(Last updated: October 13, 2026)

This Policy describes the methods and purposes of the processing of personal data carried out by IDEST S.r.l., as Data Controller (hereinafter, "IDEST" or the "Controller"), through the website live.idchronos.it (the "Site").

The processing of personal data of data subjects will be carried out in compliance with the applicable legislation, with particular reference to EU Regulation 2016/679 ("GDPR").

1. Data Controller

The Data Controller is IDEST S.r.l.
Registered office: Corso M. Fanti 40, 41012 Carpi (MO), Italy
Phone: +39 0594735965
Email: info@idchronos.it

2. Types of Data Processed

IDEST processes the following categories of personal data:

• Personal and contact information: name, surname, gender, date of birth, address, email, phone number.
• Registration data: data related to the sports club affiliation, race category.
• Payment and billing data: data related to credit cards, PayPal, Satispay, or other payment systems and billing information.
• Special categories of data (sensitive data):
  • Health-related data: information contained in medical fitness certificates required for registration in certain races.
  • Data concerning sports memberships: information from federation or sports promotion body cards, which may reveal membership in certain organizations.
• Navigation data: IP addresses, domain names, browser type, access times, and other parameters related to the user's operating system and IT environment.
• Performance and location data: race times, rankings, geolocation data during events, if applicable and with consent.
• Images and videos: photos and videos taken during sporting events.
• Commercial document viewing data: when a quote or price list is sent through a personal online viewing link, we record page openings, date and time, total and per-section reading time, page scrolling, clicks on links in the document, PDF downloads, device and browser type and a technical device identifier (stored in the browser); the IP address is stored only in encrypted form (non-reversible hash). If the data subject accepts the offer or books the date from the page, we also process the data entered in the form (name, role, organization, email, phone, event date, notes).
• Data for communications about upcoming events: email address, name, the Site language (Italian or English) in which you gave consent and, where available, the races you have registered for through the Site (so that we do not tell you about events you have already entered). We also process the date of the last mailing and of your last interaction (login to the Site, race registration, change of preferences).
• Consent log data: each time you give, refuse or withdraw consent to communications about upcoming events, we record your email address, user account (if any), date and time, IP address, browser and device type (user agent), where you made the choice (sign-up, race registration, personal area, prompt after login, link in an email), the text shown to you and the version of this privacy policy in force at that time.

3. Purposes and Legal Basis for Processing

Personal data is processed for the following purposes:

1. Provision of the requested services:
   • To manage registrations for races and sporting events.
   • To verify participation requirements, including the validity of medical certificates and memberships.
   • To process registration fee payments.
   • To publish results, rankings, and race times.
   • To provide timekeeping services and, where applicable, real-time tracking.

   Legal basis: Performance of a contract (Art. 6.1.b GDPR). For special categories of data (health, membership), the legal basis is the explicit consent of the data subject (Art. 9.2.a GDPR), provided at the time of uploading the document.

2. Compliance with legal obligations: To manage accounting, tax, and administrative obligations.

   Legal basis: Compliance with a legal obligation (Art. 6.1.c GDPR).

3. Service communications: To send emails regarding registration, payment confirmation, race reminders, or requests for missing documents.

   Legal basis: Performance of a contract (Art. 6.1.b GDPR).

4. Communications about upcoming sports events (email marketing, with consent): sending you emails, at most 4 times a month, about races and sports events open for registration, listed in the calendar on live.idchronos.it. The emails are sent by IDEST, only concern events you can register for on the Site and do not contain offers of other companies' products. We do not sell or disclose your address to race organisers or anyone else for their own marketing.

   We only write to you if you have given your consent. Consent is always optional. You can give it with a dedicated checkbox (never pre-ticked) when creating your account, when you register yourself for a race, in the "Privacy & consents" section of your personal area, or in reply to a one-time prompt after login. If you do not give it, you can still use the Site and register for races with no consequences.

   No individual email measurement: our emails contain no invisible images or links with personal codes, so we do not know whether an individual recipient opens an email or clicks its links. We only count, in aggregate form, visits to the Site coming from our emails (campaign parameters in links, with no personal codes), and only if you have accepted statistics cookies.

