on the server that handles the contact form, and it does not use a database.
The security of data held by external providers also depends on the measures each of them takes.
Third-party services
The website does not embed third-party content such as videos, maps, calendars or social plugins. The fonts are also hosted on the website’s own server: when you visit the pages, your browser does not send requests to external services.
Automated decision-making
The website does not make decisions based solely on automated processing, and no profiling takes place.
Changes to this policy
This policy may be updated, for example if the services used by the website change. The current version is always published on this page, together with its version number and the date of the last update.
This policy is available in Italian and English. In case of any discrepancy, the Italian version prevails.