At a glance
- We collect your email address and the technical logs the app needs to work.
- We do not process special categories of data: race, religion, biometric data.
- The payment processor sends us the confirmation of a transaction, not card details.
- We use data to run the lapTime transponder, sync your times and manage subscriptions.
- We share data only with the providers we need: Cloudflare for security and delivery, Stripe for payments, GAMA TRADE snc for transponder licensing.
- You can ask for access, rectification, erasure and portability, and withdraw consent at any time.
- Write to digitalcontrolsrl@gmail.com.
Introduction
This policy covers the lapTime app and the services around it. It explains what data we collect, how we use it and how we protect it, in plain language.
Questions about this policy: digitalcontrolsrl@gmail.com.
What we collect and why
We collect only what the transponder needs to work, under the GDPR.
Data you give us. When you create an account or buy a service:
- Account email: identifies you and your lapTime device (legal basis: contract).
- Payment data: handled by Stripe. We do not store card details on our servers, and our Stripe configuration is set not to keep them (legal basis: contract).
Data collected automatically. While you use the app and the site we record:
- Technical logs and usage data: errors, features used, sync times. They help us find bugs, fix crashes and understand which features racers actually use (legal basis: consent).
How we use it
- Service: we connect the app to your transponder, sync your times and manage your account. This is the contract we have with you.
- Payments: we process transactions through Stripe.
- Communication: we use your email for service messages, such as password resets or changes to the terms.
- Security: we read logs to spot unusual activity, stop unauthorised access and protect our infrastructure.
Your rights
We give every user the same rights, wherever they live (EU, UK, Canada, California and other US states):
- Access: a copy of the data we hold, within 30 days.
- Correction: fix your name, email or other data in the account settings, or ask us.
- Erasure: we delete your data unless the law requires us to keep it (for example tax records for purchases).
- Portability: receive your data in a structured, machine-readable format.
- Withdrawal of consent: at any time, without affecting processing already carried out.
To exercise them, write to digitalcontrolsrl@gmail.com.
Security
We use standard encryption for data in transit and at rest. Access is limited to the employees who need it to do their job.
No system connected to the internet is fully secure. Use a long password that you do not reuse elsewhere.
If a breach exposes personal data, we notify you and the authorities within the time the law sets, typically 72 hours.
How long we keep it
- Active account: profile and sync data for the life of the relationship, plus 30 days after deletion so an accidental one can be undone.
- Financial records: up to 7 years, as the law requires.
- Technical logs: 12 months, then deleted.
Children
The lapTime app is made for adult car racing enthusiasts. We do not knowingly collect data from anyone under 16. If you are a parent or guardian and believe a child gave us data, write to us and we will delete it.
International transfers
Digital Control s.r.l. operates across countries, so data may be processed outside yours. For transfers from the EU or the UK to countries without an adequacy decision we rely on the Standard Contractual Clauses approved by the European Commission.
Changes
When a change matters, we tell you by email or with a notice in the app. The current version always sits on this page.
Categories of data (CCPA/CPRA)
For residents of California and US states with similar laws, these are the categories collected in the past 12 months. We do not process sensitive personal information.
| Category | Source | Purpose | Third parties | Retention |
|---|---|---|---|---|
| Identifiers: name, email, account ID | Provided by you | Account, service, communication | Cloudflare (security) | Account lifetime + 30 days |
| Commercial information: purchase history | Provided by you | Payments, accounting | Stripe (payments) | 7 years, legal requirement |
| Internet activity: device data, technical logs, usage analytics | Collected automatically | Functioning, diagnostics, security | Cloudflare (security and CDN) | 12 months |
Automated decision-making
We run no automated decision-making or profiling that produces legal or similarly significant effects. Decisions about your account involve a person.
Privacy signals
The site honours the Global Privacy Control signal. If your browser or an extension sends it, we recognise it and switch off non-essential tracking where California, Colorado, Connecticut, Montana, Texas and other jurisdictions require it.
Sub-processors
We rely on these providers to run the service:
- Cloudflare: web security and content delivery.
- Stripe: payment processing.
The current list is available on request at digitalcontrolsrl@gmail.com. You can also ask to be notified 30 days before we add or replace a sub-processor, so you have time to object.