   We do not use this data for automated decisions or for profiling that significantly affects you. The only selection we make is to exclude events you have already registered for and to write to you in the language in which you gave consent.

   Legal basis: consent (Art. 6(1)(a) GDPR and Art. 130(1)-(2) of the Italian Privacy Code, Legislative Decree 196/2003).

5. Proof of consents and objections: keeping a log of your choices so that we can show we only wrote to you when, and for as long as, we were allowed to, and so that we respect withdrawals and objections (including by keeping your address on a suppression list so that we no longer write to you).

   Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR, in connection with Arts. 5(2) and 7(1) GDPR) and our legitimate interest in defending ourselves against claims (Art. 6(1)(f) GDPR).

6. Publication of photos and videos (with consent): To publish images of the event on the Site or social media channels for documentary and promotional purposes.

   Legal basis: Consent of the data subject, usually collected by the event organizer. Alternatively, the legitimate interest of the Controller to document the public event (Art. 6.1.f GDPR).

7. Management of commercial proposals: To know whether and how a quote or price list sent to an organizer has been viewed, in order to follow up at the right time and improve our proposals; to measure the effectiveness of our advertising campaigns by importing accepted offers into Google Ads (with the ad click identifier or SHA-256 hashed email and phone). Viewing data is visible only to IDEST administrative staff and is not used for automated profiling.

   Legal basis: Legitimate interest of the Controller in managing and improving its commercial negotiations and measuring advertising (Art. 6.1.f GDPR). For accepting the offer and booking the date: pre-contractual measures taken at the request of the data subject (Art. 6.1.b GDPR). The data subject may object at any time by writing to info@idchronos.it.

8. Site security and operation: To ensure the proper functioning of the Site and protect it from fraudulent or malicious activities.

   Legal basis: Legitimate interest of the Controller (Art. 6.1.f GDPR).

4. Data Retention Period

Personal data is kept for the time strictly necessary to achieve the purposes for which it was collected:

• Data for service provision: Kept for the duration of the contractual relationship and, after its termination, for 10 years to comply with legal obligations (e.g., invoice retention).
• Medical certificates, memberships, and other documents: These documents are solely for the purpose of event participation. They are stored securely and are not publicly accessible. They are periodically and permanently deleted within 90 days of the end of the sporting event to which they refer. Only the outcome of the check (valid or not valid) and the document's expiry date remain with the registration.
• Data for communications about upcoming events: processed until you withdraw consent or object. In any case we stop sending, and delete the data used only for this purpose, if you have had no interaction with us for 24 consecutive months (login to the Site, race registration, change of preferences).
• Consent and objection log: kept for as long as we send you communications and for 5 years after withdrawal, objection or the last mailing, which is the period in which the processing can be challenged. If you withdraw or object, we keep your email address on a suppression list for as long as needed to make sure we do not write to you again.
• Commercial document viewing data (openings, reading times, clicks, downloads): automatically deleted after 12 months, or earlier at the data subject's request. Data entered to accept an offer or book a date is kept for the duration of the negotiation and of any contractual relationship, and thereafter according to the terms stated for data for the provision of services.
• Navigation data: kept in the server's technical logs for a maximum of 30 days, unless needed to investigate crimes or handle security incidents.

5. Data Communication and Transfer

Personal data may be disclosed to:

• Event organizers: For the organizational management of the race.
• Official timekeepers and photographers of the event.
• Service providers: companies providing hosting (DigitalOcean, with servers located in the European Union), payment services (e.g. Stripe, PayPal, Satispay), delivery of service emails and communications about upcoming events (MailerSend), Site statistics and advertising measurement (Google, only as described in section 3 and in the Cookie section), bot protection for forms (Cloudflare Turnstile, on registration and when sending requests from the Site: it receives the IP address and technical browser data), etc. These act as Data Processors (Art. 28 GDPR) under a contract requiring them to use the data only on IDEST's behalf. Payment providers process payment data as independent controllers.
• Competent authorities: When required by law.

