Privacy Policy

The controller of the personal data collected through the website www.donadelli.eu is Fausto Donadelli, a self-employed professional based in Lugano, Switzerland.

For questions about data protection or to exercise your rights, write to info@donadelli.eu. The same address is used for general inquiries.

This policy describes how personal data is processed when you visit the website, send the contact form, book a call or write by email. Information on cookies and similar technologies is in the Cookie Policy.

This policy does not describe how data is processed during an ongoing coaching engagement, which is part of the professional relationship with the controller. If you have questions about that data, write to info@donadelli.eu.

The controller works in Lugano, Switzerland. Processing is governed by the Swiss Federal Act on Data Protection (FADP) and its Ordinance (DPO).

The website is also aimed at people in the European Union. If and to the extent that the EU General Data Protection Regulation (GDPR) applies to specific processing, the GDPR provisions referred to in this policy also apply.

• Usage data: when you visit the website, the server hosting it automatically logs technical data such as your IP address, the date and time of the request, the page requested, the result of the request, your browser and operating system, and the referring page.
• Data sent through the contact form: first and last name, email address, category (athlete, manager or executive, team or club, private individual), the text in which you describe your goal, the language of the form, and your confirmation that you have read this policy, together with the version you read.
• Data used to protect the form from misuse: a pseudonym derived from your IP address and the times of your requests (see “Contact form”).
• Booking data: the data you enter on the Google Calendar booking page, such as your name, email address and the time slot you choose.
• The content of emails you send directly to info@donadelli.eu.
• Your choice about third-party content, stored in your browser.

The website does not use analytics, advertising, profiling or social plugins.

In the contact form, you only need to include the information required to submit your request. Please do not include health data or other particularly sensitive information. If you share it anyway, for example in the free-text field, in an email or in a booking, it is used only to respond to your request; in the controller’s practice, it is not collected in dedicated records.

Before sending, you are asked to confirm that you have read this policy and would like to be contacted regarding your inquiry. This confirmation records that you have read the policy and that you asked to be contacted: it is not consent to receive promotional communications and does not authorize indefinite storage of your data. The legal basis for the processing is set out in the “Purposes and legal bases” section.

When you submit the form, the data is sent over an encrypted connection to the server that hosts the website, operated by Keliweb S.r.l. (Italy). A program on the server checks the data and sends the message, by signing in to Keliweb’s mail server, to info@donadelli.eu. No external form-processing service is used, and the message is not stored on the website’s server.

The info@donadelli.eu mailbox is hosted by Keliweb. Incoming messages are automatically forwarded to a personal Gmail account (Google), from which the controller handles correspondence, so Google receives the content of forwarded messages. After forwarding, under the configuration set by the controller, messages are removed from the Keliweb mailbox. Requests are not entered into a CRM system or stored in a dedicated database.

To protect the form from automated submissions and misuse, the server limits how many messages can be sent within ten minutes. For this purpose it does not store your IP address in plain form, but a code derived from it with a cryptographic function (HMAC-SHA-256) and a secret key kept only in the server configuration, together with the times of your requests. This code is a pseudonym, not encryption or anonymization: it does not directly reveal your IP address, but anyone who has the key can check whether a given IP address matches the code.

This data is kept in an area of the server that cannot be reached from the web and is not used for any other purpose. Records older than ten minutes are deleted automatically the next time any visitor submits the form; until then, they may remain on the server.

Bookings are made through a Google Calendar appointment page. The data you enter is collected by Google and made available to the controller to arrange the appointment. Google’s terms and privacy policy also apply to Google’s processing.

On the website, the calendar is embedded only if you have accepted third-party content or choose to load it. You can also open it directly on Google, in a new tab.

The controller deletes booking information when it is no longer needed.

Coaching services may also involve minors, for example young athletes. Minors do not normally contact the controller directly through the website: contact is initiated by their parents, and the professional agreement is made with the parents.

