Privacy Policy

This notice is provided under articles 13 and 14 of Regulation (EU) 2016/679 — the “GDPR” — to anyone visiting this site, requesting a quote, or applying to join the Club. It's written to be understood: wherever a technical term is unavoidable, what it means follows right after it.

1. Who processes your data

The data controller — the one who decides why and how your data is used, and who answers for it — is Stuweb.club, an unincorporated association (associazione non riconosciuta) under articles 36 and following of the Italian Civil Code, based in Padova, Italy.

This applies to data collected through the site: browsing, quote requests, applications to the Club. Once a project starts, the contractual relationship is formed with the individual project lead — see point 2 of the terms and conditions — and from that moment the data needed to carry out the assignment is processed by them as an independent controller, for the purpose of performing the contract they concluded with the client. Their identifying and contact details, together with what's needed to exercise the rights described in point 7 against them, are communicated in writing to the client when work begins and can be requested at any time.

For anything concerning your data, including exercising the rights described in point 7, you can use this site's contact form — that's the channel we actually monitor: we don't publish an email address because we don't have a dedicated one. We reply within one month of your request, as required by article 12(3) of the GDPR.

We haven't appointed a Data Protection Officer (DPO): none of the cases that make it mandatory under article 37 of the GDPR apply to us.

2. What data we collect

2.1 Data you give us

If you apply to join the Club, through the form on the “Join the Club” page we collect: full name, email address, age, city of residence, university, degree type (bachelor's or master's), degree course, exam average, the skills you select, the free-text answers about what you've built and what you want to do, the CV you may attach, and anything else you choose to write to us.

If you request a quote or contact us, we collect the data you give us on that occasion: typically your name, contact details, and information about the project you want to discuss.

Please don't include, in any free-text field or in your CV, the information article 9 of the GDPR calls “special categories”: racial or ethnic origin, political opinions, religious beliefs, trade union membership, health data, or data concerning sex life or sexual orientation. We don't need it and we don't want it. If you send it anyway, we delete it.

2.2 Data collected automatically

This site doesn't use profiling cookies, has no analytics or behavioural-tracking tools, has no advertising pixels, and doesn't follow you across other sites. That's why there's no cookie banner: there's nothing to ask your consent for.

Like any site, the provider hosting the pages records technical logs — IP address, date and time of the request, page requested, browser and operating system type — needed to run the service and defend it against abuse. We don't use them to identify people or cross-reference them with other data.

Both forms on the site are protected by hCaptcha, the “I am human” checkbox. To tell a person from an automated program, hCaptcha collects the IP address, the date and time of the interaction, the browser, device and operating system type, and the movements made on the checkbox with the mouse or finger. It isn't an analytics tool and it isn't there to profile you: it runs only on the forms and only for that purpose. Who operates it is listed in point 5, and where it keeps the data in point 6.

3. Why we process it, and on what legal basis

The GDPR requires every processing activity to rest on one of the bases listed in article 6. Ours are:

• Evaluating your application — legal basis: your consent (art. 6(1)(a)), given by checking the box in the form, and the performance of pre-contractual steps taken at your request (art. 6(1)(b)). Consent is freely given and you can withdraw it whenever you like: see point 7.
• Responding to a quote or contact request — legal basis: pre-contractual steps at your request (art. 6(1)(b)).
• Performing the contract, if you become a client — legal basis: performance of the contract itself (art. 6(1)(b)).
• Complying with legal obligations, in particular tax and accounting ones — legal basis: legal obligation (art. 6(1)(c)).
• Keeping the site running and secure — the technical logs and the anti-bot check on the forms — legal basis: our legitimate interest in the service working and not being abused (art. 6(1)(f)). Without that check the forms would be filled in by automated programs and would stop serving the people who actually write to us.

We don't make any decision about you in an automated way: applications are read by people, one by one.

4. How long we keep it

• Applications we don't accept: twelve months from receipt, so we can get back in touch if a suitable position opens up. After twelve months we delete everything, CV included. If you'd like it sooner, just ask.
• Applications we accept: for the whole duration of your relationship with the Club, and then for as long as legal obligations require.
• Quote requests that don't go anywhere: twenty-four months.
• Client data: for the whole duration of the relationship and, for tax and accounting records, for the ten years required by article 2220 of the Italian Civil Code.
• Technical logs: for as long as our hosting provider keeps them, typically a few days to a few months.
• The copies held by the form providers: Web3Forms keeps the requests it receives for a maximum of three years from submission, after which it deletes them by itself. Applications stay on Forminit until we delete them, and we delete them within the periods set out above.

