Privacy policy

On this page

Data controller
Types of data collected
Purposes and legal basis
Third-party services
Transfers outside the EU
Data retention
Your rights
Cookies
Processing of minors' data
Changes to this policy
Contact and complaints

1. Data controller

The data controller for the personal data collected through the website matteocampagna.com (hereinafter "Website") is:

Controller: Matteo Campagna · Performance Analyst, MCPerformance
Email: info@matteocampagna.com
VAT number: IT04237651205
Address: Via Garibaldi 23, 40033 Casalecchio di Reno (BO), Italy

2. Types of data collected

The Website collects the following categories of personal data, distinguished by source and collection method.

2.1 Data provided voluntarily by the user

Contact data: name, email address and the text of your message, which you provide when you write to info@matteocampagna.com, including through the «Send me an email» button on the Website, which opens your own email program.
Newsletter subscription: email address, with the date and time of sign-up. You subscribe by entering your address in the newsletter form on the Website; the date and time of sign-up are recorded and serve to prove that consent was given.
Optional information: content preferences, technical level, sporting goals, only where you choose to include them in your messages.
Billing data: if you buy a service, the details needed for the invoice (full name or company name, address, tax code or VAT number, recipient code or certified email address). The Website does not take payments online: services are paid for as set out in the data controller's proposal, and the data controller never collects or stores card numbers.
Material for the services: video footage of your shooting and technical questionnaires, only if you have signed up for a service.
Data concerning health (Art. 9 GDPR): neither the Website nor the services ask for it or measure it. If, however, you choose to tell the data controller about a pain, an injury or advice from your doctor or physiotherapist, in a message or in the questionnaire, that is data concerning health, which the GDPR protects as a special category. The data controller uses it only to adapt the work and only with your explicit consent: it is not used to make any diagnosis and does not replace the advice of a doctor. You can ask for it to be deleted at any time.

2.2 Data collected automatically

Technical logs: IP address, date and time, page requested, browser type and operating system. They are recorded by Cloudflare, which hosts and protects the Website, for technical and security purposes.
Searches on the Website: when you search with the Website's search box, the following are recorded: the search text (in lower case, up to 100 characters), the language of the Website, the day, the number of results found and the page where you searched. Your IP address, your browser, cookies and identifiers are not recorded: each search becomes a count ("this text was searched N times on this day") and cannot be linked to you or to your other searches. If your browser has Do Not Track or Global Privacy Control switched on, the search is not recorded. Text that looks like an email address, a phone number, an Italian tax code or an IBAN is discarded without being stored; even so, please do not type personal data into the search box.
Visit statistics, only with your consent: if you accept in the banner, Google Analytics 4 collects the pages visited, the referring website, approximate country and city, device type, browser and operating system, and some actions such as scrolling, downloads and clicks to other websites. Two cookies (_ga and _ga_FFYBQE90PG) hold a random identifier that makes it possible to recognise repeat visits from the same browser. For traffic from the European Union, Google uses the IP address only to derive an approximate location and then discards it without logging it. Google Signals and all advertising features are switched off: the data is not used to profile you or to show you ads, and the data controller uses it only in aggregate form. If you reject, Google Analytics is not loaded.
Cookies and similar technologies: details are in section 8 and on the Cookies page.

3. Purposes and legal basis for processing

Purpose	Legal basis	Duration
Replying to messages and contact requests	Pre-contractual steps at your request (Art. 6(1)(b)) or legitimate interest in replying (Art. 6(1)(f))	See section 6
Providing the services requested (full assessment, programme, training protocols, prevention and return to shooting, education, services for clubs and federations)	Performance of a contract or pre-contractual steps (Art. 6(1)(b))	For the duration of the service
Taking into account the data concerning health that you choose to share (for example a pain or an injury) to adapt the work	Explicit consent (Art. 9(2)(a) and Art. 6(1)(a))	See section 6
Sending the newsletter with updates to the evidence registry (changed statuses, new claims, predictions registered or resolved, new studies, new books)	Consent (Art. 6(1)(a)), given by signing up with the form on the Website	Until consent is withdrawn
Visit statistics with Google Analytics	Consent (Art. 6(1)(a) and Article 122 of the Italian Privacy Code), given through the banner and revocable at any time	See section 6
Understanding what readers search for, to improve and complete the Website's content (anonymous searches in the search box)	Legitimate interest (Art. 6(1)(f))	24 months, then monthly totals only (see section 6)
Security and technical operation of the Website	Legitimate interest (Art. 6(1)(f))	See section 6
Invoicing and tax compliance	Legal obligation (Art. 6(1)(c))	10 years (tax regulations)
Defence of legal claims	Legitimate interest (Art. 6(1)(f))	Limitation periods

4. Third-party services

The Website relies on the following providers, which process personal data on behalf of the data controller as data processors or, where stated in their own policies, as independent controllers.

4.1 Cloudflare (hosting, CDN and security)

Provider: Cloudflare, Inc. (United States).
Data processed: IP address, HTTP headers, security logs; the counts of searches made on the Website (section 2.2), stored in a Cloudflare D1 database.
Legal basis: The data controller's legitimate interest in the security and operation of the Website.
Privacy policy: cloudflare.com/privacypolicy

Searches made on the Website stay with Cloudflare, which stores them on behalf of the data controller as a processor, and are not disclosed to anyone else. The weekly summary the data controller receives contains only search texts and counts.

