Privacy and Cookie Policy
This notice describes how Daniele Di Gregorio, provider of the GoCicero service, processes the personal data of those who use the app and the website www.gocicero.it, in compliance with EU Regulation 2016/679 (GDPR) and Italian data protection law.
1. Data controller
The controller of personal data is Daniele Di Gregorio, VAT no. 13131880018, with registered office at Via Villarbasse 12, 10138 Turin (TO), Italy, operating under the trade name GoCicero.
For any request regarding the processing of your personal data you can write to [email protected] (certified email / PEC: [email protected]).
No Data Protection Officer (DPO) has been appointed, as this is not mandatory given the nature and scale of the activity currently carried out (art. 37 GDPR). The privacy contact point remains the controller.
2. What data we collect and why
| Data category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Identification and contact data | First name, last name, email, phone number, date of birth or age range | Account creation, quote and booking management, communications about the Mission, age requirement checks | Performance of the contract (art. 6.1.b GDPR) |
| Billing data | Company name, VAT number, certified email (PEC), recipient code, registered office/residence | Invoicing, tax compliance | Legal obligation (art. 6.1.c GDPR) |
| Authentication credentials | Email/password account, Google ID, Apple ID (via Firebase Auth) | Login and account management | Performance of the contract |
| Geolocation data | GPS position of the Team Leader's device, including in the background | Group coordination, participant safety and running the challenges, only during the Mission. The Team Leader's position is visible to the participants in their group and to the other Team Leaders at the same event. Other participants' positions are not collected | Performance of the contract, with the permission requested by the operating system |
| User-uploaded content | Photos, videos and text uploaded during challenges, when the feature is available | Running the challenges and operating the Mission | Performance of the contract |
| Uploaded content used for promotion | Photos and videos published on GoCicero's channels | Promoting GoCicero (e.g. on social media) | Specific consent (art. 6.1.a GDPR), revocable at any time |
| Reports, complaints and requests | Content of reports of items not provided, rescheduling or refund requests, complaints | Handling requests, refunds and disputes | Performance of the contract and legitimate interest in protecting our rights (art. 6.1.f GDPR) |
| Usage and analytics data | App interactions, Firebase Analytics events | Service improvement, usage statistics | Consent (collected via banner) |
| Diagnostic data | App crash reports, device model, operating system and app version, technical installation identifier (Firebase Crashlytics) | Identifying and fixing errors and malfunctions | Legitimate interest in the proper functioning of the app (art. 6.1.f GDPR) |
| Payment data | - | Not processed by GoCicero: the transaction is handled entirely by Stripe, which acts as an independent controller for card and transaction data. GoCicero does not store or have access to full payment card details. | - |
| Push notification tokens | Device identifier (Firebase Cloud Messaging) | Sending notifications related to the Mission | Performance of the contract |
3. How we collect data
Data is collected directly from the data subject during registration, quote requests and app use, or automatically generated by the device (location, technical identifiers) with the permission requested by the operating system (iOS/Android). For Users under 14, some data is provided or confirmed by whoever holds parental responsibility (see section 8).
4. Who we share your data with
Your data may be shared with the following parties, who process it as independent controllers or as processors under art. 28 GDPR:
- Partner Venues, as independent controllers: only the data needed to provide the Consumptions and Services included in the Mission (Redemption Code, Team Leader name, number of participants) and, if the User requests an invoice for the Consumptions, the billing details needed to issue it. Venues may not use it for their own marketing purposes;
- other participants at the same event: the Team Leader's position during the Mission, as described in section 2, and any content shared during the challenges;
- Stripe (Stripe Payments Europe, Ltd. and affiliates): payment processing via Stripe Connect;
- Firebase / Google (Google Ireland Ltd. and US affiliates): authentication (Firebase Auth), push notifications (FCM), usage analytics (Firebase Analytics), diagnostics (Crashlytics);
- Carto: map services within the app;
- Apple (Apple Distribution International Ltd.): the Apple Maps map on the website's partner venues page, which loads when the page is viewed and receives from the browser the technical data needed to display it (e.g. IP address);
- OVH: hosting of the application backend and storage of User-uploaded content (server located in France);
- the controller's tax/administrative advisors, for legal compliance;
- public authorities, where required by law.
