Privacy Policy

1. Data Controller

The data controller is ICE RACING KART di Rigotti Adriano, based in Via di Prusa 20, 38078 San Lorenzo Dorsino (TN), Italy — VAT No. 02469580225 — Tax Code RGTDRN81S21L174J.

To exercise your rights or request information, you can write to loylightonyou2@gmail.com.

2. Personal Data Processed

• Registration and account data: email, password (encrypted), first and last name.
• Purchase and billing data: shipping and billing address, phone number, order details.
• Payment data: securely handled by Stripe; we do not process or store your card details directly.
• Browsing data: IP address, user-agent, technical logs, technical cookies and — subject to consent — analytics cookies.
• Contact data: information provided through the contact form (name, email, subject, message).

3. Purposes and Legal Bases

• Contract performance (Art. 6.1.b GDPR): management of the account, orders, payments, shipping and after-sales support.
• Legal obligations (Art. 6.1.c GDPR): invoicing, tax compliance, bookkeeping.
• Legitimate interest (Art. 6.1.f GDPR): fraud prevention, site security, essential technical logs.
• Consent (Art. 6.1.a GDPR): analytics and marketing cookies, sending promotional communications (if enabled).

4. Data Recipients

Data may be shared with third parties acting as data processors pursuant to Art. 28 GDPR:

• Stripe Payments Europe, Ltd. — payment processing.
• Resend, Inc. — sending transactional emails (order confirmation, shipping, contact).
• Supabase / Lovable Cloud — database hosting and application infrastructure.
• Cloudflare, Inc. — CDN and site security.
• Couriers responsible for order delivery.
• Accountant, consultants and competent authorities where required by law.

5. Transfers Outside the EU

Some providers may process data outside the European Economic Area. In such cases, the transfer is safeguarded by European Commission adequacy decisions or by the Standard Contractual Clauses approved by the Commission itself.

6. Retention Period

• Account data: until a deletion request is received.
• Order and billing data: 10 years pursuant to Art. 2220 of the Italian Civil Code.
• Contact form messages: up to 24 months from receipt.
• Technical logs: maximum 12 months.

7. Data Subject Rights

At any time you may exercise the rights provided for under Articles 15-22 GDPR: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise these rights, write to loylightonyou2@gmail.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (www.garanteprivacy.it).

8. Changes

This notice may be updated. The date at the top of the document indicates the latest revision.