PRIVACY POLICY — PLAY FOR CHANGE INTERNATIONAL PORTAL
Website: https://www.playforchange.org
Canonical URL: https://www.playforchange.org/privacy-policy
Effective Date: October 2026
Data Controller: Play for Change Impresa Sociale S.r.l.
Registered Office: Corso di Porta Nuova 15, 20121 Milan (MI), Italy
Italian Fiscal Code & VAT Number: 11128750962 | REA Number: MI-2581113
────────────────────────────────────────────────────────────
1. INTRODUCTION AND GLOBAL REGULATORY FRAMEWORK
This Privacy Policy describes how Play for Change Impresa Sociale S.r.l. (hereinafter referred to as "Play for Change", the "Company", "we", "us", or "our"), in its capacity as Data Controller, collects, processes, stores, and protects personal data obtained from visitors, beneficiaries, donors, and institutional partners who interact with our international web portal available at https://www.playforchange.org.
We are committed to processing all personal data in strict compliance with:
• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation - GDPR);
• Italian Legislative Decree No. 196 of 30 June 2003 (Personal Data Protection Code), as amended by Legislative Decree No. 101 of 10 August 2018;
• The UK Data Protection Act 2018 and UK GDPR, in consideration of our programmatic partnership with our affiliated UK charitable trust;
• Relevant international data protection principles governing cross-border transfers and children's welfare in sport for development initiatives.
────────────────────────────────────────────────────────────
2. IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER
The primary legal entity acting as Data Controller for processing operations conducted through playforchange.org is:
• Legal Entity Name: Play for Change Impresa Sociale S.r.l.
• Corporate Status: Italian Social Enterprise (Impresa Sociale) incorporated under Legislative Decree No. 112/2017 and Third Sector Entity (ETS)
• Registered Office: Corso di Porta Nuova 15, 20121 Milan (MI), Italy
• Italian Tax Code / VAT Identification Number: 11128750962
• Chamber of Commerce Registration (REA): MI-2581113 (Milan Monza Brianza Lodi Chamber of Commerce)
• Managing Director / Legal Representative: Valeria Ignarra
• Institutional Contact Telephone: +39 02 3672 3660
• Official Data Protection and Institutional Inquiries: info@playforchange.org | info@playforchange.it
• Executive Office Inquiries: valeria@playforchange.org
2.1 Programmatic Synergy with Play for Change Charitable Trust (United Kingdom)
Play for Change was initially founded in 2013 as a UK-registered charity (Play for Change Charitable Trust, Charity Commission Registration No. 1152062). Today, international sport for development programs, social campaigns, and local field activities are managed in strategic and programmatic synergy between the Italian entity (Play for Change Impresa Sociale S.r.l.) and the UK Trust. For the purposes of European data protection regulations, the Italian entity maintains formal ownership and administration of the playforchange.org web infrastructure, serving as the responsible Data Controller under EU law.
2.2 Data Protection Officer (DPO) Assessment
In accordance with Article 37 of the GDPR, Play for Change Impresa Sociale S.r.l. is not legally mandated to appoint a statutory Data Protection Officer (DPO), as the organisation is not a public authority, does not conduct large-scale systematic monitoring of individuals, and does not process special categories of data on a large scale. All data protection inquiries, access requests, and rights notifications may be submitted directly to our designated team at info@playforchange.org.
────────────────────────────────────────────────────────────
3. CATEGORIES OF PERSONAL DATA COLLECTED AND PROCESSED
We collect only data that is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed (data minimisation principle):
3.1 Technical Browsing and Cloud Hosting Telemetry
playforchange.org is hosted on the Wix cloud infrastructure. During standard web navigation, the servers automatically log:
• Internet Protocol (IP) addresses of connecting devices;
• Date, time, and duration of the user visit;
• Uniform Resource Identifiers (URI/URL) of accessed web pages and resources;
• HTTP response codes and data volume transferred;
• User-agent strings, browser type, operating system version, and device resolution.
These technical data are processed automatically to deliver web pages, maintain system stability, balance server loads, and prevent cyber threats.
