This is a courtesy translation. The legally binding version is the Italian one.Read the Italian version

Legal document

Privacy Policy

This page explains what personal data we collect through the ondarte.ch website, why we collect it, who we share it with and how you can take action. It is written to actually be read: if anything isn't clear, write to us at info@ondarte.cloud and we'll explain it.

1. Who processes your data

Data controller
OndArte Sagl
Via Lugano 18, 6988 Ponte Tresa (TI)
UID (Business Identification Number): CHE-105.547.921
Email: info@ondarte.cloud
Phone and WhatsApp: +41 79 833 20 39

OndArte Sagl determines the purposes and means of processing the personal data collected through this website and is therefore the data controller.

For any question about data protection, and to exercise your rights, you can write to info@ondarte.cloud: it is the single channel for every request. We have not appointed a data protection advisor: the appointment is optional under Swiss law (art. 10 LPD) and the size and nature of our processing activities do not make it necessary.

The registered office shown above is a corporate detail and does not correspond to a pool open to the public: the course locations are listed on the Locations page.

2. Which laws we refer to

We process personal data in accordance with the Swiss Federal Act on Data Protection (nFADP/LPD) and its implementing ordinance (OPDA).

If you are located in the European Union and our services are directed at you, Regulation (EU) 2016/679 (GDPR) also applies. This notice is drafted to satisfy both legal systems: where we indicate a legal basis, the reference applies to the GDPR, whereas under Swiss law processing carried out by private parties is lawful without the need for a specific legal basis, provided it does not infringe the data subject's personality rights.

3. In brief: what we don't do

We'll say it upfront, since it's usually the part people worry about most. This website has none of the following:

  • profiling or advertising cookies;
  • retargeting or remarketing systems;
  • Facebook, Instagram, TikTok or other social-platform pixels;
  • member areas, accounts or login credentials;
  • online course sign-up, and no electronic payment;
  • sale, transfer or exchange of your data with third parties for commercial purposes.

No third-party resource is loaded before an explicit action of yours: the only external element is the map, which loads only if you request it (see point 6).

Course sign-up does not happen through the website: it goes through direct contact with us.

4. The contact form

4.1 What data we collect

When you fill in the contact form we collect:

  • your name (required);
  • your email address (required);
  • your phone number (optional);
  • the location you are interested in (optional);
  • the text of your message (required);
  • a technical indication of the page or button you opened the form from, which we use only to understand what you are writing to us about.

We don't ask you for anything else.

4.2 Why we process it

We use it exclusively to read your request, reply to you, and give you information about courses, locations, schedules and how to sign up.

Legal basis (GDPR): performance of pre-contractual measures taken at your request (art. 6 para. 1 let. b) and, for the transfer described in point 4.4 and for any health data referred to in point 4.3, your explicit consent (art. 6 para. 1 let. a, art. 9 para. 2 let. a and art. 49 para. 1 let. a).

4.3 Health data: read this before you write

Some of our courses relate to sensitive personal situations: Acquantalgica is aimed at people living with back or joint pain, and AcquaGravidanza at pregnant women. If you write to us about them, your message may contain information about your health.

Health information is considered "personal data requiring particular protection" under art. 5 let. c LPD, and falls within the "special categories of data" under art. 9 GDPR. We give it reinforced protection on our side: access limited to the people who need to handle your request, and no disclosure to third parties beyond what is necessary.

Please don't write diagnoses, medical conditions, treatments, medical reports or other health details in the form. We don't need them to sign you up: it's enough to tell us you're looking for a warm-water course for your back, or that you're expecting. If we need a bit more information to look after you properly, we'll ask you by phone or in person — channels better suited to this than a web form.

If you write them anyway, we will consider that you have expressly consented to their processing and to the transfer described in the following point. You can withdraw this consent at any time (see point 11).

4.4 How your message travels: Web3Forms and the United States

The form is handled by Web3Forms, a service that receives the submission and delivers it to us by email at info@ondarte.cloud. The data you enter therefore passes through Web3Forms' servers, which are located in the United States of America.

This means your data is disclosed abroad, to a country that does not in itself offer a level of protection equivalent to the Swiss or European one, and that US authorities could, under certain conditions, access it using tools against which the remedies available to you are more limited than those provided for in Switzerland and the European Union.

We transfer the data on this basis: your explicit and informed consent, given by ticking the box before sending (art. 17 para. 1 let. a LPD and art. 49 para. 1 let. a GDPR), together with the fact that the transfer is directly necessary to follow up on the request you make to us.

If you'd rather your data didn't leave Switzerland, don't use the form. Write to us directly at info@ondarte.cloud, call us, or send us a WhatsApp message at +41 79 833 20 39. You'll get exactly the same answer.

4.5 Protection against spam

The form contains a hidden field that the user does not see and does not fill in (a technique called a honeypot): if it turns out to be filled in, the submission is discarded because it almost certainly comes from an automated program. It does not set cookies, does not profile you and does not collect any additional data about you. We do not use reCAPTCHA or any similar system.

4.6 How long we keep it

We keep emails received through the form for 24 months from our last exchange with you. After that period we delete them, unless in the meantime the request has turned into an enrolment: in that case the data becomes part of the management of the relationship with the enrolled participant and is kept for the duration of that relationship and afterwards for the periods required by Swiss legal, tax and accounting obligations, in particular ten years pursuant to art. 958f of the Swiss Code of Obligations.