Only the data in rankings, start lists and results (first name, surname, sex, category, club, bib number and times) are disseminated, i.e. published on the Site. Documents, membership cards, certificates, tax codes and contact details are never published. Some providers, or their sub-processors, may also process data outside the European Economic Area (for example in the United States). In such cases the transfer takes place only on the basis of a European Commission adequacy decision (including, for participating companies, the EU-U.S. Data Privacy Framework) or the Standard Contractual Clauses approved by the Commission (Arts. 45 and 46 GDPR). You can ask for information on the safeguards adopted by writing to info@idchronos.it.

6. Security Measures

IDEST adopts appropriate technical and organizational measures to protect personal data from loss, illicit, or unauthorized use. Sensitive documents such as medical certificates and memberships are stored with enhanced security protocols to ensure maximum confidentiality.

7. Rights of the Data Subject

As a data subject, you have the right to exercise the following rights under the GDPR:

• Right of access (Art. 15): To obtain confirmation as to whether or not personal data concerning you is being processed, and to access that data.
• Right to rectification (Art. 16): To obtain the correction of inaccurate personal data.
• Right to erasure ('right to be forgotten', Art. 17): To obtain the erasure of your personal data, in the cases provided for by law.
• Right to restriction of processing (Art. 18): To obtain the restriction of processing.
• Right to data portability (Art. 20): To receive the personal data concerning you in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21): To object at any time to the processing of your data for marketing purposes or for reasons related to your particular situation.
• Right to withdraw consent: To withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, you can send a request to the email address info@idchronos.it. You also have the right to lodge a complaint with the competent supervisory authority (in Italy, the Garante per la Protezione dei Dati Personali).

How to stop receiving communications about upcoming events. You can withdraw consent or object at any time, free of charge and without giving reasons, in any of these ways:

• using the "Unsubscribe" link in every email: one click is enough, with no need to log in;
• from the Privacy & consents section of your personal area on the Site, where you can also see the history of your choices;
• by writing to info@idchronos.it.

Withdrawal through the link or the personal area takes effect immediately; requests sent by email within 2 working days. It does not affect service emails about your registrations and orders, which you will keep receiving, and it does not make communications sent before it unlawful.

8. Cookies and similar tools

Cookies are small files the Site stores in your browser. We also use similar tools such as the browser's local storage. We divide them into three groups.

Technical cookies (always active). They are needed to run the Site and the services you ask for: account login, form security, cart and registrations, payments, remembering your cookie choices. They do not require consent (Art. 122(1) Italian Privacy Code).

• laravel_session: browsing session and account login. Duration: 120 minutes of inactivity.
• XSRF-TOKEN: protects forms against fraudulent submissions. Duration: same as the session.
• remember_web_*: only if you tick "Remember me" at login. Duration: 400 days or until logout.
• Local storage cookieconsent_analytics, cookieconsent_ads, cookieconsent_version, cookieconsent_ts: remember your cookie choices and when you made them. Kept until you clear your browser data.
• Payment providers' cookies (Stripe, PayPal, Satispay): set only on payment pages, for security and fraud prevention.

Statistics cookies (only with your consent). Activated only if you accept the "Statistics" category in the banner.

• Google Analytics 4 (Google Ireland Ltd): statistics on visits to the Site. Cookies _ga and _ga_6JD3GSDHPN, duration 13 months.

Advertising cookies (only with your consent). Activated only if you accept the "Advertising" category in the banner.

• Google Ads (Google Ireland Ltd): measuring the effectiveness of our advertising campaigns (conversions) and personalised advertising. Cookies _gcl_au / _gcl_aw, duration 90 days. We also store in local storage (idc_attribution) the campaign you came from, for 90 days.
• Facebook SDK (Meta Platforms Ireland Ltd): measuring visits for our Facebook/Instagram campaigns. Meta's code is loaded only after your consent. Cookies set by Meta on the facebook.com domain (e.g. fr, 90 days).

