1. Who we are (data controller)
The controller of your personal data is NEXTA SRL, VAT no. IT02602140978, registered office at Via Fabbroni 12, 59100 Prato (PO), Italy. For any privacy matter write to privacy@ksm-official.com. Certified email (PEC): amministrazione@pec.nextasolutions.it. We have not appointed a Data Protection Officer (DPO): our processing does not fall within the mandatory appointment cases of Art. 37 GDPR. We prefer to say so rather than imply there is a role that does not exist: the contact point for privacy is the mailbox above.
2. What this policy covers
This policy describes how we process the personal data of everyone using the platform: visitors, registered users, kiters, professionals (instructors, coaches, schools, shops) and buyers. Important exception — KSM Spaces (B2B): for data about students, instructors and clients managed by schools through the Spaces module, KSM acts as a data processor on behalf of the school, which is the controller. See the Spaces section. This policy does not apply to third-party sites or services linked from the platform.
3. What data we process
We only process the data needed for the features you use. Here is the list, feature by feature.
Account and profile
Email, username and password (stored only in hashed form: we never know your password in plain text). Optional profile data: name, photo, bio, experience level, gear (quiver), preferred language. If you sign in with Google we receive your name, email and profile picture: we never receive your Google account password.
Public kiter profile
Your kiter profile (username, photo, bio, stats, achievements, published content) is publicly visible on the platform. You decide what to publish; account data, starting with your email, is never public.
Community content
Posts, comments, likes, reposts, follows, reviews and photos you upload in posts, on your profile, in marketplace listings and in professional storefronts. Published content is visible to other users: do not upload data you do not want to make public, and do not post photos of other people without their consent.
Location (spot check-ins)
If you use check-in at a spot in the catalogue we process your location only at the moment of check-in and only to record it. We do not track your location continuously and we do not use background location. The location permission is managed by your operating system and you can revoke it whenever you want: without it the platform stays usable, simply without geolocated check-in.
Gamification
XP, achievements, badges and leaderboard position, computed from your activity on the platform. The leaderboard publicly shows username, avatar and score.
Second-hand marketplace
Published listings, offers and counter-offers exchanged with other users, messages related to negotiations and reviews of completed deals.
Purchases and payments (shop, e-learning, lessons, KSM Pro)
Order data: products or services purchased, amounts, billing and shipping address, tax data where required. Payment data is collected and processed directly by Stripe, a PCI-DSS certified provider: KSM never receives or stores your full card number, we only see the payment outcome, the last four digits and the card network, for support and reconciliation. For subscriptions we process status, expiry dates and renewals.
Travel booking requests
KSM does not sell and does not organise trips. When you send a request for a trip published by a host (school, kite centre, organiser) we process the request data — dates, number of participants, contact details, message, preferences — and pass it to the host, who from that moment is an independent controller for handling the negotiation and the trip. Payment for the trip happens between you and the host: KSM does not collect the trip price and does not receive your payment data for that transaction. We keep the existence and status of the request to run the service and to calculate the intermediation fee owed by the host.
Event sign-ups (GetResponse form)
On our event landing pages, for example Week’nd Fly, the sign-up form is hosted by GetResponse S.A. and collects name, email, phone number, date of birth, height and weight. Height and weight are used to size the kite and board and to assess suitability for the on-water session: they are not health data and we do not use them for anything else. The data does not pass through KSM systems: your browser sends it directly to GetResponse, which stores it in the organiser’s contact list and is therefore an independent controller of that processing. Legal basis: the consent you give by submitting the form (Art. 6.1.a GDPR) and the performance of pre-contractual measures at your request (Art. 6.1.b). You can withdraw consent and ask to be removed from the list using the unsubscribe link in every email. The form also loads Google reCAPTCHA anti-abuse protection, which receives technical data about your browser to tell a person from a bot.
Messaging
The messages you exchange with other users through in-app messaging. We do not use them for profiling or advertising; we access them only where necessary to comply with legal obligations or to handle abuse reports.
Notifications
Service emails (order confirmations, account security, activity notifications) sent through Mailgun on European infrastructure. Push notifications, coming to iOS and Android: device token, handled through APNs (Apple) and FCM (Google). You can disable push from your device or from the in-app notification preferences.
