Privacy Policy

Regulation (EU) No. 679/2016 (GDPR)

Last updated: 12 May 2026

This privacy notice is provided pursuant to Articles 13 and 14 of Regulation (EU) No. 679/2016 (the “GDPR”) by Automobile Club Sassari, acting as Data Controller, in favour of users browsing the website www.sardegnarallyraid.com (the “Website”), dedicated to the “Sardegna Rally Raid” sporting event organised by Automobile Club Sassari.

The personal data (“Data”) of users browsing the Website are processed in accordance with the principles of fairness, lawfulness, transparency, and protection of confidentiality and the rights of the Data Subject, in compliance with the GDPR, Italian Legislative Decree No. 196/2003 as amended (Italian Personal Data Protection Code), and any other applicable national and supranational regulations on the subject, including the measures adopted by the Italian Data Protection Authority (Garante per la protezione dei dati personali).

1. Categories of Data Processed

The following categories of Data are processed:

a) Browsing Data The IT systems and software procedures used to operate the Website acquire, in the course of their normal operation, certain personal Data whose transmission is implicit in the use of internet communication protocols. In particular:

• IP address, including time of access;
• type of browser used (user agent) and operating system;
• pages visited and time spent on each page;
• method used to submit the request to the server;
• size of the file received in response and numerical code indicating the response status.

This Data is used solely for the purpose of obtaining anonymous statistical information on the use of the Website and to monitor its proper functioning; it is stored in the hosting server’s log files for the time strictly necessary and may be used to ascertain liability in the event of hypothetical computer-related offences against the Website.

b) Data Collected through Cookies and Similar Technologies The Website uses technical cookies necessary for its operation. As of the date of publication of this notice, no statistical analysis, marketing, or profiling tools are in use. For all details, please refer to the Cookie Policy.

c) Data Voluntarily Provided through Comments on Articles If the User chooses to post a comment on articles in the “News” section, the Data voluntarily provided (name, email address, content of the comment, and the IP address of the device used to publish the comment) will be processed in order to enable publication and to prevent abuse (spam, unlawful content).

d) Data Provided via WhatsApp Contact If the User chooses to contact the organisation via the WhatsApp number made available on the Website, the contact Data communicated (phone number, name potentially associated with the account, content of the communication) will be processed solely for the purpose of providing the requested response.

e) Data Related to the Viewing of Embedded Video Content The Website embeds video content from the YouTube platform (Google LLC). Viewing such content may involve the processing of Data by the service provider (see “International Data Transfers” section).

2. External Services Accessible via Links

The Website does not directly host registration forms, account creation features, or structured data collection tools. Registrations for competitions and ancillary services occur exclusively through external platforms accessible via links provided on the Website, in particular:

• ACI Sport Portal (registrations for Cross Country, W2RC Candidate Event, Classic, Experience)
• FMI Sigma Portal (registrations for the Italian Motorally Championship)
• JotForm (Supplementary Services Order Form, logistics packages for car competitors)
• Google Forms (Foreign Competitors Form)
• Portal managed by Insolita Sardegna (logistics and accommodation packages for moto competitors)

By clicking on the relevant links, the User leaves the Website and accesses platforms operated by independent Data Controllers. The processing of Data provided on such platforms is governed by their respective privacy notices, which we invite Users to consult. Automobile Club Sassari is not responsible for the processing practices carried out on such platforms, without prejudice to any subsequent use of the Data received from them for purposes of managing the sporting event, for which a specific notice will be provided at the time of registration.

3. Purposes and Legal Basis of Processing

The Data collected is processed for the following purposes:

The provision of Data is free and voluntary; however, failure to provide it may make it impossible to respond to requests from the User or to use specific features of the Website (e.g. posting of comments).

4. Methods of Processing

Data is processed using electronic and IT tools, through means suitable to ensure its security and confidentiality. Appropriate technical and organisational measures are in place to prevent the risks of unauthorised access, destruction or loss, unauthorised processing, or processing inconsistent with the purposes of collection, in compliance with Art. 32 GDPR.

Data is not subject to automated decision-making processes, including profiling, within the meaning of Art. 22 GDPR.

5. Categories of Subjects Who May Process the Data

Data may be processed by:

a) Authorised personnel of Automobile Club Sassari, duly instructed pursuant to Art. 29 GDPR.

b) External entities appointed as Data Processors pursuant to Art. 28 GDPR, in particular:

• the hosting service provider (Aruba S.p.A., based in Italy, with servers located within the European Union);
• the entity responsible for the technical maintenance of the Website;
• any other providers of technical and IT security services.

