For the processing of personal data carried out by IDEST S.r.l. as part of the services for sports event registration and medical certificate verification

Dear Athlete and Platform User,

Your privacy is important to us. With the entry into force of the European Regulation 679/2016 (GDPR) and the current Italian legislation on personal data protection, we wish to inform you clearly and transparently about how we collect, use, and protect your personal information.

This document contains all the information related to the processing of your data when you use our services for sports event registration and athletic fitness verification through our IDChronos platform (available at https://live.idchronos.it, hereinafter simply referred to as "Platform").

We have structured this information in a question-and-answer format to make it easier to consult. If you still have doubts after reading it, please contact us using the contact details you will find below.

Our goal is to build a relationship based on trust and maximum transparency.

Who are we and who manages your data?

IDEST S.r.l.
VAT Number and Tax Code: 03736740360
Operational and legal headquarters: Corso Manfredo Fanti 40, 41012, Carpi (MO)
Telephone number: +39 059 4735965
Contact email: info@idchronos.it

IDEST S.r.l. (which in this document we will also call "we", "our", or "Data Controller") is the company responsible for the collection and processing of personal data of those who use our Platform (the "Users" or "Data Subjects").

How to contact our Data Protection Officer?

For any questions regarding privacy and the processing of your personal data, you can contact our dedicated email address: info@idchronos.it

What exactly does IDChronos do?

Our Platform offers a complete service for sports enthusiasts: it allows you to register for competitions and sports events of various kinds (running, cycling, triathlon, swimming, and other disciplines) organized by our partners. A fundamental aspect of our service is the management and verification of sports medical certificates, necessary to ensure that each participant is suitable for the chosen competitive activity.

To learn in detail about all the services we offer and the conditions for using them, we recommend consulting our Terms and Conditions of Use, always updated and available on the Platform.

What information do we collect when you use our Platform?

When you use IDChronos to register for sports events and upload your medical documentation, we collect:

• Your identification data: name, surname, date of birth, and country of residence
• Technical information: IP address, type of device and browser used, cookies, and other online identifiers
• Data contained in the sports medical certificate you upload to the Platform (specifically: type of certificate, sports discipline for which it is valid, date of issue, expiry date, and the health professional who issued it)

It is important to underline that, although the medical certificate may contain other health information, we process and store only the data strictly necessary to verify your suitability to participate in the sports event, in full respect of your privacy.

If you spontaneously provide us with further unsolicited information, it will still be processed in compliance with this Information and current regulations (in this document, for simplicity, we will refer to all this information as "Data").

Why do we collect your data, on what legal bases, and for how long do we keep it?

1. Management of event registrations and verification of sports eligibility

What we do: We allow you to register on the Platform, upload your medical certificate, securely store the documentation, and allow authorized parties (such as the organizers of the event you registered for) to consult it to verify your eligibility.

Legal basis: Your explicit consent.
This consent is essential to allow us to offer the service and you can revoke it at any time by writing to the contacts indicated above. However, we inform you that, without this consent, we will not be able to complete your registration for sports events.

Retention period: We keep your data for the time necessary to achieve the described purposes and in any case no later than the terms provided by law.

2. User assistance and support

What we do: We answer your questions and requests for assistance.

Legal basis: The legitimate interest of IDEST S.r.l. to provide adequate customer service.

Retention period: For the time strictly necessary to respond to your requests and manage any issues.

3. Tax, accounting, and legal obligations

What we do: We use the necessary data to manage billing and comply with legal obligations.

Legal basis: Legal obligation and legitimate interest of our company.

Retention period: For the time required by Italian tax and accounting legislation.

How we process and protect your data

We process your Data using both traditional methods and advanced IT systems, including automated ones. In any case, we adopt appropriate technical and organizational security measures to ensure the confidentiality, integrity, and protection of your personal information, in accordance with current data protection regulations.

Your Data is stored on secure cloud servers, located within the European Union or in countries that offer adequate data protection guarantees according to the European Commission's assessments.

At the end of the indicated retention periods, your Data will be deleted, anonymized, or destroyed securely, taking into account technical backup and archiving procedures.

With whom do we share your information?

To offer our service effectively, we may share some of your information with:

• The organizers of the sports competitions you have registered for (only to verify your eligibility to participate in the event: name, surname, date of birth, country of residence, and validity of the medical certificate)
• Public bodies and authorities, when required by law
• External professionals such as accountants, legal and tax consultants
• IT and technology service providers who support us in managing the Platform

The staff of IDEST S.r.l. who access your data have been specifically trained and authorized for processing, in compliance with privacy regulations.

In some cases, we may have to share your data as part of corporate operations (such as mergers, acquisitions, or business unit disposals) or to comply with legal obligations.

All these subjects can act as external data processors or as autonomous data controllers, depending on the case. If you wish to know the updated list of recipients of your data, you can request it at any time using the contacts indicated in this Information.

Is your data transferred outside the European Union?

In general, your personal data is stored and processed within the European Union. However, in some specific cases, it may be necessary to transfer some information to countries outside the EU.

In these cases, we ensure that the transfer takes place only to countries that guarantee an adequate level of protection of personal data, as established by the European Commission, or we adopt appropriate guarantees such as:

• Standard contractual clauses approved by the EU
• Binding Corporate Rules
• Other valid transfer mechanisms according to the GDPR

You have the right to request a copy of the safeguards adopted for the data transfer and to know the exact locations where your data is stored by sending a request to the contacts provided in this Information.

What are your rights regarding personal data?

The GDPR and Italian law guarantee you a series of specific rights that you can exercise at any time by contacting us at the email address info@idchronos.it:

• Right of access: you can ask us for confirmation that we are processing your data and, if so, obtain information about this processing and a copy of the data.
• Right to rectification: if you believe that some of your data is incorrect or incomplete, you can ask us to correct or supplement it.
• Right to erasure (or "right to be forgotten"): in certain circumstances, you can ask us to delete your data from our systems.
• Right to restriction of processing: in some specific situations provided for by art. 18 of the GDPR, you can ask us to limit the processing of your data.
• Right to data portability: you have the right to receive your data in a structured, commonly used, and machine-readable format, and to transmit it to another data controller, where technically feasible.
• Right to withdraw consent: for processing based on consent, you can withdraw your consent at any time, without prejudice to the lawfulness of the processing carried out before the withdrawal.
• Right to object: you can object to the processing of your data at any time for reasons related to your particular situation, when the processing is based on our legitimate interest.

If you believe that the processing of your personal data does not comply with the regulations, you also have the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it).

Updates to the Information

This Privacy Information may be updated periodically to reflect changes in our data processing practices or regulatory changes. We invite you to regularly consult this page or contact us directly to obtain the latest version.

Last update: May 2025