Technical data, logs and diagnostics
Access and security logs: IP address, date and time, user agent, request method and path, technical headers, request parameters and payload, authentication events; for requests that end in an error we also record the server response, so that we can diagnose it. Passwords are masked, the content of private messages and reviews is not recorded, and headers carrying credentials (session cookies, tokens) are redacted. Error tracking with Sentry: when a technical error occurs we collect diagnostic data (error type, device, app version, user identifier if you are signed in) to fix malfunctions.
Data we do NOT process
We do not collect special categories of data (for example health data) as a requirement of the service: if you choose to include them in free-form content, for example in your bio, you are making them public voluntarily. We do not sell personal data to third parties. We do not run behavioural advertising.
4. Why we process data and on what legal basis
Every processing operation has a stated purpose and legal basis. This is the complete table.
| Processing | Purpose | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Account, profile, community, gamification, marketplace, messaging | Providing the service you requested by signing up | Performance of a contract (Art. 6.1.b) |
| Geolocated check-in | Recording the check-in at the spot you choose | Performance of a contract (Art. 6.1.b) upon your voluntary action; the device location permission stays under your control |
| Orders, payments, subscriptions, lesson bookings | Executing purchases, renewals and bookings | Performance of a contract (Art. 6.1.b) |
| Travel booking requests forwarded to the host | Putting you in touch with the host, who handles and collects payment for the trip | Performance of the intermediation contract with you (Art. 6.1.b) and pre-contractual measures at your request |
| Event sign-up through the GetResponse form (name, email, phone, date of birth, height, weight) | Handling the sign-up, sizing the equipment, assessing suitability for the on-water session | Consent given by submitting the form (Art. 6.1.a) and pre-contractual measures (Art. 6.1.b) |
| Invoicing and accounting | Complying with tax and accounting obligations | Legal obligation (Art. 6.1.c) |
| Moderation, report handling, abuse and fraud prevention | Keeping the community safe and enforcing the Terms | Legitimate interest (Art. 6.1.f) and, where applicable, legal obligation (Art. 6.1.c) |
| Technical logs, security, error tracking | Security, service continuity and bug fixing | Legitimate interest (Art. 6.1.f) |
| Service emails and system notifications | Communications necessary for the operation of the service | Performance of a contract (Art. 6.1.b) |
| Push notifications and optional notification preferences | Keeping you updated on activity you care about | Consent (Art. 6.1.a), revocable at any time from the in-app preferences or your device |
| Promotional communications, if and when we enable them | Direct marketing | Consent (Art. 6.1.a), revocable at any time |
| Defence of legal claims | Legal protection | Legitimate interest (Art. 6.1.f) |
Providing the data marked as mandatory at sign-up or at purchase is necessary for us to deliver the service: without it we cannot act on your request. All other data is optional.
5. How long we keep data
We keep data only for as long as needed for the purposes it was collected for.
| Category | Retention |
|---|---|
| Account and profile | While the account is active. Upon deletion the account is anonymised: identifying data is removed or replaced and the account row remains without any identity, because it is tied to orders and payments we must keep by law. Public content (posts, reviews, Pro showcase, listings) is withdrawn from publication; comments, reposts, the session log and alerts are deleted |
| Community content and photos | While the account is active or until you delete them; upon account deletion the above applies |
| Geolocated check-ins | While the account is active, as part of your activity history; erased or anonymised together with the account |
| Messages | While the account is active; upon deletion your side of the conversation is anonymised |
| Travel booking requests | While the account is active, to handle the negotiation and calculate the fee owed by the host. Data already passed to the host follows the retention the host decides as an independent controller |
| Order and invoicing data | 10 years (Italian civil and tax obligations, Art. 2220 Civil Code) |
| Technical and security logs | 14 days, both for the log files of the production systems (daily rotation) and for the application access log kept in the database, which a nightly job deletes beyond that threshold |
| Spaces document acceptance register | For the whole life of the Space and ten years thereafter: it is the proof of which version of the contract and of the DPA was accepted, by whom and when, and it is what makes it possible to reconstruct the terms a Space operated under. When an account is deleted, the technical data of the request (IP address and browser) are removed immediately; what remains is the fact — document, version and date — attached to an account that no longer has an identity |
| Error-tracking diagnostic data | 90 days |
| Event sign-ups (GetResponse) | Retention decided in the organiser’s contact list; you can unsubscribe at any time from the link in every email |
| Litigation management data | Until the dispute is settled and the related limitation periods expire |
7. Providers that process your data
To run the platform we rely on the providers listed below: some receive data from our systems, others are contacted directly by your browser when you use a feature (maps, videos, statistics). We do not sell your data to anyone.
