Personal data protection notice
4 August 2026
This notice is given pursuant to Articles 12, 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and of Italian Legislative Decree 196/2003 ("Codice Privacy") to all users of the SkiCoach application (app.skicoach.it) and of the management console (gestionale.skicoach.it): club administrators and coaches, athletes and their families, chaperones and drivers.
This page is a courtesy translation. In case of any discrepancy, the Italian version prevails. Read the Italian version
1. Who processes your data: two distinct roles
SkiCoach is a service provided by MAGICA S.R.L., VAT no. 02571380225, registered office at Via Lungo Leno 24/I, 38068 Rovereto (TN), Italy, privacy contact e-mail: hello@skicoach.it (the "Provider") to the ski clubs that purchase it (your "Club").
- For the sporting and personal data managed in the app (athlete records, attendance, training sessions, races, injuries, video, family details, transport logistics): the controller is your Club, which decides what data to enter and why. The Provider acts as processor within the meaning of Article 28 GDPR, on the basis of a written agreement with the Club, and processes that data only on the Club's instructions. To exercise your rights over this data (access, rectification, erasure and so on) please contact your Club; the Provider assists the Club in responding, and will forward to the Club any request it receives directly.
- For the data needed to operate the platform (credentials and accounts, technical and security logs, support requests, the Club's contractual and billing details): the controller is the Provider.
2. What data is processed
| Category | Examples | Source |
|---|---|---|
| Identification and contact data | first name, surname, e-mail, telephone, date of birth, FIS code | entered by the Club |
| Parent/guardian data | names and telephone numbers of family contacts | entered by the Club |
| Address and location | home address and its coordinates (for organising transport), meeting points, pick-up times | entered by the Club; geocoding via the HERE service |
| Sporting data | attendance, training sessions, race results, objectives, assessments, equipment | entered by the Club and its coaches |
| Health data (special category, Article 9 GDPR) | injury log, "injured" status, medical certificates uploaded as documents | entered by the Club, which must have a valid condition for processing under Article 9(2) GDPR — as a rule the explicit consent of the holder of parental responsibility |
| Photographs and video of athletes | training and race footage uploaded by coaches | uploaded by the Club |
| Motion analysis (AI) | derived from video processing: skeletal points and joint angles, for technical analysis. Processing takes place on the Provider's own servers; the data is not used to identify individuals, nor to train AI models | generated by the service at the coach's request |
| Family financial data (optional module) | fees, payments, due dates, payment method, last 4 digits of the IBAN | entered by the Club |
| Account and log data | login e-mail, role, activity log (who changed what), support tickets | generated by use of the service |
The app does not collect your device's GPS location, contains no advertising and uses no tracking or commercial profiling tools.
3. Purposes and legal bases
Where the Club is the controller (sporting and personal data): the purposes are the management of the Club's sporting activity (organising training, races, transport, communications and membership fees). The legal bases are determined by the Club, as a rule: performance of the membership relationship (Article 6(1)(b)), legal obligations (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)). For health data the Club must have a valid condition for processing under Article 9(2) GDPR — as a rule the explicit consent of the holder of parental responsibility (Article 9(2)(a)), without prejudice to any further conditions applicable under Italian law on medical supervision of sporting activity. For photographs and video the basis is the consent of the data subjects or of the holder of parental responsibility, together with Articles 96-97 of Italian Law 633/1941 for the publication of images.
Where the Provider is the controller. Most data subjects (athletes, families, coaches, drivers) are not party to the contract concluded between the Provider and the Club: for these processing operations the legal basis is not the performance of a contract with the data subject, but the Provider's legitimate interest, specified below for each purpose.
| Purpose | Legal basis and legitimate interest pursued | Retention |
|---|---|---|
| Creation and management of accounts, authentication | legitimate interest (Article 6(1)(f)): reliably delivering to the Club the service it has purchased, by granting access to the people it authorises | lifetime of the account |
| Platform security: technical and access logs, abuse prevention, service integrity | legitimate interest (Article 6(1)(f)): protecting the Service and the data held in it against unauthorised access and misuse (see Recital 49 GDPR) | security logs max 24 months |
| Support and tickets | legitimate interest (Article 6(1)(f)): responding to requests for help from those who use the Service, and documenting the outcome | 24 months from closure of the request |
| Contract and invoicing towards the Club (contact person's data) | legal obligation (Article 6(1)(c)) for accounting and tax purposes; legitimate interest (Article 6(1)(f)) in managing the relationship with the Club; performance of a contract (Article 6(1)(b)) where the contact person is themselves party to it | 10 years (accounting obligations) |
| Service usage statistics for improvement (which screens and features are used, by role and by club — with no personal identifiers, no cookies and no third parties) | legitimate interest (Article 6(1)(f)): understanding which features are actually used, in order to guide product development | 12 months, then aggregates only |
For each of these processing operations the Provider has carried out and documented a balancing of its own interest against your rights, which may be requested at hello@skicoach.it. In respect of processing based on legitimate interests you have a right to object: see §10.
There is no automated decision-making producing legal effects on data subjects (Article 22 GDPR): AI video analysis provides the coach with technical support only, and the coach remains the sole assessor of the athlete.
4. Minors
SkiCoach is designed for the activity of ski clubs whose athletes are largely minors. Athletes' accounts are created by the Club within the membership relationship: the Service is not offered directly to minors, but to the Club that registers them. The Club is responsible for informing families and for collecting the necessary consents, in particular for health data, for photographs and video, and for their possible publication.
The age threshold laid down by Article 8 GDPR — 14 years in Italy, pursuant to Article 2-quinquies of the Codice Privacy — applies exclusively where an information society service is offered directly to a child and the processing is based on consent under Article 6(1)(a). It is not a general threshold of capacity and does not apply to the other consents relevant here: in particular, explicit consent for health data (Article 9(2)(a)) and consent to the publication of images (Articles 96-97 of Law 633/1941) follow the rules on representation of minors laid down by national law, and are given by the holder of parental responsibility. For clubs established outside Italy, the Article 8 threshold set by the relevant national law applies.
5. Recipients and sub-processors
The data is processed by the Provider and, on its behalf, by the following technical suppliers (sub-processors), bound by agreements under Article 28 GDPR:
| Supplier | Service | Location / data region | Transfer safeguards |
|---|---|---|---|
| Google Ireland / Google LLC (Firebase Authentication) | account authentication | EU/USA | EU-US Data Privacy Framework / SCCs |
| Wasabi Technologies | storage of files, photographs and video | EU — Milan (eu-south-1) | DPA |
| Plus Five Five, Inc. (*Resend*) | service e-mail delivery | USA | Adequacy decision EU-US Data Privacy Framework (participant no. 8907); in the alternative Standard Contractual Clauses, already in force under the Resend DPA |
| HERE Global B.V. | address geocoding | EU | DPA |
| OpenRouteService (HeiGIT) | transport route calculation | EU (Germany) | DPA / terms |
| Leaseweb Deutschland GmbH | application servers, database, AI video processing | Germany (EU) | Article 28 agreement incorporated into Leaseweb's B2B general sales terms |
| Anthropic PBC *(only for clubs whose plan includes the "Ricerca AI" feature)* | processing of natural-language search requests (excluding health data and parent contact details; no use for training) | USA | EU-US Data Privacy Framework / SCCs |
The current list is published at https://skicoach.it/subprocessori. Data is neither sold nor disclosed to third parties for marketing purposes.
Services called directly by your browser: displaying maps loads map tiles from the servers of the OpenStreetMap Foundation, and weather forecasts query Open-Meteo; in both cases those parties receive your IP address and the coordinates of the area displayed (ski resorts or meeting points), not your location.
6. Transfers outside the EU
Where the suppliers listed above involve a transfer to third countries (in particular the USA), it takes place on the basis of an adequacy decision (EU-US Data Privacy Framework) or of the European Commission's Standard Contractual Clauses, with supplementary measures where necessary. A copy of the safeguards may be requested at hello@skicoach.it.
7. Retention
Data managed on the Club's behalf is retained for the duration of the contract with the Club and deleted or returned at its end, in accordance with the Article 28 agreement. The periods set out in §3 also apply. The Club may set or request the deletion or anonymisation of athletes who are no longer registered; accounting data is retained for the periods required by law.
8. Cookies and local storage
SkiCoach uses technical tools only, for which no consent is required (Garante guidelines of 10 June 2021; Article 122 Codice Privacy):
- an encrypted session cookie: maintains your login; rolling 8-hour duration;
- a preference cookie (language, interface settings);
- local device storage (IndexedDB/Cache): caching of data and video for offline use of the app on your device; cleared on logout.
There are no profiling, analytics or third-party cookies; for that reason no banner is displayed.
9. Security
The Provider adopts technical and organisational measures under Article 32 GDPR, including: transport encryption (HTTPS/HSTS), an architecture that never exposes access tokens to the browser, per-club data isolation, role-based access control and log minimisation. Personal data breaches are handled and notified within the time limits of Articles 33-34 GDPR.
10. Your rights
You have the right to obtain access to your data, its rectification, erasure, restriction and portability (Articles 15-20 GDPR), and to withdraw any consent you have given. For sporting and personal data please contact your Club (the controller); for account and support data, the Provider at hello@skicoach.it.
Right to object. Where the Provider processes your data on the basis of its own legitimate interest (§3), you have the right to object at any time to that processing on grounds relating to your particular situation (Article 21 GDPR). On receiving an objection the Provider will cease the processing unless it demonstrates compelling legitimate grounds which override your interests, rights and freedoms, or the need to establish, exercise or defend a legal claim. To exercise this right, write to hello@skicoach.it.
Complaint to a supervisory authority. You are in any event entitled to lodge a complaint with the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it) or with the supervisory authority of the State in which you reside or work.
11. Changes
Any material changes to this notice will be communicated through the app with reasonable notice, stating the date of the new version.
Company details
MAGICA S.R.L. · Registered office: Via Lungo Leno 24/I, 38068 Rovereto (TN), Italia · Registro Imprese (Companies Register) of Trento — VAT / tax code 02571380225 · Share capital € 10.000,00 fully paid up · Certified e-mail (PEC): pec@pec.magica.srl