Privacy Policy

Owner and Data Controller

Last updated: June 2026

Mediterranean Football SSD a R.L.
Via Filippo Tajani 50 — 00149 Roma (Italy)
VAT: IT10963991004

Owner contact email: mediterr.cup@gmail.com

Types of Data Collected

This Application collects the following categories of Personal Data, either directly from the User or through automated means.

Data provided directly by the User

  • Account registration data: First name, last name, email address, phone number, password (hashed). Purpose: Create and manage the coach/manager account; enable login and password reset.
  • Team and tournament registration data: Team name, sport, age group, tournament selection, country, team phone, declared number of players. Purpose: Register a team for a tournament; manage the registration lifecycle.

Data of third parties entered by the Coach

The Coach (team manager) enters personal data of players and staff members into the platform. By doing so, the Coach declares that they have obtained the necessary consent from the data subjects (or their parents/legal guardians, for minors) and that the data has been provided in compliance with applicable data protection laws.

  • Athlete / staff personal data: First name, last name, date of birth, gender, country of birth, nationality, city of birth (Italian citizens only), jersey number, photo and media consent. Purpose: Register athletes and staff for a tournament; manage team rosters.
  • Italian tax identification data: Codice Fiscale (Italian citizens only). Purpose: Identity verification; compliance with Italian sports regulations.
  • Health data (special category — Art. 9 GDPR): Food allergies and intolerances — 11 allergen categories (Sesame, Egg, Milk/Casein, Peanut, Fish, Shellfish, Soy, Tree nuts, Wheat, Celiac Disease/Gluten, PKU) each with severity level (None, Intolerance, Allergic reaction, Severe/Anaphylactic), plus free-text other dietary notes. Purpose: Communicate dietary requirements to tournament catering services; ensure participant safety during meals.
  • Medical documentation: Medical certificate (accepted formats: PDF, JPG, PNG, DOCX). Purpose: Verify fitness to participate in sports activities.

Documents uploaded

  • Data and Images Release Form: Uploaded by the Coach for each team, per tournament. Stored in a protected directory.
  • Participation Agreement: Uploaded by the Coach for each team, per tournament. Stored in a protected directory.
  • Medical Certificate: Uploaded by the Coach for each athlete, per team. Stored in a protected directory.
  • Additional documents (optional): Any extra documentation uploaded by the Coach. Stored in a protected directory.

Data collected automatically

  • Usage Data: IP address, browser type, access timestamps. Purpose: Security monitoring, debugging, service improvement.
  • Activity Log: Coach registrations, team creations, status changes, player additions and deletions. Purpose: Administrative auditing and monitoring.
  • Trackers (Cookies): Session cookies, technical cookies. Purpose: Authentication, security, and basic site functionality.

For detailed information on cookies, please refer to our Cookie Policy.

Legal Basis for Processing

The processing of Personal Data is based on the following legal grounds (Art. 6 and Art. 9 GDPR):

  • Account data, team data, player personal data (non-health): Performance of a contract (Art. 6(1)(b)) — registration and participation in tournaments organized by Mediterranean Cup.
  • Health data (allergies, intolerances, medical certificates): Explicit consent (Art. 9(2)(a)) of the data subject or their parent/legal guardian.
  • Codice Fiscale: Legal obligation (Art. 6(1)(c)) — compliance with Italian sports and tax regulations, or explicit consent where no legal obligation applies.
  • Usage data, activity logs, technical cookies: Legitimate interest (Art. 6(1)(f)) — ensuring network and information security, fraud prevention, service improvement.
  • Photo and media consent: Consent (Art. 6(1)(a)) — separately obtained through a dedicated checkbox.

The Coach acts as the data collection intermediary on behalf of the athletes/staff members and their parents/guardians. Mediterranean Cup processes the data as the Data Controller once entered into the platform.

Mode and Place of Processing

Methods of Processing

The Owner takes appropriate technical and organizational security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data, including:

  • Access control: Role-based access (Coach vs Administrator). Coaches can only access their own data. All access is verified server-side.
  • Encryption in transit: All data is transmitted over HTTPS (TLS).
  • Authentication: Password hashing, WordPress nonces (CSRF protection), activation links for account confirmation.
  • File protection: Sensitive documents (medical certificates, identification forms) are stored outside the public web root in a protected directory with access blocking. File downloads are routed through a controlled PHP endpoint that verifies login status and ownership.
  • Input validation: Server-side MIME type validation for all file uploads; size limits (3 MB per file); format validation (Codice Fiscale regex); sanitization of all user input before storage.
  • Database access: Access through WordPress's built-in ORM with prepared statements.

Place of Processing

The Data is processed at the Owner's operating offices and on servers located within the European Union.

Data transfers to countries outside the European Union are not currently carried out. Should this become necessary, appropriate safeguards (Standard Contractual Clauses or equivalent) will be put in place.

Retention Time

  • Account data (coach): Indefinitely, until manually deleted by an administrator.
  • Team and tournament data: Indefinitely (historical tournament records), or until deletion by coach or admin.
  • Player personal data and health data: Indefinitely (historical tournament records), or until deletion request.
  • Uploaded documents: Indefinitely, or until the related team/player is deleted.
  • Usage data and server logs: As per hosting provider defaults.

Data may be retained longer where required by applicable law (e.g., tax records, legal disputes).

