PRIVACY POLICY FOR THE PROCESSING OF PERSONAL DATA

(Last updated: October 13, 2026)


This Policy describes the methods and purposes of the processing of personal data carried out by IDEST S.r.l., as Data Controller (hereinafter, "IDEST" or the "Controller"), through the website live.idchronos.it (the "Site").

The processing of personal data of data subjects will be carried out in compliance with the applicable legislation, with particular reference to EU Regulation 2016/679 ("GDPR").

1. Data Controller

The Data Controller is IDEST S.r.l.
Registered office: Corso M. Fanti 40, 41012 Carpi (MO), Italy
Phone: +39 0594735965
Email: info@idchronos.it

2. Types of Data Processed

IDEST processes the following categories of personal data:

  • Personal and contact information: name, surname, gender, date of birth, address, email, phone number.
  • Registration data: data related to the sports club affiliation, race category.
  • Payment and billing data: data related to credit cards, PayPal, Satispay, or other payment systems and billing information.
  • Special categories of data (sensitive data):
    • Health-related data: information contained in medical fitness certificates required for registration in certain races.
    • Data concerning sports memberships: information from federation or sports promotion body cards, which may reveal membership in certain organizations.
  • Navigation data: IP addresses, domain names, browser type, access times, and other parameters related to the user's operating system and IT environment.
  • Performance and location data: race times, rankings, geolocation data during events, if applicable and with consent.
  • Images and videos: photos and videos taken during sporting events.
  • Commercial document viewing data: when a quote or price list is sent through a personal online viewing link, we record page openings, date and time, total and per-section reading time, page scrolling, clicks on links in the document, PDF downloads, device and browser type and a technical device identifier (stored in the browser); the IP address is stored only in encrypted form (non-reversible hash). If the data subject accepts the offer or books the date from the page, we also process the data entered in the form (name, role, organization, email, phone, event date, notes).
  • Data for communications about upcoming events: email address, name, the Site language (Italian or English) in which you gave consent and, where available, the races you have registered for through the Site (so that we do not tell you about events you have already entered). We also process the date of the last mailing and of your last interaction (login to the Site, race registration, change of preferences).
  • Consent log data: each time you give, refuse or withdraw consent to communications about upcoming events, we record your email address, user account (if any), date and time, IP address, browser and device type (user agent), where you made the choice (sign-up, race registration, personal area, prompt after login, link in an email), the text shown to you and the version of this privacy policy in force at that time.

3. Purposes and Legal Basis for Processing

Personal data is processed for the following purposes:

  1. Provision of the requested services:
    • To manage registrations for races and sporting events.
    • To verify participation requirements, including the validity of medical certificates and memberships.
    • To process registration fee payments.
    • To publish results, rankings, and race times.
    • To provide timekeeping services and, where applicable, real-time tracking.

    Legal basis: Performance of a contract (Art. 6.1.b GDPR). For special categories of data (health, membership), the legal basis is the explicit consent of the data subject (Art. 9.2.a GDPR), provided at the time of uploading the document.

  2. Compliance with legal obligations: To manage accounting, tax, and administrative obligations.

    Legal basis: Compliance with a legal obligation (Art. 6.1.c GDPR).

  3. Service communications: To send emails regarding registration, payment confirmation, race reminders, or requests for missing documents.

    Legal basis: Performance of a contract (Art. 6.1.b GDPR).

  4. Communications about upcoming sports events (email marketing, with consent): sending you emails, at most 4 times a month, about races and sports events open for registration, listed in the calendar on live.idchronos.it. The emails are sent by IDEST, only concern events you can register for on the Site and do not contain offers of other companies' products. We do not sell or disclose your address to race organisers or anyone else for their own marketing.

    We only write to you if you have given your consent. Consent is always optional. You can give it with a dedicated checkbox (never pre-ticked) when creating your account, when you register yourself for a race, in the "Privacy & consents" section of your personal area, or in reply to a one-time prompt after login. If you do not give it, you can still use the Site and register for races with no consequences.

    No individual email measurement: our emails contain no invisible images or links with personal codes, so we do not know whether an individual recipient opens an email or clicks its links. We only count, in aggregate form, visits to the Site coming from our emails (campaign parameters in links, with no personal codes), and only if you have accepted statistics cookies.

    We do not use this data for automated decisions or for profiling that significantly affects you. The only selection we make is to exclude events you have already registered for and to write to you in the language in which you gave consent.

    Legal basis: consent (Art. 6(1)(a) GDPR and Art. 130(1)-(2) of the Italian Privacy Code, Legislative Decree 196/2003).

