Privacy Notice on the Processing of Personal Data – Roadbooking (Articles 13 and 14 of EU Regulation 2016/679)
Last updated: 12 October 2026 · Version 1
This notice explains in simple terms what personal data we process when you use roadbooking.com, for what purposes, on what legal grounds, and what your rights are. For capitalised terms, please refer to the definitions set out in the Platform’s Terms and Conditions.
1. Data controller and contact details
The data controller for the activities identified as its own in this policy is ROADBOOKING S.R.L., with its registered office at Via Pianette 61, 25064 Gussago (BS), Tax Code/VAT number and Brescia Companies Register number 04809720982, REA BS-643305, share capital €10,000.00, fully paid up.
Certified email (PEC): roadbooking@pec.it · Privacy email: privacy@roadbooking.com · Privacy contact: via the same contact details.
Roadbooking has not appointed a Data Protection Officer (DPO), as, at present, the conditions set out in Article 37 of Regulation (EU) 2016/679 (GDPR) are not met.
2. Who this applies to
This privacy notice is intended for:
- Participants, including guests who purchase or use a Tour without creating an account;
- Organisers and persons acting on their behalf;
- Visitors to the Platform;
- persons designated as emergency contacts.
This policy does not govern the processing carried out by the Organiser in its capacity as an independent data controller. The Organiser independently determines and manages the content of the offer, the rules of the Event/Tour, the participation requirements and the pre-contractual information, and processes the data necessary for the organisation, execution and management of its Event/Tour in accordance with its own privacy policy. This privacy notice, together with the Event/Tour terms and conditions and any other applicable pre-contractual information, must be made available by the Organiser on the Event page and/or during the checkout process. The emergency contact is used solely to manage emergency situations and does not receive marketing communications. Roadbooking does not determine this content nor does it act as a party to the contract relating to the Event/Tour; it retains its role as an independent data controller for the activities set out in this privacy notice and acts as a data processor only when processing data on behalf of the Organiser, in accordance with documented instructions and the applicable agreement.
2.1. Key definitions
Event: an activity or event published on the Platform. Tour: a purchasable variant of the Event, with its own dates, places, price and requirements. Participant: a person who purchases or takes part in a Tour. Organiser: the entity that organises and manages the Event. Order: the purchase of a Tour completed via the Platform. Platform: software for the online management and sale of Events, the marketplace and public pages managed by Roadbooking. Required Documents: documents and information required by the Organiser for admission to the Tour. Garage: an area where the Participant can store certain data and documents for future use. Terms: Roadbooking’s Terms and Conditions.
3. Privacy roles
| Subject | Role and activities |
|---|---|
| Roadbooking | Independent data controller for the Platform, accounts, authentication, security, fraud prevention, payment collection and reporting, its own invoicing, legal obligations, service communications, the newsletter and the production of anonymous statistics. |
| Organiser | Independent data controller for the data necessary to run the Event: registration, eligibility criteria, review of required documents, group management, own communications and marketing. |
| Roadbooking on behalf of the Organiser | Data processor pursuant to Article 28 of the GDPR for activities carried out on the Platform in accordance with the Organiser’s instructions and the data processing agreement. |
Roadbooking
Role and activities: Independent data controller for the Platform, accounts, authentication, security, fraud prevention, payment collection and reporting, its own invoicing, legal obligations, service communications, the newsletter and the production of anonymous statistics.
Organiser
Role and activities: Independent data controller for the data necessary to run the Event: registration, eligibility criteria, review of required documents, group management, own communications and marketing.
Roadbooking on behalf of the Organiser
Role and activities: Data processor pursuant to Article 28 of the GDPR for activities carried out on the Platform in accordance with the Organiser’s instructions and the data processing agreement.
Roadbooking collects payments in the name and on behalf of the Organiser, within the limits set out in Article 2(2)(b) of Legislative Decree 11/2010. In respect of its own payment, identification and anti-money laundering obligations, the payment service provider also acts as an independent data controller. With regard to the data and documents requested by the Organiser, including medical certificates, the Organiser is the independent data controller for the purposes specific to the organisation, admission, execution and management of the Event/Tour. Roadbooking acts as a data processor pursuant to Article 28 of the GDPR exclusively for activities carried out on behalf of the Organiser in accordance with documented instructions and the applicable agreement. The two roles may coexist for different processing operations: Roadbooking remains the independent data controller for the purposes specified in this privacy notice.
