⚠️ DRAFT — not legally binding. This text was drafted from a technical audit of the website's actual data flows. Before publication it must be completed with the missing operator details (marked {…}) and reviewed by the operator (David Prato) and a qualified lawyer. It is not legal advice.
This Privacy Policy explains how Time to Jump Dolomites — Associazione Sportiva Dilettantistica (A.S.D.) ("we", "the Data Controller") processes personal data of visitors and customers of timetojumpdolomites.com, in accordance with Regulation (EU) 2016/679 (GDPR) and the Italian Privacy Code (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018).
Time to Jump Dolomites A.S.D. — David Prato
Registered office: {address — to be added by the operator}
📧 info@timetojumpdolomites.com · 📱 +39 342 763 5478
A Data Protection Officer (DPO) has not been appointed, as we are not obliged to designate one. {To be confirmed by the operator.}
We only process the data you actively provide. We do not run a generic newsletter or marketing-profiling system.
When you reserve a seat, we collect — across the booking form and the registration-completion step — the following data:
Purpose: to process and fulfil your booking, verify eligibility (licence/insurance are safety- and regulatory requirements), coordinate the load, and contact you about your jump.
Legal basis: performance of a contract — Art. 6(1)(b) GDPR (and Art. 6(1)(c) for licence/insurance verification where required by aviation/sport regulations).
Public display of nickname: the nickname you choose is shown publicly on the flight card of your jump, so other skydivers can see who is on their load. Do not use your real name as a nickname if you do not want it shown. Legal basis: Art. 6(1)(b)/(f) GDPR (group coordination).
To take the deposit, your email is transmitted to our payment provider (Nexi); your name is entered by you directly on Nexi's page when you pay. Card data is entered directly on Nexi's secure hosted payment page and never reaches our servers. We store only the payment status and an order reference — no card details are stored on our side. Any remaining balance and cancellation charges are settled on site.
Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (tax/accounting obligations).
If you tick "save my details for next time", we create an account using your email and a password (stored only in hashed form) so your data can be pre-filled at the next booking.
Legal basis: consent — Art. 6(1)(a) GDPR; you can delete the account at any time.
If you book for a group, you may enter the first name and email of the friends you invite, so we can email each of them a personal link to complete their own registration. You are responsible for having your friends' agreement to share their email with us.
Legal basis: legitimate interest in facilitating the group booking you requested — Art. 6(1)(f) GDPR.
If you write to us by email, WhatsApp or phone (via the links on the site), we process the data you provide in that message to answer you. We do not operate a web contact form that stores data on this site.
Legal basis: Art. 6(1)(b)/(f) GDPR.
Our hosting provider automatically processes technical access data (IP address, browser/OS, time of request) in server logs, as is technically necessary to deliver the website securely.
Legal basis: legitimate interest in secure operation — Art. 6(1)(f) GDPR.
We use the following service providers, who process personal data on our behalf as processors (Art. 28 GDPR) strictly for the purposes above. We do not sell your data or use it for advertising.
Beyond these, data may be disclosed to public authorities where required by law, and to our tax/legal advisors bound by confidentiality.
Some of the processors above (Cloudflare, Resend, Google, and possibly Supabase depending on its configured region) are based in or may process data in the United States. Such transfers are safeguarded by the EU Standard Contractual Clauses and/or certification under the EU-US Data Privacy Framework. A copy of the relevant safeguards can be requested at the contact address above. {The operator must confirm the Supabase region and the executed Data Processing Agreements / SCC with each provider before go-live.}
Booking and registration data is kept for as long as necessary to perform the contract and thereafter for the periods required by Italian tax and accounting law (generally up to 10 years for accounting records, Art. 2220 Codice Civile). Account data is kept until you delete your account. Server logs are kept only for a short period for security purposes. {Exact retention periods to be finalised with the operator's tax advisor.}
This website is intentionally lean. It sets no advertising or profiling cookies and uses no Google Analytics or comparable tracking.
We store small values in your browser's local storage that are strictly necessary for the site to function — your language choice (ttjd_lang), your cookie-banner choice (ttjd_cookie_consent), and, if you log in, your session. These do not require consent.
The location maps on our home page are embedded from Google Maps. To avoid transmitting your data to Google without your agreement, the maps are not loaded automatically: they appear as a placeholder and load only when you click to load them (or accept loading external content in the cookie banner). Loading a map transmits your IP address to Google and may set Google cookies. Google's privacy policy: policies.google.com/privacy. You can withdraw this consent at any time by clearing the ttjd_cookie_consent value or your browser storage.
Fonts are currently loaded from Google's servers, which transmits your IP address to Google when the page loads. {Recommended follow-up: self-host the fonts to avoid this transfer — see operator notes.}
Under Articles 15–22 GDPR you have the right to: access your data; rectify inaccurate data; erase data ("right to be forgotten"); restrict or object to processing; data portability; and, where processing is based on consent, to withdraw that consent at any time without affecting prior processing. To exercise these rights, contact info@timetojumpdolomites.com. We will respond within the legal deadline (generally one month).
If you believe your data is processed unlawfully, you may lodge a complaint with the competent supervisory authority — in Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it) — or with the authority of your EU country of residence.
This website was conceived, designed and implemented by Solum Invest GmbH, Innsbruck, Austria (office@soluminvest.at). Solum Invest GmbH acts solely as technical service provider and is not a Data Controller for the personal data processed through this website.
Last updated: June 2026 — DRAFT pending operator completion and legal review.