This is a courtesy translation: the Italian text is the binding version. Read it in Italian.
Privacy and cookies
What this website writes in your browser, what data the contact forms collect and who it is sent to. The data controller is Società Sportiva Dilettantistica Point 2000 SSD, which runs Athlon Club 4.0.
Data controller and data protection officer
The data controller is Società Sportiva Dilettantistica Point 2000 SSD (Athlon Club), with registered office at Via Ugo Ojetti 134, 00137 Roma. You can write to desk@athlonroma.it or, for communications that require legal validity, to point2000srl@pec.it.
The data protection officer (DPO) is Mario Cuccia, who can be reached at desk@athlonroma.it. This is the address to use for any request about your data.
Data processed and collection channels
We process your personal data through the channels below. For the technical details of what this website writes in your browser and which services it sends data to, see further down this page.
a) Browsing the website
While you browse, our systems automatically acquire some technical data needed for the website to work and to keep it secure: IP address, browser type, operating system, pages visited, date and time of access. They are used for statistical purposes in aggregate form and for security.
b) Contact forms
The website has two places where you can leave us your data: the “Prova Athlon” form and the Club Life assistant. In both cases we collect first name, last name, email address, mobile number and the activity you're interested in, plus whatever you choose to write to us.
The forms are not handled by a club server: the data is sent to an automation platform that routes it to our systems and to the club's database, hosted on servers in the European Union (Ireland). The company that runs it acts as a data processor.
c) The assistant and the phone callback request
The Club Life assistant is a conversation: what you write is sent to the automation platform to produce the reply and to allow us to get back in touch with you.
If during the conversation we offer you a phone callback and you choose to book it, the calendar that opens is ours: the day and time go into the club's schedule together with your first name, last name, email, mobile number and the text of the conversation, which we include in the subject of the call so that whoever calls you back knows what you talked about. The subject can still be edited before you confirm, and none of this data leaves our systems.
If you write to the assistant using the microphone, we do not record or keep your voice: it's your browser that turns it into text, relying on its provider's speech recognition service (Google on Chrome and Edge, Apple on Safari), to which the audio is sent for the time needed for transcription. The text appears in the field before it is sent, so you can correct or delete it. If instead you tap the speaker icon to have a reply read aloud, the reading happens entirely on your device, with your operating system's voices: nothing is sent to anyone.
d) Browser identifier and visit source
If you accept marketing cookies, the website keeps in your browser a random identifier — it contains no personal data — and the parameters of the campaign the visit came from. They are used to recognize a request coming from the same person and to understand which campaign brought it. They are attached to the forms you submit: from the moment they travel together with your name and email, they are personal data in every respect.
Without your consent they are not stored, and the forms work exactly the same way: only the information about the source is missing.
e) Enrollment and relationship with the facility
When you enroll and throughout the relationship, we collect the personal and contact details needed to provide the services and — where required by law or by sporting practice — health data, such as the medical certificate of fitness. Memberships, bookings and access are managed on the club's portal, provided by a third-party operator acting as a data processor.
f) Special categories of data (health)
Information about your health, such as the medical certificate, is processed exclusively on the basis of your explicit consent and to provide the service requested. It is not disclosed to third parties, except for obligations provided for by law.
g) Other channels
If you write to us on WhatsApp or social media, the conversation takes place on the platform of Meta Platforms Ireland Ltd, which is an independent data controller for its own part: account name, phone number and message content are also subject to WhatsApp's privacy policy. We process what emerges from the conversation to handle your request and, with your consent, for marketing purposes.
h) The club app: suggestions calculated from your visits
In the club app, to suggest the classes and the number of days a week that suit you best, we calculate how often you come to the facility: the days you came in (turnstile entries) and the classes you're recorded as attending over the last two months, with the time and type of class. This is data the club already has to manage your membership. With these figures the app tells you, for example, how many times a week it makes sense for you to come and which classes you already attend; it doesn't compare you with other members and doesn't set you targets to reach.