4. Data processed
| Data subject | Categories of data |
|---|---|
| Participants | Identification and contact details; emergency contact details, if provided; driving experience, if provided; vehicle details; billing details, if requested; order and payment details; account and login details; communications; technical and log data. Full card details are processed solely by Stripe. |
| Documents Required | Driving licence, vehicle registration document, insurance certificate, national or membership card, medical certificate, consent form and other documents required by the Organiser, including their numbers and expiry dates. The version, date and time of consents, as well as access to medical documents, are also recorded. |
| Organisers and their staff | Details of the organisation, legal representative, beneficial owner and contact persons; licences and insurance policies; contractual and billing details; account status with the payment provider. Identity verification and anti-money laundering checks are carried out by Stripe. Access to the back office and the operator reviewing each document are recorded. |
Participants
Categories of data: Identification and contact details; emergency contact details, if provided; driving experience, if provided; vehicle details; billing details, if requested; order and payment details; account and login details; communications; technical and log data. Full card details are processed solely by Stripe.
Documents Required
Categories of data: Driving licence, vehicle registration document, insurance certificate, national or membership card, medical certificate, consent form and other documents required by the Organiser, including their numbers and expiry dates. The version, date and time of consents, as well as access to medical documents, are also recorded.
Organisers and their staff
Categories of data: Details of the organisation, legal representative, beneficial owner and contact persons; licences and insurance policies; contractual and billing details; account status with the payment provider. Identity verification and anti-money laundering checks are carried out by Stripe. Access to the back office and the operator reviewing each document are recorded.
Roadbooking processes only the data necessary for the purposes described. As a rule, it does not collect data unrelated to the Order or the Event.
5. Purposes, legal bases and retention periods
| Purposes | Legal basis | Retention |
|---|---|---|
| Navigation, security and operation of the Platform | Article 6(1)(f) of the GDPR | Technical logs: 12 months. |
| Accounts and access via one-off codes | Article 6(1)(b) of the GDPR | For the duration of the account; deletion within 30 days of closure. |
| Order, booking, acknowledgement and acceptance of terms and conditions and transactional communications | Art. 6.1.b GDPR | For the duration of the relationship; thereafter 10 years for civil and tax purposes (Articles 2220 and 2946 of the Civil Code). |
| Collection, settlements, refunds and payment disputes | Articles 6.1.b and 6.1.c of the GDPR | 10 years, also pursuant to Art. 2220 of the Italian Civil Code |
| Ordinary documents requested on behalf of the Organiser | Art. 6.1.b GDPR | Up to 12 months from the end of the Tour, unless the item is stored in the Garage or there are any disputes. |
| Medical certificates, on behalf of the Organiser | Article 9.2.a of the GDPR | Deletion within 30 days of the end of the Tour, unless there are ongoing disputes. |
| Garage | Article 6(1)(b) of the GDPR, at the request of the data subject | Until the data is deleted or the account is closed. |
| Notifications regarding the expiry of required documents | Art. 6.1.b GDPR | Until the account or document is deleted. |
| Security, anti-fraud measures, restriction of requests and healthcare access log | Articles 6(1)(f) and 32 of the GDPR | 24 months, unless required for investigation or defence purposes. |
| Legal obligations and requests from authorities | Article 6(1)(c) of the GDPR | For the period provided for by applicable law. |
| Defence in legal proceedings and protection of rights | Art. 6.1.f GDPR | Until the limitation period expires; normally 10 years pursuant to Article 2946 of the Italian Civil Code. |
| Assistance and handling of complaints | Articles 6(1)(b) and 6(1)(f) of the GDPR | 24 months from the closure of the request. |
| Roadbooking newsletter | Article 6(1)(a) of the GDPR | Until consent is withdrawn. |
| Commercial communications regarding services to customers who have already acquired | Article 130(4) of Legislative Decree 196/2003 | Until objection is raised. |
| Anonymous statistics | Outside the scope of the GDPR | No time limit, as the data cannot be traced back to individuals. |
| Disclosure to the Organiser, in accordance with its privacy notice, of the data necessary for the Event | Art. 6.1.b GDPR | For the duration necessary to fulfil the Order and in accordance with the Organiser’s timetable. |
Navigation, security and operation of the Platform
Legal basis: Article 6(1)(f) of the GDPR
Retention: Technical logs: 12 months.