  5. Proof of consents and objections: keeping a log of your choices so that we can show we only wrote to you when, and for as long as, we were allowed to, and so that we respect withdrawals and objections (including by keeping your address on a suppression list so that we no longer write to you).

    Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR, in connection with Arts. 5(2) and 7(1) GDPR) and our legitimate interest in defending ourselves against claims (Art. 6(1)(f) GDPR).

  6. Publication of photos and videos (with consent): To publish images of the event on the Site or social media channels for documentary and promotional purposes.

    Legal basis: Consent of the data subject, usually collected by the event organizer. Alternatively, the legitimate interest of the Controller to document the public event (Art. 6.1.f GDPR).

  7. Management of commercial proposals: To know whether and how a quote or price list sent to an organizer has been viewed, in order to follow up at the right time and improve our proposals; to measure the effectiveness of our advertising campaigns by importing accepted offers into Google Ads (with the ad click identifier or SHA-256 hashed email and phone). Viewing data is visible only to IDEST administrative staff and is not used for automated profiling.

    Legal basis: Legitimate interest of the Controller in managing and improving its commercial negotiations and measuring advertising (Art. 6.1.f GDPR). For accepting the offer and booking the date: pre-contractual measures taken at the request of the data subject (Art. 6.1.b GDPR). The data subject may object at any time by writing to info@idchronos.it.

  8. Site security and operation: To ensure the proper functioning of the Site and protect it from fraudulent or malicious activities.

    Legal basis: Legitimate interest of the Controller (Art. 6.1.f GDPR).

4. Data Retention Period

Personal data is kept for the time strictly necessary to achieve the purposes for which it was collected:

  • Data for service provision: Kept for the duration of the contractual relationship and, after its termination, for 10 years to comply with legal obligations (e.g., invoice retention).
  • Medical certificates, memberships, and other documents: These documents are solely for the purpose of event participation. They are stored securely and are not publicly accessible. They are periodically and permanently deleted within 90 days of the end of the sporting event to which they refer. Only the outcome of the check (valid or not valid) and the document's expiry date remain with the registration.
  • Data for communications about upcoming events: processed until you withdraw consent or object. In any case we stop sending, and delete the data used only for this purpose, if you have had no interaction with us for 24 consecutive months (login to the Site, race registration, change of preferences).
  • Consent and objection log: kept for as long as we send you communications and for 5 years after withdrawal, objection or the last mailing, which is the period in which the processing can be challenged. If you withdraw or object, we keep your email address on a suppression list for as long as needed to make sure we do not write to you again.
  • Commercial document viewing data (openings, reading times, clicks, downloads): automatically deleted after 12 months, or earlier at the data subject's request. Data entered to accept an offer or book a date is kept for the duration of the negotiation and of any contractual relationship, and thereafter according to the terms stated for data for the provision of services.
  • Navigation data: kept in the server's technical logs for a maximum of 30 days, unless needed to investigate crimes or handle security incidents.

5. Data Communication and Transfer

Personal data may be disclosed to:

  • Event organizers: For the organizational management of the race.
  • Official timekeepers and photographers of the event.
  • Service providers: companies providing hosting (DigitalOcean, with servers located in the European Union), payment services (e.g. Stripe, PayPal, Satispay), delivery of service emails and communications about upcoming events (MailerSend), Site statistics and advertising measurement (Google, only as described in section 3 and in the Cookie section), bot protection for forms (Cloudflare Turnstile, on registration and when sending requests from the Site: it receives the IP address and technical browser data), etc. These act as Data Processors (Art. 28 GDPR) under a contract requiring them to use the data only on IDEST's behalf. Payment providers process payment data as independent controllers.
  • Competent authorities: When required by law.

Only the data in rankings, start lists and results (first name, surname, sex, category, club, bib number and times) are disseminated, i.e. published on the Site. Documents, membership cards, certificates, tax codes and contact details are never published. Some providers, or their sub-processors, may also process data outside the European Economic Area (for example in the United States). In such cases the transfer takes place only on the basis of a European Commission adequacy decision (including, for participating companies, the EU-U.S. Data Privacy Framework) or the Standard Contractual Clauses approved by the Commission (Arts. 45 and 46 GDPR). You can ask for information on the safeguards adopted by writing to info@idchronos.it.

6. Security Measures

IDEST adopts appropriate technical and organizational measures to protect personal data from loss, illicit, or unauthorized use. Sensitive documents such as medical certificates and memberships are stored with enhanced security protocols to ensure maximum confidentiality.

