Privacy policy

Data controller

The data controller is Benedetto Filipelli, a private individual.

• Email for privacy requests: info@racewaykartingtalao.it

What data we process

• Race registration, data of the driver (including minors) and of the entrant, if any: first name, surname, place and date of birth, Italian tax code (codice fiscale), nationality, address, phone, email, grade and number of the racing licence, expiry date of the medical certificate, technical equipment data (chassis, tyres, oil).
• For drivers under 18: personal details, tax code, address, phone and email of the parents or of whoever holds parental responsibility, and a copy of their identity document.
• Companion (optional): first name, surname, place and date of birth, tax code, address, phone.
• Mechanics: name and licence number.
• Invoice details, if requested: company name or full name, address, VAT number, tax code, SDI code, certified email (PEC).
• Registration forms generated as PDF and signed documents.
• Electronic signature: first name, surname, email and phone of the signatories, used to send the OTP code.
• Technical browsing data: IP address and browser type, recorded in the logs of the servers hosting the website and used, in unreadable form (hash), by the visit counter.

Purposes and legal bases

• Handling race registration, preparing the forms and having them signed, organising the event: performance of the registration contract (Art. 6(1)(b) GDPR).
• Issuing a receipt or invoice: compliance with legal obligations (Art. 6(1)(c) GDPR).
• Protecting the registration form from automated submissions with Google reCAPTCHA: legitimate interest in the security of the website (Art. 6(1)(f) GDPR).
• Counting visits to the website in aggregate form: legitimate interest (Art. 6(1)(f) GDPR).
• Ensuring the operation and technical security of the website (server logs): legitimate interest (Art. 6(1)(f) GDPR).

Data of minors

The data of drivers under 18 is provided by their parents or by whoever holds parental responsibility, who fill in and sign the registration forms.

A safeguarding policy is in place to protect minors in sport: the contact details of the person in charge are published on the dedicated page.

Recipients and external processors

The data is neither disclosed to the public nor sold. It is processed by the controller and, on the controller's behalf, by the following providers (data processors):

• Google Firebase (Firestore and Storage): storage of registration data, uploaded documents and visit counters.
• Google reCAPTCHA: anti-bot check on the registration form.
• ConvertAPI: conversion of the forms from DOCX to PDF.
• OTP Service (app.otpservice.io): electronic signature with an OTP code; it receives the PDF to be signed and the first name, surname, email and phone of the signatories.
• Vercel: website hosting, with technical server logs (including the IP address).

Registration documents are also sent to the race director for sporting requirements.

Transfers outside the European Union

Some providers (Vercel, Google, ConvertAPI) may also process data outside the European Union, in particular in the United States. Such transfers rely on the safeguards provided by the GDPR (EU-US adequacy decision or standard contractual clauses).

How long we keep the data

• Registrations for the race of 12 July 2026: registrations were closed right after the race; the data and documents were deleted from the online services (Google Firebase Firestore and Storage) on 13 October 2026; the offline copy was deleted on 14 July 2026.
• Registrations for future races: for the time needed to organise the race; the exact period will be stated when registrations open.
• Draft of the registration form: it stays only in your browser and is deleted when the form is submitted or when you clear it.
• Visit counter: only one hash code per daily visit and the daily totals are kept, for as long as needed for the website statistics.
• Vercel server logs: for the period set by the provider.

Visit counter

To know how many people visit the website, on each visit the server calculates a code (SHA-256 hash) from the date, IP address, browser type and a secret key. The IP address is not stored in clear and no cookies are used. The code is only used to avoid counting the same visit twice on the same day; otherwise only totals are kept.

Cookies

The website uses no profiling cookies and no statistics (analytics) cookies. It only uses the browser's technical storage:

• sessionStorage, to show the opening animation only once per session;
• localStorage, to save the draft of the registration form until it is submitted.

For this reason no cookie banner is shown. The race registration form uses Google reCAPTCHA, which may set its own technical cookies to protect against abuse.

Online booking

When online booking through Apex Timing is activated, this policy will be updated.

Your rights

At any time you can exercise the rights set out in Articles 15-22 of the GDPR:

• access to your data;
• rectification of inaccurate data;
• erasure;
• restriction of processing;
• data portability;
• objection to processing based on legitimate interest.

To exercise them, write to info@racewaykartingtalao.it.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

Updates

This policy may change, for example when the services used by the website change. The date of the last update is shown at the top.