Accounts and access via one-off codes
Legal basis: Article 6(1)(b) of the GDPR
Retention: For the duration of the account; deletion within 30 days of closure.
Order, booking, acknowledgement and acceptance of terms and conditions and transactional communications
Legal basis: Art. 6.1.b GDPR
Retention: For the duration of the relationship; thereafter 10 years for civil and tax purposes (Articles 2220 and 2946 of the Civil Code).
Collection, settlements, refunds and payment disputes
Legal basis: Articles 6.1.b and 6.1.c of the GDPR
Retention: 10 years, also pursuant to Art. 2220 of the Italian Civil Code
Ordinary documents requested on behalf of the Organiser
Legal basis: Art. 6.1.b GDPR
Retention: Up to 12 months from the end of the Tour, unless the item is stored in the Garage or there are any disputes.
Medical certificates, on behalf of the Organiser
Legal basis: Article 9.2.a of the GDPR
Retention: Deletion within 30 days of the end of the Tour, unless there are ongoing disputes.
Garage
Legal basis: Article 6(1)(b) of the GDPR, at the request of the data subject
Retention: Until the data is deleted or the account is closed.
Notifications regarding the expiry of required documents
Legal basis: Art. 6.1.b GDPR
Retention: Until the account or document is deleted.
Security, anti-fraud measures, restriction of requests and healthcare access log
Legal basis: Articles 6(1)(f) and 32 of the GDPR
Retention: 24 months, unless required for investigation or defence purposes.
Legal obligations and requests from authorities
Legal basis: Article 6(1)(c) of the GDPR
Retention: For the period provided for by applicable law.
Defence in legal proceedings and protection of rights
Legal basis: Art. 6.1.f GDPR
Retention: Until the limitation period expires; normally 10 years pursuant to Article 2946 of the Italian Civil Code.
Assistance and handling of complaints
Legal basis: Articles 6(1)(b) and 6(1)(f) of the GDPR
Retention: 24 months from the closure of the request.
Roadbooking newsletter
Legal basis: Article 6(1)(a) of the GDPR
Retention: Until consent is withdrawn.
Commercial communications regarding services to customers who have already acquired
Legal basis: Article 130(4) of Legislative Decree 196/2003
Retention: Until objection is raised.
Anonymous statistics
Legal basis: Outside the scope of the GDPR
Retention: No time limit, as the data cannot be traced back to individuals.
Disclosure to the Organiser, in accordance with its privacy notice, of the data necessary for the Event
Legal basis: Art. 6.1.b GDPR
Retention: For the duration necessary to fulfil the Order and in accordance with the Organiser’s timetable.
For the purposes of managing the Order, providing evidence of the conclusion of the contract, preventing fraud and safeguarding rights, Roadbooking records the version, date and time of the user’s acknowledgement and acceptance of the Organiser’s rules and conditions, as well as the Roadbooking Terms and Conditions. The legal basis is Article 6(1)(b) of the GDPR, insofar as necessary for the performance of the contract and the management of the Order, and Article 6(1)(f) of the GDPR for the prevention of fraud and the protection of rights. This data is retained in accordance with the timeframes applicable to Orders, namely for the duration of the relationship and then for a further 10 years to meet civil and tax requirements, unless different timeframes are required by law or necessary for the purposes of a dispute. The recording of this information does not make Roadbooking a party to the contract relating to the Event/Tour, which remains concluded between the Participant and the Organiser.
6. Health data and medical certificates
Medical certificates constitute health-related data and fall within the special categories of personal data referred to in Article 9 of the GDPR. They are requested only when the Organiser specifies them as a requirement for admission to the Tour. The Organiser is the independent data controller; Roadbooking acts as a data processor pursuant to Article 28 of the GDPR exclusively for activities carried out in accordance with the Organiser’s documented instructions and the applicable agreement.
The explicit consent required under Article 9(2)(a) of the GDPR is requested and collected separately at the time the certificate is uploaded only when it constitutes the appropriate legal basis for the specific processing; it is not requested during the checkout process nor alongside other consents. Consent may be withdrawn at any time, but does not replace any other conditions of lawfulness required by the applicable legislation. Without a valid certificate or without the necessary consent, where required, the Organiser may refuse to admit the Participant to the Tour.
Data processing is carried out in accordance with the safeguards adopted by the Data Protection Authority pursuant to Article 2-septies of Legislative Decree 196/2003. Health data is not disclosed, as provided for in Article 2-septies, paragraph 8, of the same decree.
