Privacy Policy of goandrace.com

Introduction

This Privacy Policy describes how AMEI WEB SOLUTIONS collects, uses, and protects the personal data of users ("User" or "Data Subject") who visit and use the goandrace.com website ("Site"). The processing of personal data is carried out in compliance with Regulation (EU) 2016/679 (GDPR) and current Italian legislation on personal data protection.

Data Controller

The Data Controller of personal data is:

AMEI WEB SOLUTIONS
Via Varsavia 24
50065 Pontassieve (FI), Italy
VAT ID: 07297840485
Email: info@goandrace.com

The Controller has not appointed a Data Protection Officer (DPO) as it does not fall within the cases provided for by Art. 37 of the GDPR.

Types of Personal Data Processed

The Controller processes the following categories of personal data:

Data voluntarily provided by the User:

Registration Data: Email address, username, and password chosen by the User to create an account.
Contact Data (Optional): Information provided via emails sent to the Controller.

Navigation Data: The computer systems and software procedures used to operate the Site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. These data are not collected to be associated with identified data subjects, but by their very nature could, through processing and association with data held by third parties, allow users to be identified. This category includes IP addresses or domain names of computers used by users connecting to the site, URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the response file, the numerical code indicating the status of the server’s response (successful, error, etc.), and other parameters related to the operating system and user’s environment. These data are used solely to obtain anonymous statistical information on site usage and to verify proper functioning. Access logs are kept by the hosting provider (Aruba S.p.A.) for 24 months for legal and security purposes.

Data collected through Cookies and similar technologies: The Site uses technical, analytical, and profiling cookies (the latter subject to consent). For detailed information on the cookies used, their purposes, and management, please consult our Cookie Policy.

Geolocation Data (GPX Files): Data relating to workout routes (geographic coordinates, timestamps, altitude, and optional performance data such as heart rate) contained in GPX files voluntarily uploaded by registered Users. These data are associated with the User's account.

Purposes of Processing and Legal Basis

Personal data are processed for the following purposes and legal bases:

a) Provision of Site services: To allow browsing of the Site, access to public areas, and the use of content.
Legal Basis: Performance of a contract / pre-contractual measures (Art. 6.1.b GDPR); Legitimate interest of the Controller (ensuring the functioning of the Site - Art. 6.1.f GDPR).

b) User Account Registration and Management: To create and manage an account to access the reserved area, and to allow the insertion and management of running events.
Legal Basis: Performance of a contract (Art. 6.1.b GDPR).

c) Management and Analysis of GPX Data: To allow the User to upload, visualize (via external map services), and analyze their workout data (GPX tracks) within their reserved area.
Legal Basis: Performance of a contract (Art. 6.1.b GDPR).

d) Aggregate Statistical Analysis: To compile anonymous and aggregated statistics about site usage (visited pages, time spent, geographical origin) through third-party services (Google Analytics, Shinystat).
Legal Basis: User Consent (Art. 6.1.a GDPR) expressed through the cookie banner.

e) Display of Advertising: To show relevant advertising banners through third-party services (Google AdSense).
Legal Basis: User Consent (Art. 6.1.a GDPR) expressed through the cookie banner.

f) Interaction with Social Networks: To allow interaction with social media platforms through buttons and widgets.
Legal Basis: User Consent (Art. 6.1.a GDPR) expressed via the cookie banner or direct plugin interaction.

g) Displaying External Content: To integrate content hosted on external platforms (e.g., OpenStreetMap/Leaflet maps, weather widgets).
Legal Basis: User Consent (Art. 6.1.a GDPR) for non-essential widgets; Contract performance (Art. 6.1.b GDPR) for maps essential to GPX display.

h) Security and Technical Maintenance: To ensure the Site’s security and infrastructure integrity, prevent fraud, and identify responsibility in case of cybercrimes (log analysis).
Legal Basis: Legitimate interest (Art. 6.1.f GDPR); Legal obligation (Art. 6.1.c GDPR).

i) Responding to User Requests: To manage requests sent via email.
Legal Basis: Performance of pre-contractual measures requested by the data subject (Art. 6.1.b GDPR).

Nature of Data Provision

Providing navigation data is implicit in using Internet protocols and necessary for the Site’s operation. Providing registration data (email, username, password) is mandatory to create an account and use reserved services (event entry, GPX management); failure to provide them prevents registration. GPX data provision is optional but required for related features. Consent for Aggregate Statistics (d), Advertising (e), Social Interaction (f), and non-essential External Content (g) is optional; lack of consent limits features or personalization but does not prevent browsing.

Methods of Processing

Data are processed using electronic and telematic tools with logic strictly related to the stated purposes, and with appropriate technical and organizational measures to ensure data security and confidentiality, preventing loss, unlawful use, or unauthorized access.

