PRIVACY POLICY

NKT MUAY THAI A.S.D. — Registered office: Largo Rodolfo Lanciani 24, Rome, Italy — Tax code 96660540582. Email: infonktmuaythai@gmail.com.

• Identity and contact data: first and last name, email, phone, date and place of birth, residential address, postal code, city and Italian fiscal code.
• Account data, profile photo, experience level and membership status.
• Health data: medical fitness certificate, its upload date, expiry date and validity status, when provided.
• Activity data: classes booked, attendance, absences, cancellations, waiting lists, credits, training statistics and fight records.
• Trial and waiver data, including the generated document, signature status and, for minors, the details of a parent or legal guardian.
• Payment and receipt data: amounts, dates, payment method, purpose, reference period, payer details and tax documents.
• Communications: direct messages with authorised staff, notices, email delivery status and in-app notifications.
• Technical data: login and session data, security logs, device/browser information and push-notification subscription identifiers.

• Account, membership, classes, bookings, attendance, waiting lists, functional messages and service notifications: performance of the membership relationship or requested pre-contractual measures (Art. 6(1)(b) GDPR).
• Accounting, receipts, legal, insurance and sports-body requirements: compliance with legal obligations (Art. 6(1)(c) GDPR).
• Medical fitness data: verification of eligibility to practise sport under applicable Italian health and sports rules (Art. 9(2)(g) GDPR and, where required, explicit consent under Art. 9(2)(a)).
• Security, abuse prevention, service defence and limited internal participation statistics: our legitimate interest (Art. 6(1)(f) GDPR), balanced against users' rights.
• Promotional communications about events, courses and offers: separate, optional and revocable consent (Art. 6(1)(a) GDPR).
• Google Analytics: consent given through the cookie banner (Art. 6(1)(a) GDPR). Analytics remains disabled if consent is refused.

Data marked as required is necessary to create and manage the account, membership, trial waiver and participation in classes. If it is not provided, we may be unable to provide those services. Profile photos, push notifications, uploaded certificate copies and marketing consent are optional unless a specific legal or sports rule requires the document; refusing marketing or analytics never affects membership or training.

Medical certificates and their expiry are used only to verify fitness for sporting activity. They are not published or used for advertising and are accessible only to authorised personnel who need them. Please do not upload clinical reports or information beyond what is required by the certificate.

When the athlete is a minor, the involvement and authorisation of a parent or legal guardian is required where applicable. We may process the guardian's identity, contact and tax details for waivers, membership administration and receipts. The guardian may exercise the minor's privacy rights. Promotional consent relating to a minor must be given by the person legally entitled to do so.

Data may be accessed, according to role and need, by authorised administrators, reception staff and coaches. It may also be processed by providers of hosting, database, storage, authentication, email and push delivery, analytics and technical support, acting as processors where applicable; and disclosed to accountants, insurers, sports bodies, advisers or public authorities when required. We do not sell personal data.

Some technology providers, including Google for analytics, may process data outside the European Economic Area. In those cases transfers rely on an applicable adequacy decision, including the EU-US Data Privacy Framework where valid, or on Standard Contractual Clauses and supplementary safeguards under Articles 44–49 GDPR.

• Account, membership, booking, attendance, waiver and communication data: for the duration of the relationship and afterwards only as long as needed for legal claims, safety and applicable sports obligations.
• Accounting records, payments and receipts: for the period required by tax and civil law, normally 10 years.
• Medical certificates: until expiry, replacement or the end of the relationship, without prejudice to a longer period required by law or necessary for a dispute.
• Push subscriptions: until notifications are disabled, the subscription expires or the account is deleted. Technical and security logs are retained only for the period necessary for security and troubleshooting.

At the end of the applicable period, data is deleted or irreversibly anonymised, except where further retention is required by law.

Authenticated members may see an internal training leaderboard showing a first name and surname initial with aggregated attendance statistics. You may object to this display by contacting us. The app automatically applies operational booking rules, such as waiting-list order, booking windows and late-cancellation counts. These processes do not produce legal or similarly significant effects, and no profiling or solely automated decision-making under Article 22 GDPR is carried out.

You may request access, rectification, erasure, restriction and portability of your data, object to processing based on legitimate interest, and withdraw consent at any time without affecting processing already carried out. Account deletion can be requested from your profile or by contacting us. Some data may still be retained where required by law or to establish, exercise or defend legal claims.

Contact us at infonktmuaythai@gmail.com.

You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, at www.garanteprivacy.it, without prejudice to your right to seek judicial remedy.

The site uses technical cookies and local storage needed for authentication, security, language, installation preferences and remembering your cookie choice. These do not require consent. If you accept, Google Analytics 4 is loaded to measure page views and usage through information such as pages visited, browser/device data, approximate location and online identifiers. The _ga and _ga_* cookies may remain for up to 2 years. Analytics is not loaded if you reject it.

You can change your choice below at any time. Rejecting analytics also removes accessible Google Analytics cookies from this site; you may additionally clear site data in your browser.

We may update this policy when the services or legal requirements change. The current version and its update date are always published on this page; where a change materially affects registered users, we will provide an appropriate notice.