We use Google Consent Mode: until you accept, Google services run with consent denied and do not store cookies on your device. In this state Google may still receive cookieless technical signals (e.g. a page load), which it uses in aggregate form. Google and Meta may also process data outside the EU, under the conditions set out in section 5 and in their own policies (Google, Meta).

How to choose and change your mind. A banner appears on your first visit. You can:

• Accept all cookies;
• Reject non-essential cookies: rejecting is as easy as accepting and the Site works normally;
• close the banner with the X: this counts as rejecting, and only technical cookies remain active;
• choose by category with Customize: optional settings all start switched off.

We do not treat scrolling or simply browsing as consent. If you reject, we will not ask again for at least 6 months, unless the cookies we use change significantly. You can change your choice at any time from the "Cookie preferences" link at the bottom of every page or from "Privacy & consents" in your personal area. If you withdraw consent, the page reloads without the third-party tools. You can also delete cookies in your browser settings.

Legal basis: for technical cookies, Art. 122(1) Italian Privacy Code and performance of the service or legitimate interest (Art. 6(1)(b) and (f) GDPR); for statistics and advertising cookies, consent (Art. 122(1) Italian Privacy Code and Art. 6(1)(a) GDPR).

9. Changes and Updates

This policy is subject to changes and updates. Users are encouraged to consult it periodically. Substantial changes will be notified to users.

Each version of this policy is identified by its last-updated date, and we record the version in force together with each consent. If a change materially affects communications about upcoming events or cookies, we will ask for your choice again where necessary.

1. Introduction

The service, accessible through the portal www.IDchronosLive.it, is provided by IDEST s.r.l., with registered office in Carpi (MO), Corso Manfredo Fanti 40, Tax Code/VAT No. 03736740360. IDEST s.r.l., through the website, with pages that are either freely accessible and/or restricted, makes an online platform available to the User in order to promote its business. In particular, by sharing multimedia content, it facilitates and enables registration, where the conditions required by the organiser are met, for sporting and/or recreational events and/or in any case lawful events.

Registration for Events is only permitted to registered Users who have:

a) read the information notice on the processing of personal data;

b) accepted these general terms and conditions;

c) created an account.

Registration is permitted only to Users who are of legal age.

2. ACCOUNT CREATION – REGISTRATION CREDENTIALS

In order to register for an Event, the User must complete the registration form available on the Website in electronic format and submit it by following the instructions that will appear on the Website from time to time. At the end of the procedure, an account and a password will be assigned to the User, which may be used exclusively by the User and may not be transferred to third parties. The User must promptly notify IDEST s.r.l. if any misuse of their credentials is suspected, the User being the sole and exclusive party responsible for the safekeeping and proper use of the credentials received.

The User warrants that the data entered during registration and account creation are complete, accurate and truthful. The User agrees to hold IDEST s.r.l. harmless from any compensation obligations and/or sanctions arising from and/or in any way connected with any breach by the User of the rules on registration to the Website. The User is solely responsible for access to the Website through their registration credentials and is directly liable for any damage or harm caused to IDEST s.r.l. or to third parties as a result of improper use, loss, misappropriation by others, or failure to maintain appropriate confidentiality of their registration credentials. All operations carried out using the registration credentials shall be deemed to have been carried out by the User to whom the credentials relate.

IDEST s.r.l. reserves the right, at its sole discretion, to refuse the registration of any User and/or to cancel an existing registration.

3. USE OF THE PORTAL

IDEST s.r.l. provides the services specified on the Portal on an “AS IS” and “AS AVAILABLE” basis, without any additional, express or implied warranties, either as to the content or as to the availability and usability of such content. The Events available on the Website are accessible only for the limited period of time specified therein.