Certificates are stored in a private archive. Access is granted exclusively to the Participant, the Organiser of the Order and authorised Roadbooking administrators, via a signed link valid for 5 minutes. Every access is logged. The certificates are excluded from bulk exports and are never used for marketing, profiling, statistics or the training of artificial intelligence systems.
7. Photographs and filming
Photographs and video footage may be taken by the Organiser or authorised persons only on the basis of optional consent or a release form provided in accordance with the procedures communicated by the Organiser. Refusal does not prevent participation in the Tour, unless the Organiser clearly states otherwise for a specific Event.
8. Provision of data
Mandatory data is required to create and manage the Order, reserve a place, process payment and provide service information. Failure to provide such data will prevent, in whole or in part, the purchase or enjoyment of the Tour. Optional data may be omitted without consequence, except for the Required Documents which the Organiser specifies as a condition of admission. Marketing communications require consent, where applicable, and are always optional.
9. Automated decision-making and profiling
Roadbooking does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the Participant, in accordance with Article 22 of the GDPR. The approval or rejection of the Required Documents is always carried out by a member of the Organiser’s staff, who may provide a reason.
Automated checks on availability, prices, deadlines and data completeness apply objective rules. Anti-fraud checks on payments are carried out by Stripe. Roadbooking does not carry out advertising profiling.
10. Recipients of the data
| Recipient | Role |
|---|---|
| Event Organiser | Receives the data necessary for registration, admission and management of the event, in accordance with their privacy role. |
| Stripe | Payments, activation of organisers’ accounts, identity verification and anti-money laundering checks, refunds. It also acts as an independent data controller in relation to its own obligations. |
| Vercel; Supabase | Hosting and infrastructure. Supabase manages databases, authentication, files and backups; the data is stored in the EU, in Frankfurt, depending on the configuration applied. |
| Resend; Upstash; Sentry | Email delivery; request throttling; error and security monitoring. |
| Machine translation provider | Catalogue texts only. Does not receive Participants’ data. |
| Software development and maintenance provider | Technical support, in accordance with authorisations, instructions and confidentiality obligations. |
| Advisers, authorities and purchasers in corporate transactions | Advice and protection of rights; fulfilment of obligations; extraordinary transactions, with the safeguards provided for by law. |
Event Organiser
Role: Receives the data necessary for registration, admission and management of the event, in accordance with their privacy role.
Stripe
Role: Payments, activation of organisers’ accounts, identity verification and anti-money laundering checks, refunds. It also acts as an independent data controller in relation to its own obligations.
Vercel; Supabase
Role: Hosting and infrastructure. Supabase manages databases, authentication, files and backups; the data is stored in the EU, in Frankfurt, depending on the configuration applied.
Resend; Upstash; Sentry
Role: Email delivery; request throttling; error and security monitoring.
Machine translation provider
Role: Catalogue texts only. Does not receive Participants’ data.
Software development and maintenance provider
Role: Technical support, in accordance with authorisations, instructions and confidentiality obligations.
Advisers, authorities and purchasers in corporate transactions
Role: Advice and protection of rights; fulfilment of obligations; extraordinary transactions, with the safeguards provided for by law.
Roadbooking does not sell personal data. The Organiser receives personal data only to the extent necessary for registration, admission and the organisation, execution and management of the Event/Tour, in accordance with its role as an independent data controller and its privacy notice made available on the Event page and/or at checkout. The up-to-date list of suppliers is published on the Platform. Suppliers who process data on behalf of Roadbooking are appointed as data processors pursuant to Article 28 of the GDPR, where applicable.
11. Transfers outside the European Economic Area
Data is stored within the European Union, including the database and backup infrastructure located in Frankfurt, in accordance with the service configuration. If a supplier or one of its sub-processors accesses data from a country outside the European Economic Area, Roadbooking applies the safeguards set out in Chapter V of the GDPR: an adequacy decision, including the EU–US Data Privacy Framework for certified suppliers, or the standard contractual clauses set out in EU Decision 2021/914, together with any supplementary measures. A copy of the safeguards may be requested from the data controller’s contact details.
