Safety, performance and technology for the “Circus”

PRIVACY POLICY

RACINGFORCE S.p.A.

(Notice on the processing of personal data pursuant to art. 13 of EU Regulation 679/2016 and art. 13 of Legislative Decree 196/2003)

Racingforce S.p.A., as Data Controller (hereinafter also: “Owner” or “RF“) pursuant to EU Regulation 679/2016 (hereinafter: “GDPR“) and Legislative Decree 196/2003 (hereinafter: “Privacy Code“) – invites you, before communicating any personal data to the Data Controller, to read carefully this Privacy Policy because it contains important information on the protection of your personal data.

This Privacy Policy:

• is intended for the website racingforce.com (hereinafter: “Website“),
• is an integral part of the Website and the services we offer,
• is written pursuant to art. 13 of the GDPR and the Privacy Code to those who interact with the web services of the Website or who contact RF by telephone or by post.

The processing of your personal data will be based on the principles of correctness, lawfulness, transparency, limitation of purpose and storage, minimisation and accuracy, integrity and confidentiality, as well as the principle of accountability pursuant to art. 5 of the GDPR.

Your personal data will therefore be processed in accordance with the legislative provisions of the GDPR and the confidentiality obligations set forth therein as well as those of the Privacy Code still in force today

The processing of personal data means any operation or set of operations performed on personal data or sets of personal data, with or without the aid of automated processes, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, comparison or the interconnection, restriction, erasure or destruction, as defined in art. 4.2 of the GDPR.

We inform you that the personal data subject to processing may consist of – also depending on your decisions on how to use the services – any personal information suitable for identifying or making you identifiable including textual information, photographic or video images and from any other information provided.

TABLE OF CONTENTS

 Below we provide the table of contents for this Privacy Policy so that you can easily find the information relevant to the processing of your personal data that may concern you.

1. DATA CONTROLLER: WHO WE ARE AND WHAT WE DO

2. WHAT DATA WE PROCESS

    a. Browsing data

    b. Data provided voluntarily by you – Particular Data

    c. Third party data provided voluntarily by you

    d. Cookies

    e. Social Network

3. PURPOSE OF DATA PROCESSING – WHY WE PROCESS YOUR DATA

4. LEGAL BASIS AND OBLIGATORY OR OPTIONAL NATURE OF PROCESSING

5. RECIPIENTS OF THE PERSONAL DATA

6. TRANSFER OF PERSONAL DATA

7. STORAGE OF PERSONAL DATA

8. RIGHTS OF THE DATA SUBJECT

9. CHANGES

10. CONTACTS

***

1. DATA CONTROLLER: WHO WE ARE AND WHAT WE DO

The Data Controller is Racingforce S.p.A., with registered office in Ronco Scrivia (GE).

2. WHAT DATA WE PROCESS

We inform you that the personal data subject to processing may consist of – also depending on your decisions on how to use the services – an identifier such as the name, an identification number, location data, an online ID or one or more elements specifying your identity suitable to make the data subject identified or identifiable, depending on the type of services requested (hereinafter only “personal data” as defined in art. 4.1 of the GDPR).

The personal data processed through the Website are as follows:

a. Browsing data

During their normal operation, the computer systems and software procedures used to operate this Site acquire certain personal data whose transmission is implicit in the use of internet communication protocols. This information is not collected with the intent of associating it with identified users but, by its very nature, may lead to the identification of users through processing and association with data held by third parties. This category of data includes IP addresses or domain names of computers used by persons who connect to the Website, the URI (Uniform Resource Identifier) of requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the reply given by the server (successful, error, etc.) and other parameters regarding the user’s operating system and computer environment. The data are used for the sole purpose of obtaining anonymous statistical information about the use of the Website to check that it is functioning correctly, to identify any anomalies and/or abuse, and are deleted immediately after processing. The data could be used to ascertain responsibility in case of hypothetical cyber crimes to the detriment of the Website or third parties.

b. Data provided voluntarily by you – Particular Data

Except for reference to specific information, this Privacy Policy is also intended for the processing of data voluntarily provided by you throughthe Website. In this regard, we invite you not to include in the form, contained within the Website and not to communicate information that may fall within the category of particular categories of personal data as per art. 9 of the GDPR (for example, data referring to racial or ethnic origin, political opinions, religious or philosophical convictions, union membership, life/sexual orientation as well as genetic data, biometric data or data related to your health condition), unless it is specifically requested and subject to specific notice and consent.