IDEST s.r.l. does not warrant uninterrupted and continuous access to the Portal and to the Services, as such access may be affected by various factors beyond its control. By way of example, ACCESS TO THE PORTAL, ACCESS TO THE SERVICES AND THEIR USE MAY BE SUSPENDED AND/OR INTERRUPTED (INCLUDING PERMANENTLY) FOR TECHNICAL REASONS OF ANY KIND, FOR EVENTS OF FORCE MAJEURE OR FORTUITOUS EVENTS, OR FOR BREACH BY THE USER OF THE OBLIGATIONS UNDER THESE TERMS AND CONDITIONS, WITHOUT THE USER BEING ENTITLED TO ANY COMPENSATION FROM IDEST s.r.l. AND/OR WITHOUT IDEST s.r.l. BEING LIABLE IN ANY WAY FOR ANY CONSEQUENCES SUFFERED BY THE USER AS A RESULT OF SUCH SUSPENSION AND/OR INTERRUPTION. IDEST s.r.l. reserves the right, following reports from Users or at its sole discretion, to delete any content and/or data that conflict with and/or breach these general terms and conditions and/or the User’s obligations under these general terms and conditions, without the User being entitled to any compensation from IDEST s.r.l. and/or without IDEST s.r.l. being liable in any way for any consequences suffered by the User as a result of such deletion of data.

4. INFORMATION ON THE PORTAL

IDEST s.r.l. does not guarantee that the information on the Portal is complete and/or free from errors, as such information may be provided by third parties. The User acknowledges that no liability for any deficiencies, inaccuracies or omissions in the information available on the Website may be attributed to IDEST s.r.l.

The User must promptly report to the Portal any errors or any other improper behaviour or abuse committed by other Users.

Users must not post or send, by email or via any other means, any virus or other software program that may interrupt, destroy or limit the functionality of any software, hardware or device. For all information transmitted by email or by any other means, whether public or private, including, without limitation: photos, videos, graphics, news, data, texts, software, sounds or any other type of content, full responsibility lies solely with the User who has submitted such content.

Although the Portal is periodically monitored, IDEST s.r.l. cannot guarantee that it is free from viruses or other potentially harmful programs. It is the User’s responsibility to take all necessary security measures to protect their own devices.

IDEST s.r.l. does not control the content posted by Users. However, IDEST s.r.l. reserves the discretionary right to refuse or remove from its Platform any unlawful content or any content that is, at its sole discretion, considered inappropriate; by way of example: blasphemous, obscene, unlawful, vulgar, illicit, pornographic, racist, defamatory content; content relating to illegal substances; content discriminatory towards individuals, groups or organisations; content relating to hacking or cracking. Likewise, no data, text, images, links, software or other content that IDEST s.r.l. may consider dangerous, unlawful, illegal, defamatory, vulgar, racist, obscene or otherwise inappropriate for the purposes of the Portal may be published.

IDEST s.r.l. respects Users’ freedom of expression. However, such freedom must be exercised within the limits of the law, without offending in any way entities, organisations, individuals or anyone else. The User who posts a comment or opinion on the Portal is solely responsible for its content. IDEST s.r.l. reserves the right to remove any comments or opinions that are defamatory, discriminatory or vulgar, without giving any notice or communication to the User who posted them. IDEST s.r.l. is not obliged to monitor or review the comments and opinions posted by Users. However, IDEST s.r.l. reserves the right to access such comments and opinions at any time and without prior notice in order to verify compliance with these Terms and Conditions. If any violation is found, whether actual, verified or alleged, IDEST s.r.l. reserves the right to take the necessary actions, including removal of the content.

5. USER OBLIGATIONS

The User undertakes to access the Portal and use the Services in full compliance with the mandatory civil, criminal and administrative law provisions in force under Italian law. In particular, but not limited to, the User undertakes not to use the Portal for illegal or unlawful purposes or for purposes contrary to public order, morality or decency.

The User undertakes not to reproduce, duplicate, copy, sell, even partially, and in any case not to exploit for commercial purposes the Platform made available by IDEST s.r.l.

6. LINKS

Although IDEST s.r.l. periodically checks the content of web pages linked from the Portal or accessible through advertising banners (and/or other advertising spaces) that may be present on the Portal, IDEST s.r.l. assumes no responsibility for the content of such pages. With regard to links from external pages to the Portal, unless otherwise agreed in writing with IDEST s.r.l., only links to the home page of the Portal are permitted.