If you are writing on behalf of your minor child, include only the information needed to submit your request. A minor’s data is processed for the same purposes and with the same care described in this policy. The fact that the agreement is made with the parents does not remove the protection of the minor’s personal data.

The FADP does not generally require a legal basis for each processing activity, but it requires compliance with its principles, including lawfulness, good faith, proportionality, a recognizable purpose, accuracy and data security.

The data is accessible to the controller and, to the extent needed to provide their services, to the following providers:

• Keliweb S.r.l. (Italy): hosting of the website and of the info@donadelli.eu mailbox, sending of contact form messages, server logs.
• Google (for users in Switzerland and the European Economic Area, Google Ireland Limited, Ireland, together with Google LLC, United States): Gmail, to which incoming messages are forwarded; the booking calendar (Google Calendar, which also uses Google reCAPTCHA); video playback (YouTube, in privacy-enhanced mode on youtube-nocookie.com).

Google also processes this data under its own terms and privacy policy. Data may be disclosed to authorities only where required by law.

Data may be disclosed to the following countries:

• Italy (Keliweb) and Ireland (Google Ireland Limited): the Swiss Federal Council recognizes these countries as providing an adequate level of data protection (Annex 1 to the Data Protection Ordinance).
• United States (Google LLC): Google states that it participates in the Swiss-U.S. and EU-U.S. Data Privacy Frameworks and that it relies on standard contractual clauses where required. Since September 15, 2024, the Swiss Federal Council has recognized an adequate level of data protection for U.S. organizations certified under the Swiss-U.S. Data Privacy Framework.

If the GDPR applies: Italy and Ireland are member states of the European Union; for the United States, the European Commission adopted an adequacy decision on July 10, 2023, for organizations certified under the EU-U.S. Data Privacy Framework.

Personal data collected through contact and booking forms is retained for as long as necessary to handle your request and any related follow-up communications, unless a longer retention period is required by applicable law.

Contact form messages are forwarded to Gmail and, under the configuration set by the controller, removed from the Keliweb mailbox after forwarding; they remain in Gmail for the period described above. Any logs, backups or other technical copies held by providers (Keliweb, Google) are retained according to the settings and terms of those services. According to its privacy policy, Keliweb keeps email traffic data for six months for ordinary operations and for up to six years for the detection and prosecution of crimes.

Usage data is retained by the hosting provider for the period set in its configuration. Data used to protect the form from misuse is deleted as described in the “Contact form” section. Your choice about third-party content stays stored in your browser until you delete or change it.

Under the FADP, you can in particular:

• ask whether personal data about you is being processed and receive the related information (right of access);
• ask for inaccurate data to be corrected;
• ask for your data to be deleted, or object to its processing;
• ask to receive the data you provided, or to have it transferred, in a common electronic format, where the law provides for this.

To the extent that the GDPR applies, you also have the right to restrict processing, to object to processing based on legitimate interest, to receive your data in a structured format (data portability) and to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

In Switzerland, you can contact the Federal Data Protection and Information Commissioner (FDPIC). If the GDPR applies, you can lodge a complaint with a supervisory authority in the European Union, in particular in the country where you live or work or where the alleged infringement took place.

Write to info@donadelli.eu describing your request. To protect your data, your identity may need to be verified. You will receive a response within the time limits set by applicable law.

The website is served over an encrypted connection (HTTPS). It consists of static pages and a single program on the server that handles the contact form, and it does not use a database. Third-party content loads only after you choose to load it.

The security of data held by external providers also depends on the measures each of them takes.

The booking calendar and the video are provided by Google, which processes data under its own terms and privacy policy. What loads, and when, is described in the Cookie Policy.

The website also links to LinkedIn, Instagram, Facebook, X and Amazon. These are plain links: no data is sent to these services unless you open the link. Once you do, the privacy policies of those websites apply.

The website does not make decisions based solely on automated processing, and no profiling takes place.

This policy may be updated, for example if the services used by the website change. The current version is always published on this page, together with its version number and the date of the last update.

This policy is available in Italian and English. In case of any discrepancy, the Italian version prevails.