The calculation takes place on the club's systems: this information is not sent to the artificial intelligence services we use to write plans and tips, and the result stays in the app's memory only for the duration of the session. For this purpose we do not use the data you enter in the sections on nutrition, sleep, devices and body measurements, which have their own consent.
i) The app's virtual assistant
In the club app, the virtual assistant answers your questions about what's on your account and about the club's communications (opening hours, closures, news, events, Help Desk articles) and takes you to the place in the app where you can do things. It doesn't book, cancel or pay on your behalf: it can suggest a class or the payment of an overdue fee, but the action only starts when you tap the confirmation button yourself, on the screen that handles it. It doesn't see or store card or bank account details.
What we read to reply. Only what the app already shows you: memberships, medical certificate status, sports registration, bookings, products, payments due and made, the titles of your workout plans and, when you ask to book, the available classes. It doesn't read the content of your plans or the data you enter in the sections on nutrition, sleep, devices, body measurements and limitations, which have their own consent.
What reaches the artificial intelligence service. The reply is written by a language model that we reach through OpenRouter, Inc. (United States), which routes the request to a Google model; we only choose providers that commit not to retain the content and not to use it to train their models. We send the model your question, the latest exchanges of the conversation and the account data relevant to the reply (amounts, due dates, class names, plan titles, certificate status). We do not send it your last name, email address, phone number, tax code, IBAN, or member or card number; the names of your family members are replaced with placeholders and the system inserts the real name after the reply. What you type in the text field, however, is sent as it is: do not write data about your health. An automatic check verifies that the figures, dates and names in the reply come from the account data and that the text doesn't promise actions the assistant cannot take; if it fails, we show a fallback reply that does not go through the model.
What we keep. We keep every question and every reply, the buttons the assistant suggested to you and which one you tapped, any “Helpful / Not helpful” rating, the screen you wrote from, the model used and the account data the reply was based on. The conversations can be read by the club staff who open your record at the front desk, to understand what can't be found in the app and to improve the service. We don't use them for marketing or to profile you.
The microphone. In the app used from the browser you can dictate your question. We do not record or keep your voice: it's your browser that turns it into text, relying on its provider's speech recognition service (Google on Chrome and Edge, Apple on Safari), to which the audio is sent for the time needed for transcription. The text appears in the field before it is sent, so you can correct or delete it; it only reaches us if you press “Send”. In the app installed on your phone there is no microphone.
Purposes and legal bases
A) Service purposes, without consent
For these purposes consent is not needed, because the processing rests on other legal bases.
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Handling requests for information, forms and conversations with the assistant | Pre-contractual measures at the data subject's request — letter b) |
| Entering into and managing the membership contract | Performance of the contract — letter b) |
| Suggestions in the app about classes and attendance frequency, calculated from entries and class attendance | Performance of the contract — letter b) |
| Replies from the app's virtual assistant to your questions | Performance of the contract — letter b) |
| Storing and reading conversations with the app's assistant, to improve the service | Legitimate interest — letter f). You can object by writing to desk@athlonroma.it |
| Tax, accounting and administrative obligations | Legal obligation — letter c) |
| Registration with the relevant Sports Promotion Body or Federation | Legal obligation and performance of the contract — letters b) and c) |
| Protecting the controller's rights in and out of court | Legitimate interest — letter f) |
| IT security and proper functioning of the website | Legitimate interest — letter f) |
| Checking delivery and opening of service emails (see below, “The emails we send you”) | Performance of the contract and legitimate interest in proving the communication — letters b) and f) |
B) Marketing and measurement purposes, with your consent
With your freely given, specific and informed consent we can send you commercial communications, newsletters, offers and updates on the club's services by email, text message, WhatsApp, phone and post.
With the same consent we measure whether you open the newsletters and which links you click, so we write to you less and better: we explain this further down, in “The emails we send you”. You can turn off just this measurement and keep receiving the newsletters.
With consent to marketing cookies, we also keep in the browser the identifier and source described above, and we enable the campaign measurement tools. These are two separate consents: you can accept the communications and refuse the cookies, or the other way round.
Consent to communications is a single consent for all channels. Withdrawing it from any channel stops communications on all of them: it can't be managed channel by channel.
If you're already a member, we may send you communications about services similar to those you have already used even without new consent, unless you object (Art. 130, para. 4, of Legislative Decree 196/2003). You can object at any time.
