Legal

Privacy Policy

Version updated on 25 October 2026. In case of discrepancy, the Italian version prevails.

Last updated: 28 October 2026

This notice explains how personal data is processed for people who visit agracingacademy.com, contact AG Racing Academy or become partners. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, the “Privacy Code”).

1. Data controller

Racing Life ASD, an amateur sports association (associazione sportiva dilettantistica) without legal personality
Registered office: Via Valdice, 14 – 60025 Loreto (AN), Italy
Tax code 93155760429 · Italian VAT no. 02802490421
Legal representative: Alessio Guazzaroni
Email: info@agracingacademy.com · Phone: +39 333 2599551

AG Racing Academy is the name of the project and of the website, both run by Racing Life ASD: it is not a legal entity separate from the controller.

Massimiliano Moreni, founder and director of AG Racing Academy, runs the website, the email inbox and the call booking service on the controller's behalf, as processor under Article 28 GDPR.

No data protection officer (DPO) has been appointed, as one is not required for this type of activity (Article 37 GDPR).

2. What data we process and where it comes from

  • Browsing data. IP address, date and time of the request, page requested, browser and device type, referring page. These are generated automatically by the systems that deliver the website; they are not used to identify or profile you.
  • Data you give us. Name, company, role, email, phone number, message content and any attachments, when you email us, call us or write to us on WhatsApp.
  • Booking data. Name, email, topic and chosen time slot, when you book a discovery call through the booking page (book.agracingacademy.com/ag-racing).
  • Contract data. Details of contact persons at partner companies and the data needed to invoice and manage sponsorship and Business Experience contracts.

If your data was provided to us by the company or organisation you work for, for example because you are named as the contact person in a contract, that organisation is the source and the data consists of contact and role details (Article 14 GDPR).

We do not ask for special categories of data (Article 9 GDPR), such as health data, through the website: please do not send them. People taking part in track activities, and anyone photographed or filmed at events, receive a specific notice when they register.

Contact form. If you use the form on the Contact page, we process the data you enter (type of request, name, company, email and/or phone number, message), together with the page and language you write from and the country derived from your connection, solely to answer your request and for any negotiation that follows (steps taken at your request before entering into a contract, Article 6(1)(b) GDPR). Before the form is sent, the Cloudflare Turnstile anti-spam service checks that a person is writing, processing technical signals such as IP address, TLS fingerprint and user agent, on the basis of our legitimate interest in protecting the form from abuse (Article 6(1)(f)). The request is stored in Cloudflare Workers KV, copied to a restricted-access archive on the website's server in Germany and forwarded to the info@agracingacademy.com inbox by the mail server run on the same server; the internal arrival notification contains no personal data. Cloudflare, Inc. processes this data as processor; for Turnstile it also processes the technical signals as an independent controller, to improve bot detection, under its own privacy notice. The transfer to Cloudflare in the United States relies on adequacy decision (EU) 2023/1795 (EU-U.S. Data Privacy Framework) and, as a fallback, on the standard contractual clauses (Article 46(2)(c) GDPR). Outgoing emails, including our replies, may pass through the Brevo relay service (France, EU), as processor. Data sent through the form is deleted automatically 24 months after it is sent, unless it is needed for a concluded contract (section 8).

3. Purposes and legal bases

  • Running and securing the website, and preventing abuse and cyber attacks: the controller's legitimate interest in providing a secure website (Article 6(1)(f) GDPR).
  • Answering enquiries and arranging calls: steps taken at your request before entering into a contract (Article 6(1)(b)) when you act on your own behalf; legitimate interest in replying to you and managing the relationship with the organisation you represent (Article 6(1)(f)) when you act on behalf of a company or organisation.
  • Negotiating, concluding and performing sponsorship and Business Experience contracts: performance of a contract (Article 6(1)(b)) or, for contact persons at companies, legitimate interest in managing the contractual relationship (Article 6(1)(f)).
  • Legal obligations, in particular tax and accounting: legal obligation (Article 6(1)(c)).
  • Establishing, exercising or defending legal claims: legitimate interest (Article 6(1)(f)).
  • Promotional emails: only with your consent (Article 6(1)(a) GDPR and Article 130(1) and (2) of the Privacy Code) or, for existing clients, about services similar to those purchased unless you object (Article 130(4) of the Privacy Code). The website does not collect newsletter sign-ups.

Where processing is based on legitimate interest, you can object at any time (section 9).

