Personal data processing notice — Panka application

The data controller is Panka S.r.l., with registered office at Viale Aldo Moro 16, 40127 Bologna, Italy, VAT and tax code 04398091209, registered with the Bologna Companies Register under no. REA BO-590392.

Any request may be addressed to privacy@panka.app. Certified electronic mail: pankasrl@pec.it.

The Controller is also answerable for data entered by the team’s staff, having assumed sole controllership rather than allocating it to the individual managers of each group. It follows that every request may be addressed to a single party.

This document is addressed to three categories of data subject, whose positions within the application differ.

An account may be created only by persons who have reached the age of fourteen, in accordance with the threshold set in Italy pursuant to Article 8 GDPR. For that reason the date of birth is a mandatory item at registration: without it the threshold could not be verified.

Children under the age of fourteen do not have an account and may nonetheless be part of the squad: their record is entered and managed by the staff, as set out in §11.

The publication of a minor’s image on a shareable card is excluded in all cases, without exception.

The application allows images to be generated for sharing in the team’s chat: the match result, the standings, the line-up, an individual player’s card. This is the only feature that involves a name and an image leaving the perimeter of the application and it is therefore subject to specific rules.

Cards show the nickname and not the first name and surname. Where no nickname is set, the first name and the initial of the surname are shown; where the data subject has objected, the wording “Player” is shown.

Cards containing an image may be generated only in respect of adults and only within teams that have declared that they have obtained the relevant releases. The data subject may in any event share their own card, that being a decision concerning themselves.

A card link is valid for twenty days, after which it ceases to work; the image is deleted from the Controller’s servers after thirty days. Cards already forwarded to third parties cannot be recovered: expiry operates on the link generated by the Controller and not on copies already distributed.

Access to data varies according to role. The restriction is not left to the interface: it is configured at database level.

The Controller relies on suppliers that process the data on its behalf as processors, appointed pursuant to Article 28 GDPR. The data are not sold or otherwise disclosed to any other party.

Google, Apple, Meta (Facebook) and X are a separate case: where access is obtained through their authentication services, those parties do not act on behalf of the Controller but as independent controllers. They learn that Panka is being used and transmit to the Controller the name, the email address and any profile image; their own terms apply to that processing. Registration by email address is available as an alternative.

The majority of the data is processed within the European Union: the database, files and authentication are hosted in Ireland. Identification data, certificate dates, dues, ratings, images and cards therefore remain there.

The data transferred outside the European Economic Area, to the United States, are the content and recipient of push notifications, email messages and, once enabled, usage statistics. Those transfers take place on the basis of the Standard Contractual Clauses and/or of the EU-US Data Privacy Framework, with the safeguards provided for in Articles 44 et seq. GDPR.

Where access is obtained through Google, Apple, Facebook or X, authentication involves United States companies, which in that context act as independent controllers (§8).

Where the data subject is listed in a squad without having registered, the data concerning them — name, date of birth, image, certificate dates, dues, attendance — are entered by the staff. The source of the data is the team; the purposes and legal bases are those set out in §3 and §4 and this document constitutes the notice required under Article 14 GDPR.

Those data subjects have the same rights as set out in the following paragraph; their exercise does not require an account and is effected by writing to privacy@panka.app.

An objection to appearing on cards may also be raised with the team’s staff, who record it, with the same effect.

The data subject may exercise the rights of access, rectification, erasure, restriction of processing, portability and objection provided for in Articles 15 to 22 GDPR. Where processing is based on consent, that consent may be withdrawn at any time, without prejudice to the lawfulness of processing carried out before withdrawal.

Deletion of the account may be requested from within the application or, without installing it, from the “Account deletion” page published on this website.

Consent to marketing communications is withdrawn through the unsubscribe link at the foot of every message.

The right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) applies in any event.

The Controller reserves the right to amend this notice, recording any amendment by updating the date shown above. Where an amendment concerns material elements — for example the introduction of a new measurement tool — consent is sought again.