Content for which you have given consent to promotional use may be published on GoCicero's channels (website, app, social networks) and is therefore publicly visible.
Data Processing Agreements (DPA) with the listed providers have been signed/activated.
5. Data transfers outside the European Union
Data collected by the GoCicero backend, including User-uploaded content, is stored on a server located in France (European Union). Some third-party providers (in particular Firebase/Google and Stripe) may also process data in the United States or other non-EU countries. In such cases the transfer relies on the safeguards provided by arts. 44 et seq. GDPR, such as the Standard Contractual Clauses approved by the European Commission and/or the provider's adherence to the EU-US Data Privacy Framework, as stated in each provider's privacy notice.
6. How long we keep your data
- Account data: kept for the duration of the relationship and deleted within 30 days of the account deletion request.
- Billing data and tax documents: kept for at least 10 years from the date of issue, as required by Italian tax and civil law (art. 2220 of the Civil Code), regardless of account deletion. Each period applies to its own data category.
- Geolocation data: not retained or used after the end of the Mission it relates to.
- Uploaded content: kept until deleted by the User or until the account is deleted. Content used for promotion is removed from GoCicero's channels within 30 days of consent being withdrawn, without affecting what was already published.
- Reports and complaints: kept for as long as needed to handle them and, in case of a dispute, until it is resolved.
- Analytics data: retained according to the default periods of the Firebase Analytics platform, unless deleted earlier upon request.
- Diagnostic data: retained according to the default periods of Firebase Crashlytics.
7. Your rights
As a data subject, you have the right to: access your data; obtain its rectification or erasure; restrict its processing; object to processing; request its portability; withdraw a given consent at any time (for example for usage analytics or for the promotional use of your content), without affecting the lawfulness of processing carried out before the withdrawal. For Users under 14, these rights are exercised by whoever holds parental responsibility. You can exercise these rights by writing to [email protected]. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
8. Minors
Purchasing Missions and acting as Team Leader are reserved for adults. As a result, GPS position, collected only for Team Leaders, is never collected for minors.
Users aged 14 to 18 may register on their own to take part in Missions, pursuant to art. 2-quinquies of Legislative Decree 196/2003.
Users under 14 may register only with the consent of whoever holds parental responsibility over them, collected through the procedure shown in the app before the account is activated. Usage analytics (Firebase Analytics) is not activated for these accounts.
Content depicting minors is used for promotion only with the consent of whoever holds parental responsibility.
If we become aware that an account for a child under 14 was created without the required consent, we deactivate it and delete the related data.
9. Data security
We adopt appropriate technical and organisational measures to protect personal data from unauthorised access, loss or disclosure, including encrypted transmission of communications between the app and the backend and entrusting payment data to a PCI-DSS certified provider (Stripe).
10. Cookies and similar technologies
10.1 Website (www.gocicero.it)
The website uses technical cookies, necessary for the site to function, and analytics cookies (Google Analytics), installed only with the user's prior express consent via a cookie banner, revocable at any time from the site settings.
10.2 Mobile app
The app uses technical identifiers and tracking tools equivalent to cookies (in particular Firebase Analytics) for statistical purposes. These tools are activated only with the User's prior express consent via an in-app banner on first launch: if consent is denied, analytics tracking is not activated. Consent can be changed at any time from the app settings. For accounts of Users under 14, analytics tracking is not activated (see section 8).
No advertising profiling or third-party marketing cookies or trackers are used.
11. Changes to this Policy
This Privacy and Cookie Policy may be updated periodically. Material changes will be communicated to registered Users via the app or email before they take effect.
12. Contact
Daniele Di Gregorio - GoCicero
Via Villarbasse 12, 10138 Turin (TO), Italy
VAT no. 13131880018
Email: [email protected]
PEC (certified email): [email protected]
Last updated: 30 September 2026