Last updated: 7 August 2026
This document relates solely to the panka.app website. The Panka application carries out processing of a different nature (squads, matches, ratings) and is governed by separate documents, available in the Legal documents section.
The panka.app website serves informational and promotional purposes and collects contact requests from data subjects. This document sets out which personal data are processed, for which purposes, on which legal basis and for how long they are retained.
Notice provided pursuant to Article 13 of Regulation (EU) 2016/679 (the “GDPR”) and to Italian Legislative Decree no. 196/2003, as amended by Legislative Decree no. 101/2018 (the “Privacy Code”).
The data controller is Panka S.r.l., with registered office at Viale Aldo Moro 16, 40127 Bologna, Italy, VAT and tax code 04398091209, registered with the Bologna Companies Register under no. REA BO-590392, share capital EUR 10,000.00 fully paid up.
Any communication concerning the processing of personal data may be addressed to privacy@panka.app or, by certified electronic mail, to pankasrl@pec.it.
The Controller processes personal data when the data subject submits the contact form, consents to receive marketing communications, consents to statistical or marketing cookies, submits an account deletion request, and when its systems log incoming requests for security purposes. The table below sets out, for each purpose, the data processed, the legal basis and the retention period.
| Purpose | Data processed | Legal basis | Retention |
|---|---|---|---|
| Responding to requests submitted through the contact form and administering the beta testing phase | Name, email address, team name (optional), content of the message, page language | Performance of pre-contractual measures taken at the data subject’s request (Article 6(1)(b) GDPR) | 24 months from the last contact, after which the data are deleted |
| Statistical measurement of visits and pages viewed (Google Analytics 4) | Statistical cookie identifier, pages viewed, IP address in anonymised form, device and browser type, language, traffic source | Consent of the data subject (Article 6(1)(a) GDPR), which may be withdrawn at any time | 14 months |
| Prevention of automated access and abuse, security and proper operation of the website | IP address, user agent, outcome of the anti-bot check, server technical logs | Legitimate interest of the Controller in the security of the service (Article 6(1)(f) GDPR) | A maximum of 30 days |
| Sending marketing communications about Panka, its initiatives and partnership updates, subject to the specific consent given in the form | Name, email address, language, date of consent and version of the text accepted | Consent of the data subject (Article 6(1)(a) GDPR), which may be withdrawn at any time | Until consent is withdrawn. Following withdrawal the address is deleted and only the evidence of the consent given is retained |
| Measurement of advertising campaigns and remarketing on Google, YouTube and websites in the Google network (Google Ads) | Advertising cookie identifier, pages viewed, actions taken on the website (for example submission of the form), IP address, device and browser | Consent of the data subject (Article 6(1)(a) GDPR), which may be withdrawn at any time | The cookie stored on the device lasts 90 days; retention in remarketing lists does not exceed 540 days |
| Measurement of advertising campaigns and remarketing on Facebook and Instagram (Meta Pixel) | Advertising cookie identifier, pages viewed, actions taken on the website (for example submission of the form and selection of the store buttons), IP address, device and browser | Consent of the data subject (Article 6(1)(a) GDPR), which may be withdrawn at any time | The cookie stored on the device lasts 90 days; retention in custom audiences does not exceed 180 days |
| Receipt and handling of account deletion requests submitted through the form published on the website | Name, account email address, content of the request, page language | Compliance with a legal obligation and the need to demonstrate that it has been fulfilled (Articles 6(1)(c), 12 and 17 GDPR) | 24 months from the request, being the period during which the Controller must be able to demonstrate that it acted upon it |
The Controller carries out no automated decision-making within the meaning of Article 22 GDPR and does not sell or otherwise disclose personal data to third parties. Where consent to marketing cookies is given, Google and Meta may recognise the data subject and display advertisements relating to Panka outside this website — on Google services and websites in the Google network, and on Facebook and Instagram respectively: that activity constitutes profiling for advertising purposes and is conditional upon consent.
The name, email address and message are required in order to respond to the request; without them the Controller cannot reply. The team name is optional and is used solely to place the request in context.
The data submitted are stored in a Supabase database hosted in Ireland and delivered to the Controller in copy by email through Resend. Before submission, the Cloudflare Turnstile service verifies that the request does not originate from an automated system.
The data are used solely to respond to the request and, where the data subject expresses an interest in joining the beta, to activate the service for their team. They are not disclosed to third parties nor used for the advertising purposes of any party other than the Controller.
Data subjects are advised to limit the content of the message to the information required. The form is not intended for the transmission of health data, identity documents or information relating to third parties.
The contact form includes an optional, non-pre-ticked box by which the data subject may consent to receive by email communications relating to Panka, its initiatives and partnership updates. That consent is independent of the submission of the message: a reply to the request is provided even where consent is not given.
Every communication contains the link for withdrawing consent, which takes effect upon express confirmation. Following withdrawal the address is deleted from the list and is not kept in a suspended state; only the evidence of the consent given is retained, consisting of the relevant dates and the address in encrypted form, which is necessary to discharge the burden of proof under Article 7(1) GDPR and cannot be used to send further communications.