c. Third party data provided voluntarily by you

In using certain services, personal data which you have provided to RF may be processed by third parties. In this event, you are the independent data controller, assuming all the legal obligations and responsibilities. In this sense, you confer on this point the widest indemnity with respect to any objection, claim, request for compensation for damages from processing etc. that should reach the Data Controller from third parties whose personal data has been processed through your use of the services on the Website in violation of the rules on the protection of relevant personal data. In any case, if you provide or otherwise mention personal data of third parties in the use of the Website, you guarantee from now – assuming all related liability – that this particular hypothesis of processing is based on the prior acquisition – on your part – of the consent of the third party to the processing of information concerning the same and to its dissemination and that said processing will be carried out in accordance with the GDPR.

d. Cookies

Information on cookies used by the Website is available at the following link.

3. PURPOSE OF DATA PROCESSING – WHY WE PROCESS YOUR DATA

Your personal data will be processed where applicable, with your consent where necessary, for the following purposes:

3.1. to allow navigation of the Website and the provision of RF services through the Website;

3.2. to find specific requests, including telephone calls, addressed to RF;

3.3. to fulfil any obligations under applicable laws, regulations or community legislation, or to satisfy requests from authorities;

3.4. to exercise the rights of the Data Controller;

3.5. to fulfil contractual and pre-contractual obligations deriving from existing relations with you;

3.6. for statistical purposes, without it being possible to trace your identity.

Your personal data, also included in the particular categories, will be processed using automated and non-automated tools. 

In order to prevent data loss, unlawful or incorrect use of data and unauthorised access, specific security measures have been implemented.

4. LEGAL BASIS AND OBLIGATORY OR OPTIONAL NATURE OF PROCESSING

The legal basis for processing personal data for the purposes set out in sections 3.1 and 3.2 and 3.5. is art. 6(1)(b) of the GDPR ([…] processing is necessary for the performance of a contract of which the data subject is a party or for the execution of pre-contractual measures taken at the request of the same), since the processing is necessary for the provision of services. The provision of personal data for these purposes is optional, but failure to provide them would make it impossible to activate the requested services. 

The legal basis for the purpose referred to in section 3.3 is art. 6(1)(c) of the GDPR ([…] processing is necessary to fulfil a legal obligation to which the data controller is subject). In fact, once the personal data have been transferred, the processing is indeed necessary to comply with the legal obligations to which RF is subject.

The legal basis for the purpose referred to in section 3.4 is art. 6(1)(f) of the GDPR (…. Processing is necessary for the pursuit of the legitimate interests of the data controller or of third parties, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject….). In fact, once the personal data have been transferred, it is indeed necessary for the pursuit of RF’s legitimate interest to the aforementioned conditions,

It is also specified that the processing referred to in section 3.6 is not performed on personal data and therefore can be freely carried out by RF.

Finally, in the event of any provision of Particular Data, if requested, the Processing has a legal basis in your consent pursuant to art. 9(2)(a) of the GDPR ([…] the data subject has given his/her explicit consent to the processing of such personal data for one or more specific purposes), subject to specific notice.

 5. RECIPIENTS OF PERSONAL DATA

Your personal data may be shared for the purposes set out in section 3 of this Privacy Policy with: 

5.1. subjects that typically act as data supervisors, namely: i) persons, companies or professional firms that provide assistance and advice to RF in accounting, administrative, legal, tax and financial matters or other types of advice; ii) subjects delegated to carry out technical or IT maintenance; iii) credit institutions, insurance companies; iv) companies and entities controlling, controlled and connected to RF, limited to the pursuit of administrative-accounting purposes connected with the performance of organisational, administrative, financial and accounting activities. (collectively “Recipients“).

5.2. persons, bodies or authorities who require the communication of your personal data in accordance with the provisions of law or by order of the authorities; 

5.3. persons authorised by RF to process personal data necessary to perform activities strictly related to the provision of services, whether they are committed to confidentiality or have an appropriate legal obligation of confidentiality and that guarantee the processing of data in accordance with the GDPR.