Purposes of Processing

The Data concerning the User is collected to allow the Owner to:

  1. Provide the tournament registration service — Create and manage coach accounts, register teams for tournaments, manage player rosters, upload and store required documentation.
  2. Enable administrative management — Allow tournament organizers to review registrations, validate teams, monitor compliance, and communicate with coaches.
  3. Ensure participant safety — Communicate food allergy and intolerance information to tournament catering partners.
  4. Comply with legal obligations — Respond to lawful requests from public authorities, maintain tax records, comply with Italian sports regulations.
  5. Contact the User — Send account activation emails, password reset links, registration status notifications, and administrative messages.
  6. Protect rights and interests — Detect and prevent fraudulent or malicious activity, enforce terms and conditions.
  7. Display external content — Embed YouTube videos (via youtube-nocookie.com, privacy-enhanced mode) and Instagram posts on the public website.

Communication to Third Parties

The Owner may share Personal Data with the following categories of recipients:

  • Tournament organizing staff: Team names, coach names, player rosters, document status (presence/absence), allergy severity data. Purpose: Validate registrations, organize tournament logistics.
  • Catering partners: Allergen severity data (per athlete, anonymized where possible). Purpose: Ensure food safety and accommodate dietary needs.
  • Hosting provider: All data (stored on their servers). Purpose: Website and database hosting.
  • Email service provider: Email addresses, message content. Purpose: Sending transactional emails (activation, notifications, messages).
  • Public authorities: As required by law. Purpose: Legal compliance.

The updated list of Data Processors may be requested from the Owner at any time by writing to mediterr.cup@gmail.com.

Important information for Coaches regarding allergy data:
By entering allergy information, the Coach acknowledges that:

"Mediterranean Cup will use reasonable efforts to assist our catering partners to prevent the introduction of the allergen of concern into the food by passing on all relevant information to the kitchen staff. However, it is ultimately always up to the Guest to use his or her individual discretion to make an informed choice regarding whether to consume any particular items, since Mediterranean Cup cannot guarantee that allergens may not have been introduced during any stage of the food chain process."

Minors' Data (Art. 8 GDPR)

Given the nature of youth sports tournaments (categories U14, U16, U18), this Application processes personal data of minors (individuals under 18 years of age).

  • Data of minors is entered exclusively by the Coach (team manager), who acts as the intermediary of the minor's parents or legal guardians.
  • By entering a minor's data, the Coach declares that they have obtained verifiable parental consent for the processing of the minor's personal data, including health data and photo/media consent.
  • Parents and legal guardians may exercise their rights (see "Rights of Users" section below) by contacting the Owner directly at mediterr.cup@gmail.com.
  • The Owner does not knowingly collect personal data from minors directly. If it becomes aware that a minor's data has been collected without appropriate parental consent, it will be deleted.

Rights of Users (Art. 15–22 GDPR)

Users may exercise the following rights regarding their Personal Data at any time by contacting the Owner at mediterr.cup@gmail.com:

  • Right of access (Art. 15): Obtain confirmation as to whether personal data is being processed, and access a copy of the data.
  • Right to rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
  • Right to erasure (Art. 17): Request deletion of personal data ("right to be forgotten"), subject to legal retention obligations.
  • Right to restriction (Art. 18): Request restriction of processing under certain conditions.
  • Right to data portability (Art. 20): Receive personal data in a structured, commonly used, machine-readable format.
  • Right to object (Art. 21): Object to processing based on legitimate interest, including profiling.
  • Right to withdraw consent (Art. 7(3)): Withdraw previously given consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
  • Right to lodge a complaint (Art. 77): Lodge a complaint with a supervisory authority. In Italy: Garante per la Protezione dei Dati Personali (www.garanteprivacy.it).

How to exercise rights

Send an email to mediterr.cup@gmail.com with the subject "Privacy Request". The request will be answered within 30 days. Proof of identity may be required before fulfilling the request.

Cookie Policy (Summary)

This Application uses the following types of cookies:

  • Technical / session cookies: Used for authentication and CSRF protection (WordPress nonces). Duration: session.
  • Third-party cookies (YouTube): Set when viewing pages with embedded YouTube videos (privacy-enhanced mode). Duration: as per YouTube/Google policy.

Users can manage cookie preferences through their browser settings. Blocking technical cookies may prevent the Application from functioning correctly.

For the full Cookie Policy, see the dedicated page on the website.

Changes to This Privacy Policy

The Owner reserves the right to make changes to this Privacy Policy at any time. Users will be notified of material changes via:

  • A notice on the website's homepage.
  • An email to registered coaches (for changes affecting their data).

The date of the last update is indicated at the top of this page. Continued use of the Application after changes constitutes acceptance of the updated policy.

Definitions

Application: The Mediterranean Cup website and platform, accessible at https://mediterraneancup.org/.

Personal Data: Any information relating to an identified or identifiable natural person (Art. 4(1) GDPR).

Special Categories of Personal Data: Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning a natural person's sex life or sexual orientation (Art. 9 GDPR).

User: The individual using this Application, including Coaches (team managers), Administrators, and website visitors.

Data Subject: The natural person to whom the Personal Data refers (coach, athlete, staff member).

Data Controller: Mediterranean Football SSD a R.L., as identified at the top of this policy.

Data Processor: A natural or legal person who processes Personal Data on behalf of the Data Controller.

Coach: A registered user with the "coach" role, who manages team registrations and enters athlete/staff data.

This privacy policy has been prepared in compliance with EU Regulation 2016/679 (General Data Protection Regulation — GDPR), Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (Italian Privacy Code), and the guidelines of the Garante per la Protezione dei Dati Personali.