4. Providing your data

Providing data is optional. Without contact details, however, we cannot reply to you, and without the data needed for a contract we cannot conclude or perform it.

5. Cookies and other tracking tools

The website sets no cookies, does not use browser storage (such as localStorage) and contains no analytics, advertising pixels, social media plugins or resources loaded from other websites: fonts and images are hosted on the website's own server. This is why no cookie banner is shown (Italian Data Protection Authority, Guidelines on cookies and other tracking tools of 10 June 2021, section 7.1).

The only exception is the Contact page when the form is active: it loads the Cloudflare Turnstile anti-spam service from challenges.cloudflare.com, which reads technical browser signals strictly necessary to tell people from bots and to protect the sending of your request; consent is therefore not required (Article 122(1) of the Italian Privacy Code). No other page of the website loads external resources.

The call booking page (book.moreniadvisory.com) sets a single technical cookie, book_lang, which remembers the chosen language for 12 months and does not require consent.

The content delivery provider, Cloudflare, may set technical security cookies, such as __cf_bm or cf_clearance, only when bot protection or anti-abuse checks are active. These cookies are strictly necessary and do not require consent (Article 122(1) of the Privacy Code).

Links to other websites (for example LinkedIn, WhatsApp, moreniadvisory.com and the sources cited in our articles) take you away from this website: from that point on, the privacy notices of those websites apply.

6. Recipients

Data is processed by authorised and instructed persons (Article 29 GDPR and Article 2-quaterdecies of the Privacy Code) and may be disclosed, only as far as necessary, to:

  • Hetzner Online GmbH (Germany), provider of the server located in the European Union that hosts the website, the email inbox and the booking service, as processor;
  • Cloudflare, Inc. (United States) and its group companies, the website's content delivery and protection network, which processes browsing data as processor;
  • Brevo SAS (Paris, France), relay service for outgoing email from the AG Racing Academy mailbox, as processor; for some functions it uses providers also outside the European Union, with the safeguards of the Data Privacy Framework or the standard contractual clauses (Articles 45 and 46 GDPR);
  • Massimiliano Moreni, processor (section 1);
  • professional advisers (for example the accountant), banks and public authorities, where required by law or by the management of the contract;
  • circuits, organisers, insurers and the affiliating sports federation (ACI) involved in track activities, limited to the participant data described in the specific notice.

If you choose to write to us on WhatsApp, the messaging service is provided by WhatsApp Ireland Limited under its own privacy notice. Data is not published or sold.

7. Transfers outside the European Economic Area

Cloudflare, Inc. is based in the United States and participates in the EU-U.S. Data Privacy Framework: the transfer relies on the European Commission's adequacy decision (EU) 2023/1795 of 10 July 2023 (Article 45 GDPR). Should that participation lapse, the standard contractual clauses adopted by the Commission (Article 46(2)(c) GDPR), included in Cloudflare's data processing agreement, apply. You can ask about these safeguards at info@agracingacademy.com.

8. How long we keep data

  • Technical logs of the website server: no longer than 30 days, unless needed to investigate abuse or unlawful activity.
  • Enquiries, correspondence and bookings not followed by a contract: 24 months from the last contact.
  • Contracts, invoices and related correspondence: 10 years from the end of the relationship, the ordinary limitation period (Article 2946 of the Italian Civil Code) and the retention period for records and correspondence (Article 2220 of the Italian Civil Code); longer only if needed for pending litigation.
  • Data processed for promotional emails: until you withdraw consent or object.

At the end of these periods, data is deleted or anonymised.

9. Your rights

You may at any time request access to your data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and portability of the data you provided (Article 20). You may object to processing based on legitimate interest and, always and without giving reasons, to processing for promotional purposes (Article 21). Where you gave consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal (Article 7(3)).

To exercise your rights, write to info@agracingacademy.com. We reply within one month of the request; for complex requests this may be extended by two further months, with reasons (Article 12(3)).

No decisions are taken based solely on automated processing, including profiling (Article 22 GDPR).

You may lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), under Article 77 GDPR and Article 141 of the Privacy Code, or with the supervisory authority of the EU Member State where you habitually reside, work or where the alleged infringement took place. If you are in Switzerland, the Swiss Federal Act on Data Protection also applies and you may contact the Federal Data Protection and Information Commissioner (FDPIC).

10. Security

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR), including encrypted connections (HTTPS), a server in the European Union with an encrypted disk, and access restricted to authorised persons.

11. Changes

This notice may be updated, for example if services or providers change. The version in force is always on this page, with the date of the last update.