5. Visit statistics

To understand which pages are useful we use Umami, a statistics system installed on our own server, not on an advertising platform.

Umami works without cookies and without persistent identifiers: it does not recognise you from one visit to the next and does not build any profile. It collects only aggregated, anonymous data: page visited, general traffic source, device type and country. The IP address is used transiently to derive this aggregated data and is not stored in a form that would allow us to trace it back to you. We also respect your browser's "Do Not Track" signal: if it is enabled, the visit is not counted.

The installation is managed on our behalf by Atenek Sagl, which acts as processor under an agreement that prohibits it from using the data for its own purposes. The servers are located in Germany, in the European Union, a country the Swiss Federal Council recognises as providing an adequate level of protection under Annex 1 OPDA: the transfer therefore does not require any additional safeguards.

Legal basis (GDPR): our legitimate interest in understanding how the website is performing using the least invasive tool available (art. 6 para. 1 let. f).

6. Maps of our locations

The map does not load by itself. On the location pages and on the Contact page, instead of the map you'll find a box with a button. Until you press it, no data is sent to Google and no external resource is downloaded.

When you press "Show the map", a map provided by Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) is loaded, to show you where the pool is and let you get directions.

From that moment on, and only from that moment on, Google receives your IP address, the address of the page the request came from, and technical information about your device and browser, and may set third-party cookies on your device. Google processes this data as an independent controller, for its own purposes and also outside Switzerland and the European Economic Area, in particular in the United States. We have no control over this processing, which is described in Google's own notice: policies.google.com/privacy.

The choice is yours, and it applies one map at a time: if you don't press the button nothing happens, and pressing it on one page does not activate the maps on the others. If you'd rather not load it, you won't miss anything essential: the full address, directions and contact details for each location remain available as text, and the "Open in Google Maps" button takes you straight to the external application.

You can in any case prevent third-party cookies from being set at any time by configuring your browser: Chrome (Settings → Privacy and security → Third-party cookies), Safari (Settings → Privacy → Prevent Cross-Site Tracking, on by default), Firefox (Settings → Privacy & Security → Enhanced Tracking Protection) and Edge (Settings → Cookies and site permissions).

7. Website hosting

The website is hosted on Cloudflare, which processes on our behalf, as processor, the technical data needed to serve the pages and protect the website from attacks: IP address, date and time of the request, page requested, browser type. These are short-lived technical logs, which we do not use to identify or profile you.

This website does not use profiling cookies, advertising cookies or its own analytics cookies. Visit statistics are collected without cookies (point 5).

The only cookies that may be set on your device are third-party cookies linked to the Google map, and only if you ask for it to be loaded by pressing the button described in point 6. In addition there may be strictly technical cookies necessary for the website's operation and security.

For this reason you won't find a cookie-consent banner on this website. It isn't needed, because no third-party resource is loaded and no non-essential cookie is set before an explicit action of yours: the request for consent coincides with the map button, which is the only point where a real choice is at stake. Under Swiss law, art. 45c let. b of the Federal Act on Telecommunications (LTC) requires that the user be informed and able to refuse, and this section fulfils that; under European law, art. 5 para. 3 of Directive 2002/58/EC (ePrivacy Directive) requires prior consent, which here is expressed precisely by clicking the button.

9. Who we share your data with

We do not sell, transfer or exchange your data. We make it accessible only to:

  • our staff and instructors, only to the extent needed to reply to your request or to run the course;
  • the providers that process data on our behalf as processors, all named in this notice: Web3Forms (form delivery), Atenek Sagl (statistics and technical management of the website), Cloudflare (hosting);
  • the authorities, when the law requires it.

The pools that host our courses are third-party facilities: we do not share the data collected through this website with them.

10. Security

The website is served exclusively over an encrypted connection (HTTPS). We adopt technical and organisational measures appropriate to protect data from unauthorised access, loss and misuse, and we limit access to the people who need to process it. No transmission over the internet can, however, be guaranteed to be completely secure: this is one of the reasons we ask you not to send us health details through the form.

We do not make any automated decision that produces legal effects concerning you, and we do not carry out profiling, whether for advertising or any other purpose.

11. Your rights

You can exercise the following rights at any time, free of charge:

  • access the data concerning you and obtain a copy of it;
  • have it corrected if inaccurate or incomplete;
  • request its deletion;
  • request restriction of processing, or object to it;
  • withdraw a consent already given, without affecting the lawfulness of processing carried out before the withdrawal;
  • receive the data you provided us with in a machine-readable format, or request that it be transmitted to another controller, in the cases provided for by law.

Write to info@ondarte.cloud: it is the single channel for all requests. We reply within 30 days. To protect you, we may need to verify your identity before acting on requests that concern sensitive data.

If you believe your data is being processed unlawfully you can contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch. If you are located in the European Union you can also lodge a complaint with the supervisory authority of the Member State where you live or work; for Italy, the Garante per la protezione dei dati personali (Italian Data Protection Authority), garanteprivacy.it.

12. Changes to this notice

We may update this notice when the services we use, or the applicable law, change. The version in force is always the one published on this page, with the date and version number shown below.

Version 1.0 · Last updated: 28 July 2026