DONATE
DONATE →
Automated translation under legal review. In case of discrepancy, the Italian version prevails.
Version p2-2026-10-16 · Updated on 2026-10-27

Privacy Policy

How Strongers collects, processes and protects personal data.

1. Who we are (Data Controller)

Strongers Social Club ETS is the data controller for data collected via strongers.org and connected services. For any privacy question contact us directly.

  • Data Controller: Strongers Social Club ETS
  • Registered office: Via Ruggero Fiore 38, 00136 Roma (RM)
  • CF: 96564050589 · P.IVA: 17380961007
  • RUNTS Rep.: 122206
  • Privacy contact: info@strongersc.com

2. Processing purposes and legal basis

We process your data only for clear purposes declared below. Each processing has a specific legal basis (art. 6 GDPR) and a defined retention period.

Purpose Data collected Legal basis Retention
Newsletter (events, research grants, magazine) Name, email Consent (Art. 6.1.a GDPR) Until withdrawal + 30-day deletion
Donations (card, PayPal, IBAN, 5×1000) Name, email, amount, payment data (handled by Stripe/PayPal) Contract performance (Art. 6.1.b) + tax obligations (Art. 6.1.c) 10 years (ETS tax obligations)
Sports event registration First name, last name, email, phone, event data Contract performance (Art. 6.1.b) 5 years from participation
Store purchases (order, shipping, invoice, support, refunds) First and last name, email, phone (optional), shipping address, order notes, invoicing details if requested (stored encrypted), accepted terms version; card details stay with Stripe/PayPal Performance of a contract (art. 6.1.b) + tax and accounting obligations (art. 6.1.c) 10 years for accounting data (art. 2220 Italian Civil Code); phone and notes deleted immediately upon an erasure request
Contact / partnership form Name, email, message Legitimate interest in replying (Art. 6.1.f) 24 months
Anonymised analytics (Matomo on-prem) Anonymised IP (last 16 bits), visited URLs Consent (Art. 6.1.a) 14 months (Matomo default)
Attribution tracking (_st_attr cookie) Anonymous session token, source, campaign Consent (Art. 6.1.a) 30 days
Email personalisation and engagement score (whom to write to again, whom to stop writing to) Interaction with our emails (opens, clicks), language, audience segment Legitimate interest (Art. 6(1)(f)) Until promo consent withdrawal / objection under Art. 21
Email measurement (opens and clicks) Opens: invisible image (pixel), date and time, user agent. Clicks: link opened, date and time Legitimate interest (Art. 6(1)(f) GDPR), with the right to object Until you object (Art. 21)
Anti-bot protection of public forms (Cloudflare Turnstile) IP address, technical browser signals, verification token Legitimate interest (Art. 6(1)(f)) — preventing abuse and spam Data processed by Cloudflare only for the verification; nothing stored by Strongers

2.1 Communication personalisation

To make our communications more relevant we use your interaction with the emails we send you: opens and clicks on links (unless you object, see §2.2), together with your language and audience segment. With this data we adapt the subject and content of emails (newsletter, campaigns) and calculate an engagement score, which helps us decide whom to write to again and to stop writing to people who no longer read our emails. This processing relies on legitimate interest (Art. 6(1)(f) GDPR) in communicating effectively and without insisting; it uses only your interaction with our emails: no tracking on other websites, no special categories of data (Art. 9), no automated decisions with legal or similarly significant effects (Art. 22). The score only decides whether and when we write to you. You can object at any time (Art. 21) by writing to info@strongersc.com or by turning off promotional communications: objecting also turns off personalisation. If you turn off «Measuring our communications» in the preference centre, we stop calculating your score.

2.2 Email measurement (opens and clicks)

Our emails contain an invisible image and tracked links that tell us whether a message was opened and which links were clicked. We use this information on the basis of legitimate interest (Art. 6(1)(f) GDPR), to understand whether our communications work and to avoid writing to people who do not read them. You can object at any time (Art. 21) from the preference centre, reachable from the link at the bottom of every email, and keep receiving the communications you have chosen. Our email delivery service Brevo, which processes data on our behalf, records opens and clicks for delivery statistics; if you object, we do not record them in our systems.

2.3 Emails about the Run4Rome 2027 relay

Automated translation under legal review. In case of discrepancy, the Italian version prevails.

Who this covers. Anyone who bought a team entry for the Run4Rome 2027 relay ("Just run" or "Adopt your Marathon").

How to stop. Use "Stop these emails" at the bottom of any message, reply to the email or write to info@strongersc.com. It's free and doesn't affect your entry: messages about your entry will keep coming.

What data. Name, email, language, order details, the status of your team's fundraising page (switched on, goal, published) and, once it is published, its public address, email delivery status, clicks on the links in our emails, your replies and, only if you send it, the time you suggest for a video call.

Why, and on what basis.

  • "Adopt your Marathon" includes your team's fundraising page, which we set up and switch on for you: to help you publish it we send you a welcome, reminders, an offer of help (by video call too, if you like), the invitation to the Founding Teams celebration and a summary after the race. Basis: performance of the contract (Art. 6(1)(b) GDPR).
  • With "Just run" your entry also includes a fundraising page for your team, which you can switch on yourself. Until you do, we only write to invite you to switch it on and to remind you, without asking you for donations. We do this because you bought your relay entry from us (Art. 130(4) Italian Privacy Code; Art. 6(1)(f) GDPR). You can object at any time, free of charge.
  • When you switch on the page, you agree to receive from us, until 30 June 2027 at the latest, tips, reminders and ready-made messages for your team's fundraising, including the suggestion that you make the first donations yourselves. We also tell you this at the moment you switch it on. Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by switching on the page. You can withdraw it at any time, free of charge, using the link at the bottom of any email, by replying to the email or by writing to info@strongersc.com: the page stays on, your entry doesn't change, and withdrawing doesn't make the emails sent before unlawful.
  • If you ask for the ten-minute video call, we use your email and the time you suggest only to arrange it and send you the link. The call runs on Google Meet: Google processes the technical data of the connection (display name, voice, image, IP address) as an independent controller, under its own privacy policy (policies.google.com/privacy), including in the United States; we don't record it.

Until when, and link clicks. We write to you only about this initiative, until 30 June 2027 at the latest. We record clicks on the links in our emails for two reasons: to see, in aggregate, which messages are useful; and to know you still read our emails. So, if you have also agreed to our newsletter or other Strongers communications, a click on these emails tells us you still read our messages, so we don't remove you from those mailings as an inactive contact and, if we already had, we add you back. No automated decisions with legal or similarly significant effects on you.

Retention. We keep records of sends, clicks and your choices, including your email and the record of your no if you object or withdraw your consent, for as long as they are needed to stop writing to you and to show we respected your choice, and in any case no later than 30 June 2029. Team status data, including the page address, until 30 June 2028 at the latest.

Who handles the data. The controller is Strongers Social Club ETS. Emails are sent through Brevo (Sendinblue SAS, France, EU), our processor (Art. 28 GDPR).

Your rights. Access, rectification, erasure, restriction, objection and portability (Arts. 15-22 GDPR): write to the controller at info@strongersc.com. We have not appointed a Data Protection Officer (DPO): the controller handles requests directly. You can complain to the Italian Data Protection Authority (garanteprivacy.it) or to the supervisory authority of the EU country where you live.

3. Legal bases for processing

Our legal bases are: (a) your explicit consent for newsletter and analytics; (b) contract performance for donations and event registrations; (c) legal obligations for retention of donation receipts (10 years); (f) legitimate interest in responding to messages you send us spontaneously, in measuring opens and clicks of our emails and in using your interaction with our emails to personalise communications and calculate an engagement score (§2.1, §2.2), unless you object.

4. Recipients and processors

To provide the site services we rely on external providers appointed as processors under art. 28 GDPR. All are European or comply with EU adequacy standards:

  • Stripe Payments Europe Ltd. (Dublin) — card payment processing. Stripe Privacy
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — PayPal payment processing. PayPal Privacy (loaded only on-intent, see §7)
  • Brevo (Sendinblue SAS) (Paris) — newsletter and transactional email delivery. Brevo Privacy
  • Couriers delivering physical products: they receive name, shipping address and, if provided, phone number.
  • Matomo (self-hosted, Hetzner GmbH, Falkenstein DE) — anonymised analytics, data on European servers under Strongers' control
  • Hetzner Online GmbH (Germany) — infrastructure hosting. EU-only servers, minimal sub-processors.
  • Cloudflare, Inc. — anti-bot verification (Turnstile) on public forms: processes IP address and technical browser signals to tell people apart from bots. Certified under the EU-U.S. Data Privacy Framework. Cloudflare Privacy

We do not transfer your data outside the European Economic Area (EEA): the providers listed above operate EU servers, with one exception — the Cloudflare Turnstile anti-bot verification may process your IP address on Cloudflare's global infrastructure, safeguarded by the EU-U.S. Data Privacy Framework and standard contractual clauses (Art. 46 GDPR).

5. Retention periods

We keep your data only as long as necessary for the declared purposes. When the period expires, data is irreversibly deleted or anonymized. See the 'Retention' column of the processing table.

6. Your GDPR rights

GDPR guarantees you full control over your data. You can exercise the following rights at any time, free of charge.

How to exercise your rights

You can exercise any right below by simply sending an email. No complex forms required.

  • Right of access (Art. 15) — know which data we process
  • Right to rectification (Art. 16) — correct inaccurate data
  • Right to erasure / to be forgotten (Art. 17) — have your data removed
  • Right to restriction (Art. 18) — suspend the processing
  • Right to data portability (Art. 20) — receive your data in a readable format
  • Right to object (Art. 21) — object to processing based on legitimate interest
  • Withdrawal of consent (Art. 7.3) — withdraw consent at any time

📧 How to exercise: write to info@strongersc.com stating the right you wish to exercise. Response guaranteed within 30 days.

You always have the right to lodge a complaint with the Italian Data Protection Authority: Garante Privacy.

8. Security

Data is protected by mandatory HTTPS, email hashing for anonymous matching, versioned consent audit trail. Passwords follow the Argon2id standard. Infrastructure is hosted in Germany (Hetzner) under direct Strongers control, with no undisclosed external sub-processors.

9. Changes to this policy

When we update this policy we publish a new version with the update date. If changes are substantial and concern consent-based processing, we will ask you again to confirm your preferences.

Current version: p2-2026-10-16 · Last update: 2026-10-27