3.2 Inquiries, Program Co-Design, and Partnership Correspondence
When visitors, non-governmental organisations, sports clubs, or corporate partners communicate with us via email or submitted web forms, we collect:
• Full Name and Professional Title;
• Contact Email Address;
• Organization or Entity Represented;
• Subject matter and substantive message content;
• Any supplementary documentation transmitted voluntarily by the sender.
3.3 Annual Impact Report Digital Distribution
When visitors request access to our digital Impact Report publication, we collect:
• Email address (required to receive the digital copy or verification link);
• Full Name (optional).
In strict observance of Article 7(4) of the GDPR, the distribution of the Impact Report is fully unbundled from commercial or promotional marketing. Requesting the report does not require, nor will it be conditioned upon, consent to receive periodic newsletters.
3.4 Philanthropic Donations and Charitable Contributions
When individuals or corporate donors make financial contributions to support Play for Change international educational and athletic missions:
• Donor identification: Full Name, Company Name, Address, Tax Identification / National Insurance Number;
• Transaction metadata: Contribution amount, currency, donation date, designated program fund, payment reference;
• Payment card data security: Play for Change does NOT collect, store, or process complete credit card numbers. All electronic financial transactions are handled securely through certified PCI-DSS compliant third-party payment service providers (such as Stripe or PayPal).
3.5 Advertising and Campaign Conversion Measurement (Google Ads)
Subject strictly to explicit prior consent, our portal utilizes Google Ads conversion measurement and remarketing tags to assess campaign effectiveness and reach individuals interested in international sports development. Tracking parameters are governed under Google Consent Mode v2.
────────────────────────────────────────────────────────────
4. PURPOSES OF PROCESSING, LEGAL BASES, AND DATA RETENTION PERIODS
Every processing operation carried out by Play for Change is grounded in a specific statutory legal basis pursuant to Article 6 of the GDPR:
1. Global Web Hosting, Cyber Defense, and Infrastructure Stability:
• Legal Basis: Legitimate interests of the Data Controller (Art. 6(1)(f) GDPR) to deliver a secure, performant, and reliable international platform.
• Retention Period: System telemetry logs are retained for a maximum of 30 days, after which they are purged or irreversibly aggregated.
2. Managing and Answering Inquiries, Co-operation Proposals, and Program Requests:
• Legal Basis: Performance of a contract or pre-contractual steps taken at the request of the data subject (Art. 6(1)(b) GDPR).
• Retention Period: Retained for the duration necessary to handle and conclude the communication, and up to 2 years post-resolution for archive continuity.
3. Fulfillment of the Annual Impact Report Digital Delivery:
• Legal Basis: Performance of a contract / requested service (Art. 6(1)(b) GDPR).
• Retention Period: Retained for 12 months from transmission to verify successful delivery.
4. Sending Periodic Newsletters, Campaign Reports, and Program Updates via Email:
• Legal Basis: Freely given, specific, informed consent of the data subject (Art. 6(1)(a) GDPR), collected via an explicit, non-preselected checkbox.
• Retention Period: Retained until consent is withdrawn (via the "Unsubscribe" link included in every newsletter) or after 36 months of subscriber inactivity.
5. Administration of Charitable Donations and Statutory Accounting:
• Legal Basis: Compliance with legal and fiscal obligations (Art. 6(1)(c) GDPR) and contractual performance (Art. 6(1)(b) GDPR).
• Retention Period: Retained for 10 years in accordance with Italian statutory fiscal and corporate retention regulations.
6. Campaign Performance Measurement and Conversion Tracking (Google Ads):
• Legal Basis: Explicit consent (Art. 6(1)(a) GDPR and ePrivacy Directive Art. 5(3)), managed via our cookie consent banner and Google Consent Mode v2.
• Retention Period: Cookies and identifiers persist for durations specified in the Cookie Policy (maximum 90 days to 2 years), cancellable at any time by the user.
