Privacy Policy

1. Data Controller

The Data Controller is:

Associazione Cultura & Motorsport
Registered office: Via Durini 5, Milan, Italy
Italian Tax Code and VAT Number: 14588590969
Email: info@anellodellaregina.com

For enquiries about personal data processing or to exercise rights under the GDPR, individuals may contact the Data Controller at the email address above.

2. Categories of Personal Data

Partnership enquiries

When users submit the Partnership form, we collect their full name, company or organisation, email address, message and, optionally, telephone number.

We also record information required to manage the enquiry, including a request identifier, submission date and time, acknowledgement of this Privacy Policy, request status, internal administrative notes and technical email-notification information.

Technical browsing data

When accessing the website, technical information may be processed, including IP addresses, browser and device information, requested resources, access timestamps and data required for website operation, security and abuse prevention.

Direct communications

Where users contact the Association by email, the personal information included in their communication is processed as necessary to respond.

Users are encouraged not to submit sensitive or unnecessary personal information.

3. Purposes and Legal Bases

Personal data is processed for the following purposes.

Managing Partnership and Sponsorship enquiries

To receive, review and respond to enquiries, evaluate potential collaborations and manage subsequent communications.

Where the data subject requests steps prior to entering into a contract, the legal basis is Article 6(1)(b) GDPR.

Where enquiries are submitted by representatives of companies or organisations, the processing of professional contact information may rely on the Controller's legitimate interest in managing institutional and professional relationships under Article 6(1)(f) GDPR.

Website operation and security

To maintain website functionality, prevent abusive submissions, protect systems and investigate technical issues.

The legal basis is the Controller's legitimate interest in ensuring the security and proper functioning of the website, under Article 6(1)(f) GDPR.

Compliance with legal obligations

Where applicable, personal data may be processed to comply with legal obligations under Article 6(1)(c) GDPR.

Submitting a Partnership enquiry does not automatically enrol users in newsletters, commercial profiling or marketing communications.

4. Provision of Data

Submitting a Partnership enquiry is voluntary.

Full name, company or organisation, email address and message are required to process the enquiry. A telephone number is optional.

Users must acknowledge that they have read this Privacy Policy before submitting the form. This acknowledgement does not constitute consent to marketing.

Failure to provide the required information prevents submission of the enquiry.

5. Processing Methods and Recipients

Personal data is processed using electronic systems and appropriate technical and organisational measures intended to restrict access to authorised persons.

Partnership requests are stored in the website database and are accessible through a private administration area protected by authentication and authorisation controls.

The website and enquiry-management system use third-party providers, including:

• OpenAI / ChatGPT Sites, for website hosting and application services;
• Cloudflare, as part of the technical infrastructure supporting website delivery and security;
• Resend, for sending internal Partnership email notifications;
• Microsoft 365, for email services and Association communications;
• Google Fonts, for delivering typography resources used by the website.

Depending on their role and the services provided, these organisations may act as processors, subprocessors or independent controllers under the applicable terms.

Personal data is not publicly disclosed or sold for commercial purposes.

Data may also be disclosed where required by applicable law.

6. International Data Transfers

Certain technology providers may process personal data outside the European Economic Area, including in the United States.

Where applicable, personal data hosted through ChatGPT Sites is processed under the ChatGPT Sites Data Processing Addendum.

Resend processes email-related information in the United States and states that appropriate international-transfer safeguards are in place, including the European Commission's Standard Contractual Clauses, as described in the Resend DPA.

International transfers are subject to Chapter V of the GDPR and the applicable transfer mechanisms under the relevant providers' terms, including adequacy decisions and Standard Contractual Clauses.

Further information about applicable safeguards may be requested from the Data Controller.

7. Data Retention

Partnership enquiries not resulting in a contractual relationship

Personal data associated with Partnership enquiries that do not lead to a contractual relationship is retained for a maximum of 24 months from the last communication relating to the enquiry.

After this period, the information is deleted or anonymised unless further retention is necessary to comply with legal obligations or protect rights in specific, documented circumstances.

Retention deadlines and deletion are managed through a manual procedure; Partnership requests are not automatically deleted.

Contractual relationships

Where an enquiry results in a contractual relationship, the relevant data is retained according to applicable legal and documentation requirements.

Technical and security information

Browsing data, technical logs and abuse-prevention identifiers are retained for limited periods appropriate to their purposes and the relevant service providers' retention policies.

Technical copies and backups are managed under the procedures and retention periods applicable to the relevant services.

8. Cookies and Similar Technologies

The website may use technical cookies and similar technologies required for functionality, security and authorised session management.

Website infrastructure may also involve requests to external services such as Google Fonts, resulting in the processing of technical data necessary to deliver those resources.

Details of the technologies actually used are provided in the website's Cookie Policy.

Should non-essential cookies or tracking technologies requiring consent be introduced, their use will be subject to the applicable transparency and consent requirements.

9. Data Subject Rights

Subject to the conditions and limitations established by the GDPR, individuals may exercise their rights to:

• access their personal data;
• request rectification;
• request erasure;
• restrict processing;
• data portability, where applicable;
• object to processing based on legitimate interests.

Requests may be sent to info@anellodellaregina.com.

Individuals may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

10. Automated Decision-Making

Data collected through the Partnership form is not used for automated decision-making producing legal or similarly significant effects on individuals.

Partnership enquiries are not used for commercial profiling.

11. Updates to this Policy

This Privacy Policy may be updated to reflect changes in legal requirements, organisational arrangements or technology.

The current version will be made available on the website, together with its last updated date.