12. Security of processing
Roadbooking implements technical and organisational measures appropriate to the risk, including role-based data segregation at database level, private storage, temporary links, passwordless authentication, logging of access to health records, backups with recovery procedures, and deletion procedures. In the event of a personal data breach, Roadbooking assesses the obligation to notify the Data Protection Authority within 72 hours in accordance with Article 33 of the GDPR and notifies the data subjects of the breach where it poses a high risk, in accordance with Article 34 of the GDPR.
13. Rights of data subjects
You may exercise, free of charge, the rights set out in Articles 15–22 of the GDPR and withdraw your consent in accordance with Article 7(3) of the GDPR. Requests must be sent to the contact details provided in section 1; Roadbooking may request reasonable information to verify your identity.
| Right | What it involves |
|---|---|
| Access and copy | To find out whether we process your data and to receive a copy of it. |
| Rectification and completion | To correct inaccurate data or complete any incomplete data. |
| Erasure and restriction | Request the erasure or restriction of processing in the circumstances provided for. |
| Portability | Receive the data provided in a structured, commonly used and machine-readable format, where applicable. |
| Objection | Object to processing based on legitimate interests and, in any event, to direct marketing. |
| Withdrawal of consent | To withdraw consent at any time, without affecting the lawfulness of processing carried out prior to such withdrawal. |
Access and copy
What it involves: To find out whether we process your data and to receive a copy of it.
Rectification and completion
What it involves: To correct inaccurate data or complete any incomplete data.
Erasure and restriction
What it involves: Request the erasure or restriction of processing in the circumstances provided for.
Portability
What it involves: Receive the data provided in a structured, commonly used and machine-readable format, where applicable.
Objection
What it involves: Object to processing based on legitimate interests and, in any event, to direct marketing.
Withdrawal of consent
What it involves: To withdraw consent at any time, without affecting the lawfulness of processing carried out prior to such withdrawal.
We will respond within one month of receiving your request. This period may be extended by a further two months in cases of particular complexity, in which case we will inform you within the first month (Article 12(3) of the GDPR). Requests relating to processing for which the Organiser is the independent data controller must first be addressed to the Organiser, using the contact details and following the procedures set out in the privacy notice published for the Event/Tour. Roadbooking may assist with forwarding the request where technically possible, but does not decide on such requests, unless they relate to processing for which Roadbooking is the independent data controller. Requests relating to processing for which Roadbooking is the data controller must be sent to the contact details set out in section 1.
14. Complaints and appeals
If you believe that the processing infringes the law, you may lodge a complaint with the Italian Data Protection Authority, Piazza Venezia 11, 00187 Rome, or with the supervisory authority of the European Union Member State in which you reside or work. This is without prejudice to your right to bring legal proceedings in the cases provided for in Articles 78 and 79 of the GDPR.
15. Minors
The Platform is reserved for adults, and Tours may only be purchased by persons aged 18 or over. If Roadbooking is informed that data relating to a child has been collected in breach of this rule, it will delete such data without delay, subject to any legal obligations or the need to protect rights.
16. Cookies
To find out about the cookies and similar tools used by roadbooking.com, please consult the Cookie Policy. Technical cookies necessary for the Platform to function may be used without consent in accordance with Article 122 of Legislative Decree 196/2003. Non-anonymised analytical cookies, profiling tools and advertising pixels are only activated once consent has been obtained via a banner that complies with the Data Protection Authority’s Guidelines of 10 June 2021. Consent may be withdrawn at any time via the link available in the footer of the Platform.
17. Artificial intelligence
Roadbooking may use artificial intelligence tools solely to generate draft translations of catalogue texts. The texts are published following human review. Roadbooking does not use personal data to train third-party models nor does it include such data in demos. It does not use artificial intelligence systems to make decisions regarding Participants or to carry out profiling. Any new features will be introduced following an update to this privacy notice and in compliance with Regulation (EU) 2024/1689.
18. Changes to the privacy policy
The current version is published on the Platform with the date of the last update. Substantial changes are communicated to registered users by appropriate means. The version of the privacy notice viewed during checkout is recorded alongside the Order.
19. Language versions
This Privacy Policy is drafted in Italian and may be made available in English, French, German and Spanish to facilitate consultation. The translated versions are provided for information and accessibility purposes. In the event of any discrepancy, ambiguity or difference in interpretation between a translated version and the Italian version, the Italian version shall prevail, without prejudice to Roadbooking’s obligation to ensure that information on data processing is clear, transparent, intelligible and easily accessible to the public for whom it is intended, and without prejudice to the non-derogable rights granted to data subjects under applicable legislation.