An updated list of Data Processors is available upon request by sending a communication to the contact details indicated in section 10.

c) Competent authorities, exclusively in cases provided for by law or upon their reasoned request.

Browsing Data is not disclosed or communicated to third parties for purposes other than those indicated above.

6. International Data Transfers

As a rule, Data is processed and stored on servers located within the European Union.

However, the Website embeds video content from the YouTube platform, operated by Google Ireland Limited / Google LLC. Viewing such content may involve the transfer of Data (e.g. IP address, device information) to servers located in the United States of America. The transfer takes place on the basis of the Standard Contractual Clauses approved by the European Commission and, where applicable, the provider’s adherence to the EU-U.S. Data Privacy Framework, which ensure a level of Data protection equivalent to that provided for by European legislation.

For further information, please refer to the Website’s Cookie Policy and to Google’s privacy policy (https://policies.google.com/privacy).

Users who do not wish such processing to take place may refrain from interacting with embedded video content or manage their preferences through the cookie banner.

7. Duration of Processing and Data Retention Period

User Data is processed and retained for the time strictly necessary to achieve the purposes for which it was collected, and in particular:

• Browsing Data and server logs: retained for the time technically necessary, normally not exceeding 12 months, except where retention is required for the purpose of investigating offences;
• Cookies: according to the periods indicated in the Cookie Policy;
• Comments on articles: retained for the duration of publication of the relevant content, unless deletion is requested by the User;
• Communications via WhatsApp or other channels: retained for the time necessary to handle the request and for the following 24 months for archiving and legal protection purposes;
• Data processed for legal compliance: retained within the limits provided for by applicable regulations.

Upon expiry of the periods indicated, Data will be deleted or irreversibly anonymised, except where further retention is required to comply with legal obligations or for the establishment, exercise, or defence of a legal claim.

8. Links to Third-Party Websites and Social Media Profiles

The Website contains links to the official social media profiles of the event (Facebook, Instagram) and to other third-party websites (sponsors, partners, sporting federations, public authorities). Automobile Club Sassari is not responsible for the data processing practices adopted by such third parties: Users are therefore invited to consult the privacy notices published on the respective websites and platforms.

9. Rights of the Data Subject

As Data Subjects, Users are granted the rights referred to in Articles 15 to 22 of the GDPR, as listed below:

• Right of access (Art. 15 GDPR): to obtain confirmation as to whether or not Data concerning them is being processed and, if so, to obtain access to such Data and to the information relating to the processing, as well as a copy thereof.
• Right to rectification (Art. 16 GDPR): to obtain the correction of inaccurate Data and the completion of incomplete Data.
• Right to erasure (“right to be forgotten”, Art. 17 GDPR): to obtain the deletion of Data concerning them, where one of the conditions provided for by the regulation applies.
• Right to restriction of processing (Art. 18 GDPR): to obtain the restriction of processing in the cases provided for by the regulation.
• Right to data portability (Art. 20 GDPR): to receive Data concerning them in a structured, commonly used, and machine-readable format, and to request its transmission to another Data Controller, where technically feasible.
• Right to object (Art. 21 GDPR): to object at any time to processing based on the legitimate interest of the Data Controller, provided that there are no compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the Data Subject, or where the processing is necessary for the establishment, exercise, or defence of a legal claim.
• Right to withdraw consent (Art. 7 GDPR): where processing is based on consent, the User may withdraw it at any time, without affecting the lawfulness of processing based on consent given before its withdrawal.

The exercise of these rights is free of charge and may be carried out by writing to the email address automobileclub@sassari.aci.it or to the Data Protection Officer at m.annibalidpo@aci.it.

As Data Subjects, Users also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei Dati Personali, Art. 77 GDPR), in accordance with the procedures indicated by the Authority on its website www.garanteprivacy.it.

10. Data Controller and Data Protection Officer (DPO)

Data Controller Automobile Club Sassari Viale Adua, 32 – 07100 Sassari (SS), Italy Italian Tax Code / VAT Number: 00072050909 Certified email (PEC): automobileclubsassari@pec.aci.it Email: automobileclub@sassari.aci.it Phone: +39 079 278102 Legal representative: President pro tempore

Data Protection Officer (DPO) Email: m.annibalidpo@aci.it

11. Amendments to This Privacy Notice

Automobile Club Sassari reserves the right to amend this privacy notice at any time, by publishing the updated version on the Website, indicating the date of the last update. Users are therefore invited to consult this page regularly.