| Provider | Purpose | Where the data is processed |
|---|---|---|
| Stripe Payments Europe, Ltd.under reviewReceives data from our systems | Payments, subscriptions and fraud prevention | European entity (Ireland), with possible processing in the United States Processing outside the European Union is possible |
| Sinch MailgunReceives data from our systems | Service emails: confirmations, notifications, password recovery | European infrastructure (EU endpoint configured) Data processed in the European Union |
| Functional Software, Inc. (Sentry)Receives data from our systems | Detection of technical application errors | European infrastructure (Germany); group companies in the United States Processing outside the European Union is possible |
| DigitalOcean LLCReceives data from our systems | Infrastructure hosting and storage of uploaded files | Frankfurt datacenter (Germany); group companies in the United States Processing outside the European Union is possible |
| Google Ireland Limitedunder reviewReceives data from our systems | Signing in with a Google account if you choose social login, and reCAPTCHA anti-abuse protection on the event sign-up form | European entity (Ireland), with possible processing in the United States Processing outside the European Union is possible |
| Plausible Insights OÜunder reviewContacted directly by your browser | Aggregate usage statistics, without cookies | European Union Data processed in the European Union |
| YouTube (Google Ireland Limited)under reviewContacted directly by your browser | Playback of lesson videos, only after you press play | European entity (Ireland), with possible processing in the United States Processing outside the European Union is possible |
| OpenFreeMapunder reviewContacted directly by your browser | Maps and map tiles for spots | To be confirmed Location to be confirmed |
| EOX IT Services GmbHunder reviewContacted directly by your browser | Satellite imagery on the spot page (satellite view) | Austria (EU): the provider's registered office Location to be confirmed |
| GetResponse S.A.Contacted directly by your browser | Sign-up form for Week’nd Fly events: it collects name, email, phone number, date of birth, height and weight, the last two to size the equipment and assess suitability for the on-water session. Legal basis: the consent you give by submitting the form, and pre-contractual measures to handle the sign-up | Poland (European Union). The data does not pass through KSM systems: your browser sends it directly to GetResponse, which is an independent controller of the contact list Data processed in the European Union |
Entries marked “under review” are being checked with our legal counsel: exact company name, place of processing and contractual safeguards will be confirmed in the next version of this notice. You can ask us for the up-to-date list at any time.
8. Transfers outside the European Union
The infrastructure hosting the platform and the files you upload is in the European Union: DigitalOcean, Frankfurt (Germany) datacenter. For hosting, therefore, there is no transfer of data outside the EU. That, however, does not mean there are no transfers at all. Some providers belong to non-EU groups or may process data outside the Union: — Stripe (payments): Irish contracting entity, possible processing in the United States; — Sentry (error tracking): collection in the German region, but a US parent company; — Google and YouTube (social login, reCAPTCHA on the event form, lesson videos): Irish entity, possible processing in the United States; — DigitalOcean: the data sits in Frankfurt, but the parent company is American and may access it for technical support. Where a transfer does occur, it is protected by the Standard Contractual Clauses approved by the European Commission and/or certification under the EU-U.S. Data Privacy Framework, plus supplementary measures such as encryption in transit and minimisation. You can request a copy of the safeguards at privacy@ksm-official.com.
9. Listings imported from other portals
To enrich the marketplace, KSM may show — in a dedicated, clearly labelled section — used-gear listings published on third-party portals we have an agreement with. For each listing we import only the essential data (title, category, brand, model, price, area) and at most one photo referenced from the source site; we do not copy the description or your contact details. Every listing shows the source and a direct link to the original portal, where all contact and negotiation take place. Legal basis: legitimate interest (Art. 6.1.f). Retention: 30 days maximum, with automatic removal when the listing disappears from the source. You can ask for your listing to be removed at any time via the «Remove this listing» button on every card: removal is immediate and prevents re-import. This content is not indexed by search engines nor used for marketing or profiling.