7. Rights of the Data Subject

As a data subject, you have the right to exercise the following rights under the GDPR:

  • Right of access (Art. 15): To obtain confirmation as to whether or not personal data concerning you is being processed, and to access that data.
  • Right to rectification (Art. 16): To obtain the correction of inaccurate personal data.
  • Right to erasure ('right to be forgotten', Art. 17): To obtain the erasure of your personal data, in the cases provided for by law.
  • Right to restriction of processing (Art. 18): To obtain the restriction of processing.
  • Right to data portability (Art. 20): To receive the personal data concerning you in a structured, commonly used, and machine-readable format.
  • Right to object (Art. 21): To object at any time to the processing of your data for marketing purposes or for reasons related to your particular situation.
  • Right to withdraw consent: To withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, you can send a request to the email address info@idchronos.it. You also have the right to lodge a complaint with the competent supervisory authority (in Italy, the Garante per la Protezione dei Dati Personali).

How to stop receiving communications about upcoming events. You can withdraw consent or object at any time, free of charge and without giving reasons, in any of these ways:

  • using the "Unsubscribe" link in every email: one click is enough, with no need to log in;
  • from the Privacy & consents section of your personal area on the Site, where you can also see the history of your choices;
  • by writing to info@idchronos.it.

Withdrawal through the link or the personal area takes effect immediately; requests sent by email within 2 working days. It does not affect service emails about your registrations and orders, which you will keep receiving, and it does not make communications sent before it unlawful.

Cookies are small files the Site stores in your browser. We also use similar tools such as the browser's local storage. We divide them into three groups.

Technical cookies (always active). They are needed to run the Site and the services you ask for: account login, form security, cart and registrations, payments, remembering your cookie choices. They do not require consent (Art. 122(1) Italian Privacy Code).

  • laravel_session: browsing session and account login. Duration: 120 minutes of inactivity.
  • XSRF-TOKEN: protects forms against fraudulent submissions. Duration: same as the session.
  • remember_web_*: only if you tick "Remember me" at login. Duration: 400 days or until logout.
  • Local storage cookieconsent_analytics, cookieconsent_ads, cookieconsent_version, cookieconsent_ts: remember your cookie choices and when you made them. Kept until you clear your browser data.
  • Payment providers' cookies (Stripe, PayPal, Satispay): set only on payment pages, for security and fraud prevention.

Statistics cookies (only with your consent). Activated only if you accept the "Statistics" category in the banner.

  • Google Analytics 4 (Google Ireland Ltd): statistics on visits to the Site. Cookies _ga and _ga_6JD3GSDHPN, duration 13 months.

Advertising cookies (only with your consent). Activated only if you accept the "Advertising" category in the banner.

  • Google Ads (Google Ireland Ltd): measuring the effectiveness of our advertising campaigns (conversions) and personalised advertising. Cookies _gcl_au / _gcl_aw, duration 90 days. We also store in local storage (idc_attribution) the campaign you came from, for 90 days.
  • Facebook SDK (Meta Platforms Ireland Ltd): measuring visits for our Facebook/Instagram campaigns. Meta's code is loaded only after your consent. Cookies set by Meta on the facebook.com domain (e.g. fr, 90 days).

We use Google Consent Mode: until you accept, Google services run with consent denied and do not store cookies on your device. In this state Google may still receive cookieless technical signals (e.g. a page load), which it uses in aggregate form. Google and Meta may also process data outside the EU, under the conditions set out in section 5 and in their own policies (Google, Meta).

How to choose and change your mind. A banner appears on your first visit. You can:

  • Accept all cookies;
  • Reject non-essential cookies: rejecting is as easy as accepting and the Site works normally;
  • close the banner with the X: this counts as rejecting, and only technical cookies remain active;
  • choose by category with Customize: optional settings all start switched off.

We do not treat scrolling or simply browsing as consent. If you reject, we will not ask again for at least 6 months, unless the cookies we use change significantly. You can change your choice at any time from the "Cookie preferences" link at the bottom of every page or from "Privacy & consents" in your personal area. If you withdraw consent, the page reloads without the third-party tools. You can also delete cookies in your browser settings.

Legal basis: for technical cookies, Art. 122(1) Italian Privacy Code and performance of the service or legitimate interest (Art. 6(1)(b) and (f) GDPR); for statistics and advertising cookies, consent (Art. 122(1) Italian Privacy Code and Art. 6(1)(a) GDPR).

9. Changes and Updates

This policy is subject to changes and updates. Users are encouraged to consult it periodically. Substantial changes will be notified to users.

Each version of this policy is identified by its last-updated date, and we record the version in force together with each consent. If a change materially affects communications about upcoming events or cookies, we will ask for your choice again where necessary.