────────────────────────────────────────────────────────────
5. THIRD-PARTY SERVICE PROVIDERS AND CROSS-BORDER DATA TRANSFERS
To deliver global non-profit services efficiently, personal data may be communicated to trusted third-party service providers acting as Data Processors under formal data processing agreements pursuant to Article 28 of the GDPR:
5.1 Categories of Data Processors
• Website Hosting and CMS Infrastructure: Wix.com Ltd. (Tel Aviv, Israel) and Wix.com Inc. (San Francisco, CA, USA);
• Consent Management Platform (CMP) and Translation Services: CookieYes Limited (United Kingdom / Ireland) and Weglot SAS (Paris, France);
• Digital Marketing and Conversion Infrastructure: Google Ireland Limited (Dublin, Ireland) and Google LLC (Mountain View, CA, USA);
• Payment Gateway Intermediaries: Certified PCI-DSS payment processors (e.g., Stripe Payments Europe Ltd., PayPal Europe S.à r.l.);
• Professional Advisors: Certified public accountants, independent statutory auditors, and legal advisors in Italy.
5.2 International Data Transfer Safeguards (GDPR Chapter V)
Because Play for Change operates globally, personal data may be transferred to and processed in countries outside the European Economic Area (EEA):
1. Transfers to Israel (Wix.com Ltd.): Israel is recognized by European Commission Decision 2011/61/EU as providing an adequate level of data protection under Article 45 of the GDPR.
2. Transfers to the United Kingdom (Play for Change Charitable Trust, CookieYes Ltd.): Covered by the European Commission Adequacy Decision for the UK dated 28 June 2021.
3. Transfers to the United States (Wix.com Inc., Google LLC): Executed in adherence to the EU-U.S. Data Privacy Framework (DPF) where vendors are self-certified, or under the European Commission's Standard Contractual Clauses (SCCs) (Implementing Decision (EU) 2021/914).
────────────────────────────────────────────────────────────
6. YOUR RIGHTS UNDER THE GENERAL DATA PROTECTION REGULATION (GDPR)
Under Articles 15 through 22 of the GDPR, all natural persons whose data is processed by Play for Change are entitled to exercise the following fundamental rights:
1. Right of Access (Art. 15 GDPR): Obtain confirmation as to whether personal data concerning you is being processed, and receive a copy of that personal data.
2. Right to Rectification (Art. 16 GDPR): Request the prompt correction of inaccurate personal data or the completion of incomplete information.
3. Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): Obtain the erasure of your personal data where it is no longer necessary for the purposes collected or where consent has been withdrawn.
4. Right to Restriction of Processing (Art. 18 GDPR): Request that we temporarily restrict the processing of your data while its accuracy is verified, or when you object to erasure.
5. Right to Data Portability (Art. 20 GDPR): Receive your personal data in a structured, commonly used, machine-readable format, and transmit that data to another controller.
6. Right to Object (Art. 21 GDPR): Object at any time to the processing of your data based on our legitimate interests (Art. 6(1)(f) GDPR) or to direct marketing.
7. Right to Withdraw Consent (Art. 7(3) GDPR): Withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
6.1 How to Exercise Your Rights
To exercise any of the rights listed above, you may submit a written request without any administrative fee to:
• Email: info@playforchange.org (or info@playforchange.it)
• Postal Mail: Play for Change Impresa Sociale S.r.l., Corso di Porta Nuova 15, 20121 Milan (MI), Italy
Pursuant to Article 12(3) of the GDPR, we will provide a substantive response within 30 calendar days of receipt.
────────────────────────────────────────────────────────────
7. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY
If you consider that our processing of your personal data infringes the GDPR or national data protection legislation, you have the statutory right under Article 77 of the GDPR to lodge a complaint with a supervisory authority:
• Primary Supervisory Authority (Italy):
Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Rome, Italy
Telephone: (+39) 06.696771 | Email: protocollo@gpdp.it | Website: https://www.garanteprivacy.it
• Supervisory Authority for UK Residents:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
Telephone: +44 303 123 1113 | Website: https://www.ico.org.uk
────────────────────────────────────────────────────────────
8. AUTOMATED DECISION-MAKING AND SECURITY OF PROCESSING
Play for Change does not employ automated decision-making processes or algorithmic profiling as defined under Article 22 of the GDPR. We employ state-of-the-art technical and organizational security measures (including HTTPS/TLS encryption across all routes, distributed cloud firewalls, and multi-factor authentication) to protect personal data against unauthorized access or loss.
Last Updated: October 2026