4.2 Google Analytics 4 (visit statistics, only with consent)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be processed by Google LLC in the United States.
Data processed: The browsing data described in section 2.2, linked to the random identifier in the _ga and _ga_FFYBQE90PG cookies. The IP address of visitors from the European Union is not logged.
Settings: Google Signals switched off, no link to Google Ads, no ad personalisation.
Legal basis: Consent, given through the banner and revocable at any time through "Cookie settings". Without consent, the Google script is not loaded.
Privacy policy: policies.google.com/privacy and how Google uses information from sites that use its services

4.3 Systeme.io (newsletter)

Provider: ITACWT Limited (systeme.io), 2 Cruise Park Rise, Tyrrelstown, Dublin 15, Ireland. According to its privacy policy, data is stored on Amazon Web Services servers in Ireland and is not transferred outside the European Union.
Data processed: Email address, date and time of sign-up; email open and link click statistics, which Systeme.io records for every mailing.
Legal basis: Consent, given by signing up with the form on the Website. Every email contains an unsubscribe link.
Privacy policy: systeme.io/privacy-policy

The Website loads no Systeme.io scripts or cookies: the newsletter form sends the address to a function of the Website on Cloudflare, which passes it on to Systeme.io.

4.4 Email

Messages written to info@matteocampagna.com pass through the ImprovMX forwarding service (ImprovMX Incorporated, United States), which delivers them to the data controller's mailbox. The «Send me an email» button opens the visitor's own email program: the message leaves from their mailbox, not from the Website.

Privacy policy: improvmx.com/privacy

The Website does not use Meta Pixel, Microsoft Clarity or any other advertising tracking tool. It loads no fonts from Google Fonts and no JavaScript libraries from external CDNs: typefaces and scripts are hosted on the Website itself. The only external script is Google Analytics, and it starts only after you consent.

5. Transfers of data outside the EU

Some providers (Google for Google Analytics, Cloudflare and ImprovMX) are based in the United States or may process data there, and their services may involve transferring personal data outside the European Economic Area (EEA). Systeme.io stores data in Ireland.

Such transfers take place on the basis of:

the EU-US Data Privacy Framework, the adequacy decision adopted by the European Commission on 10 July 2023, for certified providers: Google LLC and Cloudflare, Inc. state that they participate in it;
Standard Contractual Clauses approved by the European Commission by Decision 2021/914, for providers that are not certified or should a certification lapse;
supplementary technical measures (encryption in transit, data minimisation).

6. Data retention

Personal data is retained for the period strictly necessary to fulfil the purposes for which it was collected:

Newsletter subscribers' email addresses: until consent is withdrawn (unsubscribe link at the bottom of every email);
Client data: 10 years from the last purchase for tax compliance, then deleted;
Emails and messages exchanged with the data controller: 2 years from the last interaction, unless an earlier deletion request is made;
Technical videos submitted for analysis: 12 months from delivery of the report, then deleted unless an explicit retention request is made;
Data concerning health that you have shared: until the end of the service or until consent is withdrawn, whichever comes first; then deleted;
Visit statistics: in Google Analytics, data linked to the cookie identifier is kept for 2 months, after which only aggregated reports remain. The _ga and _ga_FFYBQE90PG cookies last up to 2 years in your browser; if you withdraw consent, the Website deletes them;
Your cookie choice: 6 months in your browser, after which the banner asks you again;
Searches on the Website: 24 months; after that, each day's counts are merged into monthly totals (text, language, number of searches), without the day or the page;
Technical and security logs: for the period set by Cloudflare, according to its privacy policy.

7. Your rights

As a data subject, you may exercise the following rights at any time (Articles 15-22 GDPR):

Right of access (Art. 15): to obtain confirmation of whether your personal data is being processed and to receive a copy of it;
Right to rectification (Art. 16): to update or correct inaccurate data;
Right to erasure (Art. 17, "right to be forgotten"): to have your data deleted in the cases provided by law;
Right to restriction of processing (Art. 18): to request the temporary suspension of processing;
Right to data portability (Art. 20): to receive your data in a structured, machine-readable format and to transmit it to another controller;
Right to object (Art. 21): to object to processing based on legitimate interests or for direct marketing;
Right to withdraw consent (Art. 7): to withdraw any consent given at any time, without affecting the lawfulness of processing carried out before withdrawal. Consent to statistics is withdrawn through "Cookie settings" at the bottom of every page; consent to the newsletter through the link in every email.

To exercise these rights, send a request to info@matteocampagna.com with the subject line "GDPR · exercise of rights". The data controller replies within 30 days.

The Website uses technical tools, which require no consent, and, only if you accept in the banner, the Google Analytics cookies. The banner appears on your first visit: "Accept" and "Reject" carry equal weight, closing it with the X counts as rejecting, and scrolling the page does not count as consent. Your choice is saved in your browser for 6 months and you can change it at any time through "Cookie settings". The full list, with duration and purpose, is on the Cookies page.

9. Processing of minors' data

The Website is not intended for people under the age of 16. The data controller does not knowingly collect personal data from minors. Where processing a minor's data is necessary (for example in services for young archers), the explicit consent of the person holding parental responsibility is requested.

10. Changes to this policy

The data controller may amend this policy at any time, in particular to reflect new legislation or technical changes. Material changes are announced through a prominent notice on the Website and, where appropriate, by email. The date of the last update is shown at the top of the page.

11. Contact and complaints

For any questions about the processing of your personal data, you can write to the data controller:

Email: info@matteocampagna.com
Suggested subject: "Privacy · information request"

You also have the right to lodge a complaint with the supervisory authority responsible for personal data protection:

Garante per la protezione dei dati personali (Italian Data Protection Authority)

Address: Piazza Venezia 11, 00187 Roma, Italy
Telephone: +39 06 696771
Email: protocollo@gpdp.it
Website: garanteprivacy.it