Last technical update: 23 September 2026
1. Controller and contact details
The controller of personal data for simsiciliarally.com is Italia events asd, registered at Via G.Impastato n.2, 90034 corleone Pa, VAT number 06749550825.
For privacy enquiries and to exercise your rights: simsiciliarally@gmail.com. Certified email (PEC): Italia-events@pec.it.
This notice covers the SIMSICILIARALLY portal and its pages on the publishing domain simsiciliarally-official.xgabbo.chatgpt.site. It is provided pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR).
2. Data, purposes and legal bases
- Partnerships. Your name, email, company or project, partnership type, links, message and any presentation or media kit are used to assess your proposal and respond. We record the submission date, the privacy notice accepted and the consent given in the form (Article 6(1)(a) GDPR). You may withdraw consent by writing to the controller, without affecting earlier processing. If your proposal leads to discussions or a relationship, necessary data is also processed to take the pre-contractual steps you request or to perform that relationship (point b).
- Contact and support. Your name, email, subject, reason for contacting us and message are used to handle your enquiry and respond, on the basis of the consent requested in the form and, where relevant, pre-contractual steps requested by you. Messages are forwarded to the team’s mailbox.
- Previous requests. Data in requests already received (name, email, optional phone number, notes and requested configurations) is used to complete their handling and contact you. The legal basis is taking pre-contractual steps at your request (point b). The pre-order service has closed and no longer accepts new requests. No payment card data was collected.
- Events and sporting activities. Event proposals include organiser details, a contact email and event information. Approved content may be published in the calendar; the contact details collected for verification remain private. Profiles, images and sporting results shown in team and classification sections document activities and competitions in connection with participation or collaboration and the legitimate interest in communicating sporting activities (point b or f, depending on the relationship).
- Restricted areas. Access codes, sessions and profile data enable authentication and use of the Driver Area or administration system. Processing is necessary for the service and its security (points b and f). Administrative access may also use the publishing platform’s authentication service.
- Browsing, security and statistics. The systems serving the website process technical data, such as IP addresses, HTTP requests and browser information, to deliver pages and prevent abuse. The application uses identifiers derived from IP addresses to limit repeated submissions, without exposing them publicly. The legal basis is the legitimate interest in protecting the service and checking its operation (point f). Internal statistics store aggregate counts by page, interaction type, device category and broad referral source; they do not record form contents, IP addresses, visitor identifiers or individual browsing paths.
Data may also be processed to comply with legal obligations (point c) and, where necessary, to establish or defend legal claims. The application does not make decisions with legal effects based solely on automated processing or carry out advertising profiling.
3. Required and optional data
Fields marked with an asterisk are required to receive and handle the relevant request. If you do not provide them, or do not give consent where required, you cannot submit that form; you can still browse the public pages. Attachments, website, profile and additional information in partnership proposals are optional.
Only provide relevant information. Do not include identity documents, health data or other particularly sensitive information in messages or attachments. If you provide another person’s data, ensure you are entitled to share it and inform them of the processing.
4. Recipients and external services
Requests are accessible to people authorised to handle them. Technical providers may process data to deliver services: Sites/OpenAI hosting and publishing, Cloudflare infrastructure and protection, Google email and, for request summaries, FormSubmit or Resend when configured. Partnership proposals and their attachments are stored in the administration system; attachments are not added to the site’s public media library.
Provider documentation: Cloudflare, OpenAI, Google, FormSubmit and Resend.
Services may involve processing outside the European Economic Area. Transfers subject to the GDPR use the safeguards set out in Chapter V, such as adequacy decisions or standard contractual clauses, depending on the service and recipient. You may ask the controller for information about recipients and applicable safeguards, and for a copy of the relevant terms.
Links and embedded content from Instagram, Facebook, TikTok, Discord, Google Drive, Emperor Servers and other linked sites are governed by their operators’ privacy notices. Loading embedded content may communicate technical data to the provider. This notice does not replace those of external services.
5. Retention and deletion
Requests, pre-orders and proposals are retained for as long as necessary to assess them, communicate and manage any resulting relationship. When a matter ends without further action, data that is no longer needed must be removed. If an agreement is reached, data needed to perform it, meet legal obligations or protect rights may be retained for the applicable periods. The controller reviews retained requests and can delete proposals and their attachments.
Private profiles are retained for the duration of the relevant relationship; retention of public results takes account of sporting records and requests from data subjects. The application’s statistical counts cover a 180-day window. Administration sessions expire after 8 hours and Driver Area sessions after 12 hours; technical identifiers used to limit submissions last only for the relevant security window. Technical copies and provider logs follow the retention cycles of the services used and are not used by SIMSICILIARALLY for additional purposes.
7. Your rights
Where provided for by the GDPR, you may request access, rectification, erasure, restriction of processing and data portability; you may object to processing based on legitimate interests and withdraw consent. Write to simsiciliarally@gmail.com or the certified email address (PEC) Italia-events@pec.it, describing your request and providing information that helps us identify your records. To protect your data, we may request proportionate evidence to verify your identity.
You may complain to the Italian Data Protection Authority or the competent supervisory authority, and seek a judicial remedy. Requests are handled within the time limits set by law.
8. Updates
This notice is updated when the services or processing described change. The date at the top identifies the current version; any new purposes requiring consent will be presented before the relevant processing begins.