This privacy policy is provided pursuant to Art. 13 of EU Regulation 2016/679 (hereinafter GDPR) by We Can Race S.r.l., with registered office at via Ospedale Vecchio n.3 c/o NEST SRL STP – 33170 – Pordenone (PN), VAT number 00951680941, in its capacity as Data Controller.

1. Data Controller

The Data Controller is We Can Race S.r.l., with registered office at via Ospedale Vecchio n.3 c/o NEST SRL STP – 33170 – Pordenone (PN), VAT number 00951680941. To contact the Controller, the following contact details can be used: email: amministrazione@wecanrace.it, pec: wecanrace@legalmail.it, phone: +39 0434.175.4520.

2. Purposes of Processing

Personal data provided by users are processed for the following purposes:

a) Booking Management

Data is processed to manage bookings for track driving experiences, including payments and communication with customers.

b) Contract Performance

Processing necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

c) Legal Compliance

Processing necessary for compliance with a legal obligation to which the controller is subject, including tax and accounting obligations.

d) Direct Marketing

Sending commercial and promotional communications regarding offered services, only with prior consent of the data subject.

e) Profiling

Analysis of preferences and consumption habits to improve the commercial offer, only with prior consent of the data subject.

f) Safety

Ensuring user safety during driving experiences and complying with legally required safety obligations.

3. Legal Basis for Processing

The processing of personal data is based on the following legal bases: performance of a contract (Art. 6, para. 1, lett. b GDPR), compliance with legal obligations (Art. 6, para. 1, lett. c GDPR), consent of the data subject (Art. 6, para. 1, lett. a GDPR), legitimate interest of the controller (Art. 6, para. 1, lett. f GDPR).

4. Categories of Data Processed

The following categories of personal data are processed: personal details (name, surname, date of birth), contact data (email address, phone number, address), payment data (credit card information through secure processors), driving preference data, audiovisual content (images and video footage of the track session), website navigation data. If the user chooses to sign in with their Google or Apple account, WCR receives basic profile data from these providers (first name, last name and email address), used solely to create and manage the account.

5. Processing Methods

The processing of personal data is carried out using computer and/or telematic tools, with organizational and logical methods strictly related to the stated purposes. Data is processed in compliance with the security measures provided for by the GDPR.

6. Communication of Data to Third Parties

Personal data may be communicated to third parties in the following cases: payment service providers (Stripe, PayPal, Scalapay), IT service providers, email and newsletter sending platform (Brevo), data flow automation services (Pabbly Connect), video service providers (Google LLC, through the YouTube API Services), consultants and professionals, competent authorities when required by law, business partners only with prior consent of the data subject.

7. Use of the YouTube API

To produce and deliver the souvenir video of the track experience, We Can Race S.r.l. uses the YouTube API Services provided by Google LLC, which involve the processing of the video content and its associated metadata (title, description, driver's name, circuit, event date). This processing complies with the Google API Services User Data Policy, and the data transmitted are subject to Google's privacy policy, available at the following links: Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy — Google Privacy Policy: https://policies.google.com/privacy

8. Cookies and Third-Party Content

The websites of We Can Race S.r.l. use cookies and similar technologies that store or read information on the user's device or browser, including by third parties (for example analytics and marketing services), for the operation of the site, for statistical purposes and, with prior consent, for marketing purposes. The websites also display content provided by third parties, such as YouTube and Vimeo videos, which may in turn use cookies. The list of cookies, their purposes and consent management are described in the Cookie Policy: https://wecanrace.it/en/cookie-policy/ — preferences can be changed at any time with the “Manage cookie preferences” button at the bottom of the Cookie Policy.

8-bis. Tracking Tools in Emails

Emails sent by We Can Race S.r.l. may contain tracking pixels and tracked links. A pixel is an invisible image that, when the email is opened, tells the sending service provider that the message has been opened. Tracked links record which link was clicked.

a) Data Collected

Date and time the email was opened, links clicked and some technical information, such as IP address, device type and email program used.

b) Purposes

With the data subject's prior consent, or under the transitional regime in letter f), these data are used to know which emails are opened and which content is of interest. They serve to improve communications and to adapt their content and frequency. Only for people who are tracked individually, the Controller may reduce or suspend sending after repeated unopened emails; people who are not tracked are not excluded for this reason.

c) Legal Basis and Consent

Except as provided in letter f), individual tracking takes place only with the data subject's consent (Art. 122 of Legislative Decree 196/2003 and Art. 6, para. 1, lett. a GDPR). Consent is requested in the newsletter sign-up form: the sign-up checkbox also counts as consent to the tracking described in the text next to it. Consent is recorded with date and time. Anyone who withdraws consent keeps receiving emails without any limitation. Anyone who subscribes in another way without giving it is not tracked individually (letter d).

d) Without Consent

Without consent, except as provided in letter f), opens and clicks in emails, including transactional emails such as order and booking confirmations, are not recorded individually.

e) Withdrawal of Consent and Objection

The data subject may withdraw consent, or object to tracking in the case described in letter f), at any time: via the “Non voglio che le mie email vengano tracciate” (I don't want my emails to be tracked) link at the bottom of every email, while continuing to receive communications without individual tracking; via the unsubscribe link in every newsletter, if they no longer wish to receive it; by writing to amministrazione@wecanrace.it. Withdrawal does not affect the lawfulness of processing based on consent given before the withdrawal.

f) Subscribers Before 29 October 2026

Anyone who was already subscribed to our communications before 29 October 2026 receives this information with the first useful mailing. Until they refuse, the measurement of opens and clicks continues. They may refuse it at any time via the link at the bottom of every email, while continuing to receive communications. After the refusal, opens and clicks are no longer recorded individually.

g) Retention and Parties Involved

Open and click data linked to the data subject are kept until consent is withdrawn, an objection is made or the person unsubscribes, and in any case for no more than 24 months from collection. Aggregate and anonymous statistics do not allow the data subject to be identified. Emails are sent through the Brevo platform, based in France, which acts as data processor on behalf of the Controller. Newsletter sign-up data are also sent to the Pabbly Connect automation service, which stores them (see section 9).

9. Transfer of Data to Third Countries

Some data may be transferred to third countries (e.g., United States) for the use of cloud and payment services. All transfers take place in compliance with the guarantees provided for by the GDPR.

10. Retention Period

Data is retained only for the time strictly necessary to achieve the purposes for which it was collected: contract data: 10 years from the end of the relationship, marketing data: until consent is withdrawn, navigation data: 24 months.

11. Automated Decision-Making Processes

No automated decision-making processes or profiling activities that produce significant legal effects are implemented.

12. Data Subject Rights

The data subject has the right to: access their personal data, rectify inaccurate data, erase data (right to be forgotten), restrict processing, object to processing, data portability, withdraw consent at any time.

13. How to Exercise Rights

To exercise their rights, the data subject can contact the Controller using the contact details indicated in point 1. The Controller will provide a response without undue delay and in any case within one month of the request.

14. Right to Complain

The data subject has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) if they believe that the processing of their personal data violates the GDPR.

15. Changes to this Privacy Policy

This privacy policy may be modified periodically. Changes will be published on this page with indication of the last update date.

16. Contact

For any questions regarding the processing of personal data, the Controller can be contacted at the contact details indicated in point 1. Email: amministrazione@wecanrace.it, PEC: wecanrace@legalmail.it, Phone: +39 0434.175.4520.

Contacts

Email: amministrazione@wecanrace.it

PEC: wecanrace@legalmail.it

Phone: +39 0434.175.4520