We do not pass your data to third parties for those third parties' marketing, and we do not carry out automated profiling that produces legal effects concerning you.
The emails we send you: opens and clicks
Our emails may contain an invisible image (a “tracking pixel”) and links with a code. When you open the email or click a link, your email program loads the image or goes through the code, and we record whether and when you opened it and which link you followed. We do not keep your IP address or the program or device you read it on. Sending and these records are handled by Twilio SendGrid, which acts on our behalf as a data processor.
In newsletters and promotional communications
We measure them with your marketing consent (letter B above), to understand what interests you and write to you less and better. At the bottom of every newsletter there's the “Manage tracking” link: with one click you turn off only the measurement and keep receiving the newsletters, unchanged, without the invisible image and without codes in the links. You can turn it back on from the same page. Refusing the measurement changes nothing else in your relationship with the club.
In service emails
Emails about your relationship with the club — confirmations, reminders of contract, medical certificate or payment method deadlines, payment notices, communications about how activities are organized — are communications we must be able to prove we sent you. For these we record delivery, opening and clicks as proof that the communication took place, on the basis of the performance of the contract and our legitimate interest in protecting our rights (Art. 6, letters b) and f) of the GDPR; Art. 122 of Legislative Decree 196/2003 and the Italian Data Protection Authority's guidelines on tracking pixels in emails, decision no. 284 of 17 April 2026). We do not use this data for marketing or to profile you. You can object by writing to desk@athlonroma.it.
Records of opens and clicks are kept with the email they refer to: those for newsletters for the retention period of contact data for marketing, those for service emails for the retention period of contract data (see “How long we keep data”).
Recipients of the data
Your data may be made accessible or disclosed only to the parties listed here. The list of technical services, with each one's domain and the reason, is further down this page and is kept up to date together with the website.
Within the club
Employees and collaborators authorized to process data — reception, sales team, instructors, administration — bound by a duty of confidentiality.
Data processors (Art. 28 GDPR)
- External consultants — accountant, payroll consultant, lawyer — for tax, accounting and legal obligations.
- The provider of the automation platform that receives the forms and conversations, and the provider of the database where they are stored, with servers in the European Union.
- The provider of the club portal for memberships, bookings and access.
- OpenRouter, Inc., which routes the questions asked to the app's virtual assistant to a Google language model, without retaining their content or using it to train models.
- The provider of the consent collection system for cookies.
- Twilio SendGrid, for sending emails and recording delivery, opens and clicks.
- The provider of the site's publishing infrastructure.
Independent controllers
- Sports Promotion Body or relevant Federation, for the mandatory membership registration (tesseramento) requirements only.
- Google Ireland Ltd, for managing measurement tags and for the map of our premises.
- Meta Platforms Ireland Ltd, for conversations started on its channels and for any advertising tools activated with your consent.
- Vimeo and the provider of the virtual tour, for the multimedia content embedded in the site.
- Judicial and administrative authorities, in the cases provided for by law.
Your data is not sold, transferred for third-party marketing or publicly disclosed.
Transfers outside the European Union
The club's database is hosted on servers in the European Union (Ireland), and the data we process directly stays there.
However, some of the services the site uses are provided by US companies and involve transferring data to the United States:
- Google, for tag management and the map;
- Vimeo, for embedded videos;
- Meta, for its channels and any advertising tools;
- Twilio SendGrid, for sending emails;
- OpenRouter and the language model provider (Google), for the answers of the app's virtual assistant.
The transfer is based on the adequacy decision adopted by the European Commission for the United States (EU-US Data Privacy Framework) for providers that have joined it, and on the Standard Contractual Clauses where that does not apply.
Tools that require your consent are not activated, and therefore transfer nothing, until you give it.