7. ADVERTISING SPACES

IDEST s.r.l. reserves the right to sell or otherwise commercialise advertising spaces on the Portal, to third parties, for any purpose and at its sole discretion. By using the content and services offered by the Portal, Users unconditionally accept that advertising may be displayed on the Portal. Such advertisements are not directly controlled by IDEST s.r.l., which uses independent advertising companies and networks for this purpose. The possible display, within a page, of advertisements from companies operating in similar or the same sectors does not in any way depend on the will of IDEST s.r.l., which has no direct commercial relationship with such operators, but is managed in a fully automated manner by third‑party advertising networks. IDEST s.r.l. cannot therefore be held liable in any way for the content of advertisements displayed on the Website.

8. MALWARE

Despite periodic checks of the Portal, IDEST s.r.l. cannot guarantee that it is free from viruses or other potentially harmful programs. Before accessing the internet and performing any operations, including, without limitation, downloading documents and software, the User must always adopt the most up‑to‑date protection measures.

9. INDUSTRIAL AND INTELLECTUAL PROPERTY

All trademarks and distinctive signs on the Portal are the exclusive property of IDEST s.r.l. and are protected under national, EU and international laws on copyright and distinctive signs. Unless otherwise indicated, copyright in the creations and/or works on the Portal (programming, graphics, designs, layout, texts, databases, etc.) is owned by IDEST s.r.l. Any unauthorised use of the content of the Website is therefore prohibited.

10. DIGITAL PAYMENTS, ADMINISTRATION FEES AND PAYMENT COMMISSIONS

Registration for Events may involve payment of a participation fee and/or administration fees, the amount of which is indicated from time to time in the Event information sheet and in the order summary before final confirmation. The Portal makes various digital payment methods available, including, by way of example, credit/debit cards belonging to the main international circuits, PayPal and Satispay, it being understood that the actual availability of specific methods may change over time and depending on the Event.

The use of digital payment methods may entail collection fees (electronic payment commissions) and/or administration fees, which are expressly shown to the User before confirming registration and submitting the payment, in compliance with transparency obligations under applicable Italian and EU legislation on payment services (including PSD2). By confirming the payment, the User accepts such additional charges, which are non‑refundable unless otherwise required by law or otherwise specified in the specific conditions of the Event.

Payments are processed through third‑party payment service providers, which act as independent data controllers with regard to payment data and implement security measures in line with industry standards (e.g. PCI‑DSS) and applicable legislation on payments and security (including strong customer authentication where required). The User must use only payment instruments they are lawfully entitled to use and warrants the accuracy and correctness of the data entered for payment purposes.

In the event of unauthorised or incorrectly executed payment transactions, the User must promptly contact their payment service provider (bank, card issuer or account provider), following the dispute procedures provided by such provider and by the applicable legislation on payment services. IDEST s.r.l., without prejudice to any mandatory provisions of law, shall not be liable for any disruptions, malfunctions or refusals of transactions attributable to payment service providers or card schemes.

11. PRIVACY

For information on the processing of personal data provided by the User at the time of Registration, Event registration and execution of payments, reference is made to the “Privacy Policy” page, available on the Portal in its constantly updated version, drafted in accordance with Regulation (EU) 2016/679 (GDPR) and applicable national legislation.

12. EFFECTIVENESS

Unless expressly derogated from by IDEST s.r.l., in whole or in part, these Terms of Use apply to all relationships between IDEST s.r.l. and Users in connection with browsing the Portal, the provision of Services and the execution of digital payments.

13. APPLICABLE LAW AND JURISDICTION

These general terms and conditions are governed by Italian law. Any invalidity of individual clauses of these general terms and conditions shall not affect the validity of the remaining provisions, which shall remain in full force and effect.

Any dispute relating to the interpretation of these terms or in any way connected with the use of the Platform, registration for Events or digital payments shall fall within the exclusive jurisdiction of the Court of Modena (Italy), without prejudice to any different mandatory jurisdiction that may apply under consumer protection legislation.