5. Who else sees it

Your data is seen by us. We don't sell it, trade it, or hand it over to third parties for marketing purposes, ours or anyone else's.

Some providers process it on our behalf — the law calls them “processors” and they're bound by a contract under article 28 of the GDPR, which requires them to use it only for what we need it for:

• Forminit — operated by UXPLUS LTD, 86–90 Paul Street, London EC2A 4NE, United Kingdom — which receives Club applications and the CV you attach;
• Web3Forms, operated by Web3Creative, which delivers quote and contact requests to us;
• hCaptcha — operated by Intuition Machines, Inc., a United States company — which provides the anti-bot check on both forms;
• the hosting provider that keeps the site online, a company established in the United States;
• the professionals who assist us with accounting and tax matters, for only the data needed for that work.

Article 13(1)(e) of the GDPR allows listing either the recipients or their categories. The only one listed here by category is the hosting provider. Its name is available on request: just ask through the contact form, which you can also use to ask us for a copy of the processing agreements in place with the others.

We may also disclose data to judicial authorities or law enforcement when a law requires us to.

6. If your data leaves Europe

We commit to choosing providers that keep data within the European Economic Area, and where that isn't possible, to covering the transfer with one of the safeguards set out in chapter V of the GDPR. Here is where the providers named in point 5 stand, according to what each of them states publicly:

• Forminit states that it keeps its application and data in the EU regions of Amazon Web Services. The company operating it is established in the United Kingdom, a country for which the European Commission has adopted an adequacy decision (art. 45 of the GDPR).
• hCaptcha processes data in the United States. The transfer rests on the company's certification under the EU–U.S. Data Privacy Framework, which is the subject of an adequacy decision, and in addition on the standard contractual clauses referred to in article 46(2)(c) contained in its data processing addendum.
• Web3Forms states that it relies on Amazon Web Services, Cloudflare and Hetzner, but does not publish which region it keeps the data in: we therefore cannot rule out that part of the processing takes place outside the European Economic Area. Our relationship with this provider is governed by its data processing agreement.
• The hosting provider is established in the United States: the technical logs described in point 2.2 may therefore be processed outside the European Economic Area. The transfer is governed by the processing agreement entered into with it, which incorporates the standard contractual clauses referred to in article 46(2)(c).

You can ask us for a copy of the safeguards in place through the contact form.

7. Your rights

Articles 15 to 22 of the GDPR give you the right to:

• know what data of yours we hold and get a copy of it (access, art. 15);
• have it corrected if it's wrong or incomplete (rectification, art. 16);
• have it deleted (art. 17), outside the cases where a law obliges us to keep it;
• restrict its use while a dispute is open (art. 18);
• receive it in a machine-readable format and have it transferred to another controller (portability, art. 20);
• object to processing based on legitimate interest (art. 21);
• withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (art. 7(3)).

To exercise them, use the contact form. It costs nothing and you don't have to justify yourself.

If you believe we're handling your data incorrectly, you have the right to lodge a complaint with the Italian data protection authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy — garanteprivacy.it — or to bring the matter before a court.

8. Data collected by the site we build for you

This notice covers this site only. The website, management software, or app we build for a client is a different matter: for the personal data collected through it — contact forms, orders, bookings, newsletter sign-ups — the data controller is the client, who decides its purposes and means and is responsible for putting together their own notice and legal bases.

The project lead builds the technical tool as instructed by the client. Where, for work carried out after delivery, they process personal data on the client's behalf, they act as a processor under article 28 of the GDPR, on the basis of an appointment separate from this document. Neither the Association nor the project lead is responsible for the content or data the client enters or has entered into their own site: that responsibility lies with the client, as set out in point 9 of the terms and conditions.

9. Is providing data mandatory?

No, but without some of it we can't do what you're asking. The fields marked as required in the application form are needed to evaluate it: without them, the application can't be considered. The CV is optional. Likewise, without a way to reach you we can't reply to a quote request.

10. Minors

This site isn't directed at anyone under sixteen and doesn't knowingly collect their data. The Club selects university students who are legal adults. If you notice that a minor has sent us data, let us know: we delete it right away.

11. Changes to this notice

If we change how we handle data, we update this page and the date at the top. When the changes are substantial, and your data is processed on the basis of consent, we let you know and, if needed, ask for your consent again.

The rules for using the site and our services are in the Terms and conditions.

This notice is also published in Italian at stuweb.club/ita/privacy. The Italian version is the one with full legal effect; this English translation is provided for convenience, and if the two differ, the Italian text prevails.