Data Retention Period

Personal data are retained only as long as necessary to achieve the purposes for which they were collected, in compliance with data minimization and storage limitation principles (Art. 5 GDPR):

Registration Data: Until the User deletes the account, requests deletion, or in case of prolonged inactivity. Accounts considered inactive (no login for over 18 consecutive months) will be automatically deleted after prior notification via email to the User with at least 30 days' notice.

Navigation Data/Access Logs: Retained by the hosting provider (Aruba S.p.A.) for 24 months for security and legal compliance.

Data collected via Cookies: For the duration specified in the Cookie Policy.

GPX Data: Retained until manually deleted by the User via their reserved area or until the account is deleted (including due to inactivity, as mentioned in the point above).

Aggregate Statistics Data (consent-based): Retained according to third-party policies (e.g., Google Analytics) until consent withdrawal.

Advertising Data (consent-based): Retained according to third-party policies (e.g., Google AdSense) until consent withdrawal.

Data provided by email: Retained as long as necessary to manage the User’s request.

Categories of Data Recipients

Personal data may be disclosed to third parties performing activities necessary for Site operation or related services on behalf of the Controller. These parties act as Data Processors (Art. 28 GDPR) or independent Controllers. Recipients include:

Technical service providers essential for Site operation (e.g., hosting provider Aruba S.p.A.).
Third-party companies providing aggregated statistical analysis (e.g., Google LLC for Google Analytics, Shinystat S.r.l.), subject to consent where required.
Advertising concessionaires (e.g., Google LLC for Google AdSense), subject to consent.
Social network platforms when the User interacts directly with embedded plugins.
Mapping providers for GPX visualization (e.g., OpenStreetMap/Leaflet).
Judicial or administrative authorities and public bodies for legal obligations.
Legal, fiscal, or professional consultants assisting the Controller.

Personal data are not disseminated (not made available to indeterminate parties).

Main Third-Party Providers and Privacy Policies

For transparency, the following are the main third-party providers used by the Site with links to their respective privacy policies:

Google LLC (Google Analytics, Google AdSense): https://policies.google.com/privacy
Shinystat S.r.l. (Statistical analytics): https://www.shinystat.com/it/informativa_privacy.html
OpenStreetMap Foundation (Maps / tiles): https://wiki.osmfoundation.org/wiki/Privacy_Policy
Leaflet library + jsDelivr CDN (Map display and JS/CSS delivery): https://www.jsdelivr.com/terms/privacy-policy
Aruba S.p.A. (Hosting and access logs): https://www.aruba.it/informativa_arubaspa.aspx

Transfer of Data Outside the European Economic Area (EEA)

The use of certain third-party services (particularly Google Analytics and Google AdSense) may involve the transfer of personal data to servers located in the United States. Such transfers occur in compliance with applicable law, based on adequacy decisions by the European Commission or through Standard Contractual Clauses (SCCs) approved by the Commission, supplemented by additional safeguards as required. Use of mapping services (OpenStreetMap/Leaflet) may also involve contact with non-EEA servers to load map tiles, technically necessary to provide the service. For details, refer to each provider’s privacy policy.

Specific Processing of Data Contained in GPX Files

The Site allows registered Users to upload GPX files to view and analyze their workouts. Specifically:

Data Processed: Geographic coordinates, timestamps, altitude, and performance data (e.g., heart rate).
Purpose: Solely to provide map display and workout analysis for the User within their private area.
Legal Basis: Contract performance (Art. 6.1.b GDPR).
Retention: Until deletion by the User or account removal; data from inactive accounts (24 months) deleted after 30 days’ notice.
Recipients: Only coordinates sent to map providers (OSM/Leaflet) for visualization; they act as independent controllers.
User Control: Users may delete their uploaded GPX data at any time.

Rights of the Data Subject

Under GDPR Articles 15–22, Users have the following rights:

Right of Access: Obtain confirmation of data processing and access relevant information.
Right to Rectification: Obtain correction of inaccurate data.
Right to Erasure ("Right to be Forgotten"): Request deletion of personal data in the cases provided by the GDPR.
Right to Restrict Processing: Request restriction in certain cases (e.g., accuracy contested, unlawful processing).
Right to Data Portability: Receive data in a structured, commonly used format and transmit it to another controller.
Right to Object: Object at any time to processing based on legitimate interest.
Right to Withdraw Consent: Withdraw previously given consent at any time, without affecting prior lawful processing. Cookie consent can be withdrawn via the cookie banner settings.
Right to Lodge a Complaint: File a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

How to Exercise Your Rights

Users may exercise their rights at any time by sending a written email to: info@goandrace.com, specifying the right they wish to exercise in the subject line.

Cookie Policy Information

This Privacy Policy should be read in conjunction with the Cookie Policy.

Changes to This Policy

The Controller reserves the right to modify this Privacy Policy at any time, notifying Users on this page and, where possible, by email. Please check this page regularly, referring to the “Last updated” date above.