Privacy policy

PRIVACY POLICY – ENGLISH
1) Controller and categories of processed data
Participation in the Event and the provision of the services linked with it entail the processing of personal
data such as: personal data and those of the participant’s involvement with sports companies/events;
pictures and videos containing the participant’s likeness; times of transit at control points and/or timing;
geolocation data of the participants who employ a geolocation device and the services linked with it.
The participant’s health data may be processed (such as those concerning pathologies disclosed by the
participant and included in medical reports) if strictly necessary for entering and participating in the Event
(such as entering a special competition category for special needs athletes and/or requesting special
assistance) and only with the explicit consent of the data subject. In these cases, the consent of the data
subject is required to participate in the Event and the failure to grant it shall prevent the participant to
complete the registration.
The Organizer acts as the controller.
2) Aims and purposes of the data processing
The use of the aforementioned personal data isinherent in the nature of the sports Event, in its organizational
needs, and in the offer of services to the participants.
The Organizer uses and processes the data, also through his/her technical and service partners and the
companies linked to them, for: checking participation requirements; timing and tracking; medical assistance;
photography and videos (paid too) for media and participants; communications with sport and public
authorities; documenting the Event; the Event’s promotion and commercial operations.
Therefore the purposes of the data processing are:
(i) providing services linked with the participants’ registration to the Event and the smooth conduct of
the Event (e.g. management of the registrations, the timing of recognizing and publication of the
results, i.e. making available to the participants the photos and videos of the Event);
(ii) consent of the subject (e.g. processing health data for marketing purposes as specified in the
following);
(iii) the legitimate interest of the Organizer and his/her commercial partners (e.g. publishing images and
results to document the Event);
(iv) complying with legal obligations (e.g., in the case of communications with public authorities);
(v) safeguarding the interests of the participant or of another person (e.g. when medical assistance is
required during the Event).
The Organizer would like to call the participants’ attention to the fact that photographs and videos of the
participants, either in movement or still, will be taken during the Event; according to the purposes stated
above (in particular, i and iii) the Organizer shall be at liberty to use them, i.e. allow the sponsors and service
and technical partners of the Event to use such images for a) documenting the Event; b) selling videos and
photo shoots of the Event with the aim of offering free or paid photos and videos, exclusively for private use,
to all the participants and the persons authorized by them. The authorization of filming one’s likeness during
the Event is a necessary prerequisite to participate in the Event since the rules of the Event include video and
photo reporting of the competition for documentation and to offer all the participants the chance to buy
photos and videos of it. Therefore any failure to authorize the use of one’s likeness for such purposes, and
the Waiver, determine the exclusion from the Event.
3) Data traffic and dissemination
The Organizer informs the participant that the Event is organized and managed also by technical and
commercial partners and with the support of the sponsors. The services provided by such partners may
include registration, tracking, timing, live-action photography and video, and other services. Some of these
may require that the participant registers on the partner’s platform or processing by the partner as an
autonomous controller. In such cases, the participant is invited to read the partner’s privacy policy. The
participant can email the Organizer at any time to request the list of the partners and sponsors.
For participants registered on ENDU (i.e. physical persons registered on ENDU, the platform managed by
Engagigo S.r.l.) who, in order to integrate their profiles, required Engagigo to obtain from the organizers acting
through ENDU the data treated by said organizers (in particular, data on the event registrations, as well as
copies of the certificate of fitness for competitive sports and memberships), the Organizer will automatically
transmit this data to Engagigo. The participant can read Engagigo’s privacy policy on Engagigo’s website
(endu.net) and exercise his/her rights towards this company.
Given the public nature and purposes of the Event, the participants acknowledge and accept that the data
concerning their likeness, timing and results, i.e. their position in real time wherever tracking services are
active, can be made publicly accessible on the Organizer’s, sponsors’ and partners’ websites and/or
transmitted to third parties for the purposes of reporting, documentation, promotion of the Event, of
providing specific services linked to the Event,such asthe sale of videos and photo shoots, for complying with
legal or regulatory obligations and for safeguarding the vital interests of the participants (such as
communicating with the competent authorities and staff during rescue operations and/or providing medical
assistance during the Event).