How long we keep data
| Type of data | Retention |
|---|---|
| Contract and membership data | 10 years from the end of the relationship |
| Invoices and accounting and tax documents | 11 years, as required by law |
| Contact data for marketing | 2 years from collection or from the last consent, unless withdrawn earlier |
| Requests from forms and conversations with the assistant | 2 years, under the same rule as contact data |
| Conversations with the app's virtual assistant | Until you ask for them to be deleted. Automatic deletion is not yet in place: you can ask for it at any time at desk@athlonroma.it |
| Health data, such as the medical certificate | For the duration of the relationship and until legal obligations have been fulfilled |
| Technical browsing data | Up to 12 months, unless legal obligations on IT security apply |
| Browser identifier and source of the visit | Until you withdraw your consent or clear your browser. The exact durations are further down this page |
| Data you have asked us to delete | Kept in protected form with restricted access for a maximum of 12 months, then deleted or anonymized |
Your rights
As a data subject you have the rights provided for by Articles 15–21 and 77 of the GDPR:
- Access (Art. 15): to know whether we process your data and receive a copy of it.
- Rectification (Art. 16): to correct inaccurate or incomplete data.
- Erasure (Art. 17): to have your data erased, in the cases provided for.
- Restriction (Art. 18): to restrict processing in certain cases.
- Portability (Art. 20): to receive your data in a machine-readable format.
- Objection (Art. 21): to object to processing for marketing or on legitimate personal grounds.
- Withdrawal of consent (Art. 7): to withdraw it whenever you like, without affecting processing already carried out.
- Complaint (Art. 77): to contact the Garante per la protezione dei dati personali (the Italian Data Protection Authority).
To opt out of marketing you can withdraw your consent whenever you like, with effect on all channels: write to desk@athlonroma.it or use the unsubscribe link at the bottom of every message we send. To turn off only the tracking of opens and clicks and keep receiving newsletters, use the «Manage tracking» link at the bottom of every newsletter. For cookies there is a button further down this page.
How to exercise your rights
Write to the DPO at desk@athlonroma.it, or to the controller: Società Sportiva Dilettantistica Point 2000 SSD, Via Ugo Ojetti 134, 00137 Roma — desk@athlonroma.it, point2000srl@pec.it.
We reply within 30 days of receipt, as required by Art. 12 of the GDPR. In complex cases the deadline may be extended by a further 60 days, and if so we will let you know and explain why.
Cookies and tracking tools
The site uses cookies and similar technologies, divided into the categories the banner shows you on your first visit: necessary, functional, analytics, performance and marketing. Only the necessary ones do not require your consent, because the site does not work without them.
One thing worth saying, because it is not obvious: part of what this site stores in your browser is not cookies in the technical sense but browser storage. The same rule governs them, and you will find them listed one by one, with duration and category, further down this page.
Measurement and advertising tools are managed through Google Tag Manager, the system used to turn them on or off: none of those subject to consent starts before you have given it. Which ones are active at any given time is shown in the preferences panel, which is updated from the site scan.
The site also embeds third-party content that may set its own cookies: the map of our premises, the videos and the virtual tour. Until you consent they are not loaded, and a placeholder appears in their place.
How to manage cookies
On your first visit a banner asks for your preferences. You can change them whenever you like from the preferences panel on this page. You can also manage or delete cookies from your browser settings, and turn off interest-based advertising at youronlinechoices.eu.
Scrolling or browsing the site does not count as accepting. We only collect consent through an action you take on the banner.
Changes to this notice
This notice may be updated to reflect regulatory, technological or organizational changes. If the changes are substantial we will flag them on the site or with a direct message. The version in force is always the one published here, with the date of the last revision.
Last revised: 30 October 2026 · version 2.4
What this site writes in your browser
They are not cookies in the technical sense — they are localStorage and sessionStorage — but the rule is the same: anything that is not needed to make the site work for you is only written if you consent.