The Controller does not send marketing communications on behalf of third parties and does not disclose the list of recipients to any party other than the processors listed in §5.
The following is specified. Contacts acquired before the box was introduced are not included in any list: consent takes effect from the moment it is given and has no retroactive effect. Withdrawal of consent to marketing communications does not affect the data submitted through the contact form, which remain subject to the retention period of 24 months from the last contact, given their different purpose and legal basis.
In order to operate the website the Controller relies on suppliers that process personal data on its behalf as processors, appointed pursuant to Article 28 GDPR and bound to act on the instructions received. The data are not disclosed to anyone other than the parties listed below.
Google is a separate case. For statistical purposes it acts as a processor; for advertising purposes it determines the purposes and means of the processing independently and therefore acts as an independent controller, under the terms published at policies.google.com/technologies/ads. For that reason the banner collects consent to statistical purposes and consent to marketing purposes separately.
Meta is likewise a separate case, and a different one from Google. As regards the collection of data by means of the pixel and its transmission to Meta Platforms Ireland Limited, that company and the Controller jointly determine the purposes and means of the processing and are therefore joint controllers within the meaning of Article 26 GDPR, under the arrangement published at facebook.com/legal/controller_addendum; processing subsequent to the transmission is determined by Meta as an independent controller. Data subjects may exercise the rights under Articles 15 to 21 GDPR against either joint controller and, in respect of the data processed by Meta, directly against Meta.
| Supplier | Activity carried out | Place of processing |
|---|---|---|
| Cloudflare | Website hosting, protection against attacks and the Turnstile anti-bot check | Global network; parent company established in the United States |
| Supabase | Storage of the messages received through the form | Ireland (European Union) |
| Resend | Delivery to the Controller of the notification of new messages and, where consent is given, sending of marketing communications | United States |
| Visit statistics (Google Analytics 4) and advertising campaign measurement (Google Ads), both conditional upon consent | United States | |
| Meta Platforms Ireland | Advertising campaign measurement and remarketing on Facebook and Instagram (Meta Pixel), conditional upon consent | Ireland (European Union), with access to the data also from the United States |
An up-to-date list of processors is available on request, to be sent to privacy@panka.app.
The content of messages is retained within the European Union: the database is hosted in Ireland.
The only data transferred outside the European Economic Area, to the United States, are email messages — the notification sent to the Controller and, where consent is given, marketing communications (Resend) — and, where consent is given, statistical and advertising data (Google) and the advertising data collected by means of the pixel (Meta: the contracting party is established in Ireland, but the data are also made accessible in the United States). Those transfers take place on the basis of the Standard Contractual Clauses adopted by the European Commission and/or of participation in the EU-US Data Privacy Framework, to which both suppliers adhere, with the safeguards provided for in Articles 44 et seq. GDPR.
On the first visit a banner is displayed allowing consent to be given or refused in respect of two separate categories: statistics and marketing. Until a choice is made, only technical cookies, necessary for the operation of the website, are active.
Statistical cookies allow the Controller to measure the number of visits and the pages viewed. Marketing cookies relate to Google Ads and to the Meta Pixel and allow the effectiveness of advertising campaigns to be measured and advertisements relating to Panka to be displayed again on Google, on YouTube and on websites in the Google network, as well as on Facebook and Instagram. The two consents are independent and may be given separately.
A complete list of cookies, with their names and durations, is set out in the cookie policy. Consent may be changed at any time through the “Cookie preferences” link at the foot of every page; withdrawal of consent to marketing purposes results in immediate notification to Google and to Meta that the relevant data may no longer be used.
The website is addressed to persons who organise and manage a football team; the contact form and the subscription to marketing communications are intended for adults. In Italy, in relation to information society services, consent on behalf of a child under the age of fourteen must be given by the holder of parental responsibility (Article 8 GDPR and Article 2-quinquies of the Privacy Code).
The same threshold applies to the banner: below that age a child cannot validly consent to statistical or marketing cookies.
The Controller does not request the date of birth and is therefore unable to verify it. Should it establish, including following a report, that a contact or a subscription relates to a child under the age of fourteen, it will delete the relevant data without requiring any explanation. Reports may be sent to privacy@panka.app.
The data subject may at any time exercise the rights of access, rectification, erasure, restriction of processing, portability and objection provided for in Articles 15 to 22 GDPR. Where processing is based on consent, that consent may be withdrawn at any time, without prejudice to the lawfulness of processing carried out before withdrawal.
Requests are to be sent to privacy@panka.app and are answered within one month of receipt. The data subject retains in any event the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of their country of residence.
Data are transmitted using an encrypted protocol (HTTPS). The database is not publicly accessible and the messages table may be consulted only by the Controller’s personnel tasked with responding to requests. The form is protected by an anti-bot verification system.
The Controller reserves the right to amend this notice, recording any amendment by updating the date shown above. Where an amendment concerns material elements — for example the introduction of a new measurement tool — consent is sought again through the banner.