The complete and updated list of supervisors is kept at the headquarters of the Data Controller, located in Ronco Scrivia, Via Bazzano no. 5 and can be provided by sending a written request to the Data Controller at the addresses indicated in the “Contacts” section of this notice.

6. TRANSFER OF PERSONAL DATA

Personal data are stored on servers located within the European Union. In any event, it is understood that the Data Controller, if necessary, will have the right to relocate the servers even outside the European Economic Area. In this case, the Data Controller ensures from now on that said transfer will take place in compliance with the applicable legislation based on an adequacy decision or on the Standard Contractual Clauses approved by the European Commission. Further information is available by sending a written request to the Data Controller at the addresses indicated in the “Contacts” section of this notice.  

7. STORAGE OF PERSONAL DATA

The personal data processed for the purposes referred to in section 3 will be kept for the time strictly necessary to achieve those same purposes and, since it is processing performed for the provision of services, up to the period of time provided and allowed by Italian legislation to protect RF’s interests and right of defence, having regard to the limitation periods set by the applicable law.

Further information regarding the data storage period and the criteria used to determine this period may be provided by sending a written request to the Data Controller at the addresses indicated in the “Contacts” section of this notice. 

8. RIGHTS OF DATA SUBJECTS

In your capacity as data subject, pursuant to art. 15 and subsequent amendments of the GDPR and art. 7 of the Privacy Code, you have the right to:

         i.            obtain confirmation of the existence or not of personal data concerning yourself, even if not yet registered, and their communication in an intelligible form;

       ii.            obtain the indication: a) the origin of personal data; b) the purpose and the modality of processing; c) the logic applied whenever the processing involves electronic tools; d) the identification details of the data controller, of the supervisors and of the designated representative pursuant to article 5, paragraph 2 of the Privacy Code and art. 3, paragraph 1 of the GDPR; e) the subjects and categories of subjects to whom the personal data may be communicated, or person who may become aware of the data as designated representatives in the country, supervisors, or processors;

      iii.            obtain: a) update, rectify, and, when deemed of interest, integrate the data; b) erase, convert to an anonymous format or block of data that has been processed in violation of the law, including data that do not need to be retained for the purposes for which they were collected and processed; c) confirmation that the operations described in sections a) and b) were made known, including their content, to the parties to whom the data was communicated or transmitted, except in cases when it may not be possible to do so or when it necessitates a disproportionate effort compared to the protected right;

      iv.            object, in whole or in part: a) to the processing of personal data concerning you, even if pertinent to the purpose of the collection; b) to the processing of personal data concerning you for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication, through the use of automated call systems without the intervention of an operator by email and/or through traditional marketing methods by telephone and/or paper mail. Please note that the data subject’s right of opposition, set out in point b) above, for direct marketing purposes through automated methods extends to traditional ones and that in any case without prejudice to the possibility for the data subject to exercise the right of opposition even partially. Consequently, the data subject may choose to receive only communications by traditional means or only automated communications or neither.

Where applicable, you also have the rights set out in articles 16 – 22 of the GDPR (Right to rectification, right to be forgotten, right to the limitation of the processing, right to data portability, right to opposition, right to oppose automated processing, including profiling).

Requests should be sent in writing to the Data Controller at the addresses indicated in the “Contacts” section of this notice.

In any case, you always have the right to lodge a complaint with the competent supervisory body (Guarantor for the protection of personal data), pursuant to art. 77 of the GDPR, if you believe that the processing of your data is contrary to current law.

9. AMENDMENTS

RF reserves the right to amend or simply update the content of this Privacy Policy, partially or completely, including in the event of changes to the relevant legislation. In this case RF will inform you of such changes as soon as they are introduced and they will be binding as soon as they are published on the Website. RF invites you to regularly visit this section so that you are aware of the most recent and updated version of the Privacy Policy in order to remain up-to-date on the data collected and the Data Controller’s use of them.

10. CONTACTS

To exercise the above rights or for any other request, write to the Data Controller: Racingforce S.p.A., based in Ronco Scrivia (GE), Via Bazzano no. 5, email: security@racingforce.com