| First name | What it contains | Duration | Category |
|---|---|---|---|
athlon_vidlocalStorage | A random browser identifier, with no personal data in it. It is used to recognize a request coming from the same person when they come back, even with a different email address. | Until the browser is cleared | Marketing |
athlon_utmsessionStorage | The campaign the visit came from (utm_* parameters, gclid, fbclid), read once at the first touch. | The browser session | Marketing |
athlon_prova_suggeritalocalStorage | When you were shown, or closed, the banner suggesting you try for a week the activities you looked at on a previous visit, so it is not shown to you again too often. | Up to 7 days after closing it | Marketing |
athlon_emaillocalStorage | The email address you have already entered in a form, so we don't ask you for it again **when you come back**, even days later. It stays on your device: it is not read back by our systems, and on the kiosk at the club entrance it is never stored or shown. | Until the browser is cleared | Functional |
athlon_email_visitasessionStorage | The same address, but for the **current visit**: if you write it in the trial form and then open «contact us» or the assistant, we don't ask you for it all over again. It is the continuation of the form you are filling in, it disappears when you close the tab, it is never read back by our systems, and on the kiosk at the club entrance it is never stored. That is why it does not depend on consent, unlike athlon_email, which recognizes you on your next visit. | The browser session | Necessary |
athlon:assistente:sessionesessionStorage | The identifier of the conversation with the assistant, so that an answer knows what was asked before. | The browser session | Necessary |
athlon:helpdesksessionStorage | The point reached in the FAQ box, so you don't start over when you change page. | The browser session | Necessary |
athlon_sidsessionStorage | A visit identifier, with no personal data in it, that groups the pages viewed in the same tab: it says how many pages a visit had, not who made it. As with athlon_utm, your consent is not needed because it disappears with the tab and does not identify anyone on its own. | The browser session | Necessary |
athlon_notracklocalStorage | The flag for those who have asked not to be counted among visits: it is used by people working on the site, so that their tests don't skew the numbers. It only exists if it has been switched on, and its effect is that no page view is recorded from this browser. | Until the browser is cleared | Necessary |
The two marked «Marketing» are written only after your consent. If you refuse, the site works exactly the same and forms are sent the same way: the only thing missing is the information about which campaign brought you here.
Contact forms
The site has two places where you leave data: the «Prova Athlon» form and the Club Life assistant. Both collect first name, last name, email address and mobile number, plus the activity you are interested in.
These submissions do not depend on cookie consent, and the distinction is worth explaining: cookie consent concerns what is stored in your browser, while the data in a form is something you are sending us yourself, for the request you are making. If you have consented to marketing, the form also includes the identifierathlon_vid and the source campaign; if you have not consented, the form is sent without them.
Where the data goes
| Service | Why |
|---|---|
n8n (the club's automation)automazione.n8ndevelop.it | Receives the messages you write to the site's assistant. |
Supabase (the club's database)kdbcwwpdazvtmjolybdm.supabase.co | Receives the data of the «Prova Athlon» request, from the form or the assistant, of the contact form, of the club tour, of the callback request, of the request for information on memberships, of the invitation to a friend, of the swimming placement trial, of the data you leave in the assistant to be registered or contacted again by the team, together with the conversation, of the help desk request, with any attachment, of the job application, with the CV, of the membership change request, of the request for the link to enter the app from the «Book» buttons and from the event enrollment buttons (only the email, to send you the link), and of the request to reset the portal password: first name, last name, email, mobile number, the activity of interest, the child's details when the request is for them and, if consented, the campaign attribution. It receives the email (or the member number) you write in the forms, in the chat and in the «Join» buttons, to check on the club's portal whether you are already registered or a member, together with the page you are writing from and the visit identifier. It also receives, for every page loaded, the visit identifier and the page itself, and likewise when you open the assistant or press a «Join» button: this is a count of how many pages are viewed and how many times those buttons are pressed, not a form filled in. It is the database where the club keeps the requests received from the site. |
PerfectGymathlon.perfectgym.com | The club's portal: registration, memberships, class booking. |
Google Tag Manager and Google Mapsgoogletagmanager.com, google.com | Management of measurement tags and the map of our premises at the bottom of every page. |
Vimeoplayer.vimeo.com | The videos of Athlon TV and of the activity pages, requested in «do not track» mode. |
MPSkinmy.mpskin.com | The virtual tour of the facility. |
CookieYescdn-cookieyes.com | Collects and stores your cookie choice, and shows it again on every visit. |
The list of cookies
The full list, with the name, purpose and duration of each one, is the one you find in the preferences panel below: it is generated by the site scan and updates itself.
Changing your mind
You can review or withdraw your consent whenever you like, and there is no need to clear anything.