10. Your rights
The GDPR grants you the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21), as well as withdrawal of consent at any time, without affecting processing already carried out. Directly in the app. You can exercise many rights on your own from the settings: export of your data in a structured format (portability), account deletion — which anonymises your profile and withdraws your public content from publication, as described in the retention table — notification preferences channel by channel, profile editing at any time. By email. For everything else write to privacy@ksm-official.com. We reply within 30 days, extendable by 60 days in complex cases with notice. Exercising your rights is free of charge. Complaints. If you believe the processing infringes the GDPR you can lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it) or with the authority of your EU country of residence, without prejudice to judicial remedies.
11. Minors: 14 to sign up, 18 to buy
You can register on the platform if you are at least 14 years old. That is the age set in Italy by Art. 2-quinquies of the Italian Privacy Code for consent to information society services, using the option that Art. 8 GDPR leaves to Member States (the Regulation sets 16 as the default but allows going down to 13). Below 14, registration is not allowed. Purchases and subscriptions, on the other hand, are reserved for people aged at least 18. This is not a privacy rule but one of legal capacity (Art. 2 of the Italian Civil Code): a 14-year-old can join the community and use the free features, but cannot enter into a purchase or subscription contract. To do that, a person holding parental responsibility must act using their own account. If we become aware of an account created by a child under 14 we close it and delete the data. Parents can report cases to the privacy address shown on this page.
12. Automated decision-making
We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). Gamification features (XP, leaderboards) and content ranking are service mechanics, not profiling with significant effects. Content moderation may use automatic thresholds, for example temporary hiding after multiple reports, but final removal decisions and account suspensions always involve human review.
13. How we protect data
We adopt appropriate technical and organisational measures (Art. 32 GDPR): encryption in transit (TLS), strong password hashing, role-based access control, segregated environments, backups, security event logging and the minimisation principle. No system is 100% secure: in the event of a breach posing risks to your rights we will inform you as required by Arts. 33 and 34 GDPR.
14. KSM Spaces: processing on behalf of schools
The KSM Spaces module allows kite schools and centres to manage their own students, instructors and activities. For that data the controller is the school using Spaces, which decides purposes and means; NEXTA SRL acts as a data processor under Art. 28 GDPR, on the basis of a Data Processing Agreement (DPA) to be entered into with each school. Since 13 August 2026 opening a Space is technically conditional on accepting the DPA and the B2B contract “KSM Spaces Order and Subscription”: the platform activates no Space, not even a trial one, unless acceptance of the current version of both documents is on record. The full text can be read from the platform before accepting it, and for each acceptance we record who made it, which document, which version, when, in which language and the technical data of the request (IP address and browser): without the version number it would not be possible, six months later, to reconstruct which text was accepted. When we publish a new version, Spaces that are already active are not suspended — they stay operational and their holder is asked to accept the updated text — while new openings require the current version straight away. Both documents are at version 1.0, in force from 14 August 2026, drafted in-house and undergoing a legal review that is not yet concluded. It is the text that governs the relationship: the acceptance we record counts as acceptance of that version, not as agreement to a draft. If the review brings substantive changes we will publish the new version and ask you to accept it, recorded with its own number. Until the review is concluded the caution is ours to ask, and we keep it in full because it concerns other people's data: use the Space to evaluate the product, with your own or fictitious data, and not to process real student and instructor data. You can also request a copy of the documents by email at privacy@ksm-official.com. We process that data only on the school’s documented instructions, using the same providers listed in this policy, and we return or delete it at the end of the contract as set out in the DPA. If you are a student or instructor of a school using Spaces, contact the school to exercise your rights over that data: if you contact us, we forward the request and assist the school in responding. If you also have a personal KSM account, NEXTA SRL remains the controller for that account and this policy applies.
15. Changes to this policy
We may update this policy to reflect changes in the service or in the law. Substantial changes will be communicated by email or through an in-platform notice with reasonable advance notice. The last-updated date appears at the top of the document and is automatically checked against the published content: if the text changes, the date changes. Previous versions are available on request.
16. Contact
Data controller: NEXTA SRL, VAT no. IT02602140978, Via Fabbroni 12, 59100 Prato (PO), Italy. Certified email (PEC): amministrazione@pec.nextasolutions.it. For any question about this policy or your data write to: