Data controller
The website arenapoloclub.ensi.it is the website of Arena Polo Club, a section of ENSI Social APS – Ente Nazionale Sportivo Italiano, which is the controller of personal data: registered office at Via Guido Banti 34, 00191 Roma, tax code and VAT number 17549421000. For any request concerning your data, you can write to info@ensi.it or to the certified email address (PEC) ensi@registerpec.it.
What data we process
- Browsing data: the systems that run the website collect certain technical data (IP address, browser type, pages requested, date and time). These data are used only to ensure that the website works properly and securely and are not used to identify visitors.
- Data you give us through the forms: name, email address, telephone number and organisation or company if provided, the topic chosen (for example membership, school, events, sponsorship, press) and the content of the message.
- Data of members and participants: those who join the club or take part in its activities receive a specific privacy notice with the membership or registration application (personal details, contact details, sports registration, fees, any medical certificates required by sports rules).
Why we process them and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to requests sent through the forms or by email, including for membership, school, events and partnerships | Steps requested by the data subject (art. 6.1.b GDPR) |
| Ensuring the security and proper functioning of the website | Legitimate interest of the Controller (art. 6.1.f GDPR) |
| Complying with legal obligations | Legal obligation (art. 6.1.c GDPR) |
We do not use form data to send newsletters or promotional communications without specific consent.
How long we keep them
Messages received through the forms are kept, including in the website’s restricted area, for as long as necessary to handle the request and in any case for no longer than 24 months, unless they are needed to comply with legal obligations or to protect rights. Technical browsing data are kept for as long as strictly necessary for the website’s security.
Who can access the data
The data are processed by persons authorised by ENSI Social APS and, on its behalf, by hosting and email service providers, appointed as data processors. When a request concerns an activity organised with a club or a partner (for example a taster day), the necessary data are disclosed only to them and only for that activity. The data are not disseminated or transferred to third parties for commercial purposes.
Cookies and third-party content
Without your consent, the website uses only the technical cookies needed for it to work, including the one that remembers the language you have chosen. The map on the Contact page is provided by Google Maps and is loaded only after you give your consent: at that point Google may collect browsing data in accordance with its own privacy policy and may also transfer them outside the European Union. The share buttons in articles are simple links and do not send any data to social networks unless you use them.
Your rights
You may at any time request access to your data, rectification, erasure, restriction of processing and portability, and you may object to processing (articles 15–22 of the GDPR), by writing to the Controller’s addresses. You also have the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority).
Cookies: list and preferences
On your first visit, a banner lets you accept, reject or choose non-technical cookies by category; closing it with the X counts as rejecting them. Your choice lasts 6 months and you can change it at any time from the ‘Cookie preferences’ link at the bottom of every page or from the button below.
Website security
To protect the website from unauthorised access, we log access to the restricted area and failed attempts, with the IP address of the connection, and we temporarily block connections that enter the wrong password several times. These data are processed on the basis of the legitimate interest in the security of the website (art. 6, para. 1, letter f, and art. 32 of the GDPR) and deleted after 90 days. Anyone who discovers a vulnerability can report it to the contact given in the security.txt file.
Last updated: October 2026.