3) Authorization for publicity usage of the participant’s likeness
The participant’s authorization gives permission to theOrganizer to use the shootings and imagesthat include
his/her likeness to promote the Event and other events organized by the Organizer. The participant can
withdraw his/her consent at any time by writing to the Organizer.
4) Treatment for marketing purposes
If the participant uses his/her email addressto register for the Event the Organizer may use such address even
via his/her service partners, without obtaining a previous consent by the participant, to send him/her
commercial emails on his/her products and services linked with the Event or any other such events and
initiatives. The participant may unsubscribe from this service at any time following the instructions included
in every email.
Notwithstanding the above and with the free and specific authorization of the participant that can be
withdrawn at any time, the Organizer, via his/her service partners, may:
a) use the participant’s personal data (email, address, and phone number) for commercial purposes,
market research, surveys, offers of products and services of his/her commercial and service partners by
traditional forms of communication (i.e. snail mail, phone calls, etc…) and automated forms of
communication (i.e. prerecorded calls, e-mail, fax, SMS, MMS, apps, etc…);
b) transmit to some categories of third parties (in particular, the Event’s sponsors and other companies
providing the Organizer with products and services for the Event and more generally sports activities) the
participants’ personal data (email, address and phone number) for purposes of commercial communication,
market research, surveys, offers of products and services made via traditional means of communication (i.e.
snail mail, phone calls, etc…) and automated means of communication (i.e. prerecorded calls, e-mail, fax,
SMS, MMS, apps, etc…). Such parties will act as independent controllers and will be required to communicate
their privacy policy to the participant.
5) Data retention and controllers
The participants’ data will be retained in the digital archives of the Organizer and subjected to the protection
measuresset out in art. 32 of EU Regulations 2016/679. The information shall be retained forthe time needed
by the purposesfor which it was gathered and possibly for a longer time if data retention is deemed necessary
to protect the rights of the Organizer or third parties (i.e. the data linked to the Event registration will be
retained for ten years, also in light of potential complaints by the participant within the regular ten-year time
of prescription). The data relating to the results of the Event will be retained as long as there is an interest in
documenting the same Event. The personal data used to send commercial emails will be retained as long as
the participant exercises his/her right to withdraw the consent accorded previously. The image data of the
participants shall be retained for as long as the Organizer may legitimately dispose of the Event’s footage.
For the purposes of data retention and treatment, the Organizer may use third parties under his/her
responsibility. The Organizer will name such parties as Controllers pursuant to art. 28 of EU Regulation
679/2016. The data subject can at any time request the list of the Controllers named by the Organizer at the
address provided in art. 9.
6) Data transfer outside the EU
In the case of data transfer outside of the European Economic Area (EEA), the participant’s data may be
transferred following a vetting by the European Commission which will ascertain that the non-EEA country is
able to guarantee adequate data protection.
In the case of transfers to non-EEA countries whose level of data protection has not been acknowledged by
the European Commission, the Organizer shall use a Waiver applicable to the specific situation, i.e. he/she
will implement one of the following measures to guarantee data protection:
• standard contract terms approved by the European Commission; or
• binding corporate rules, if applicable.
The data subject may submit a written request as per the instructions contained in the following to obtain a
copy of one of these details and measures, if available.
7) Minors
The registration of minors to the Events is allowed only if submitted by the minor’s parent or legal guardian.
Upon registering the minor the parent or legal guardian must, on behalf of the minor, authorize filming and
live-action photography at the Event for the purposes described in this Policy and the Waiver and authorize,
if necessary, the treatment of the minor’s health data.
The parent or legal guardian can exercise the rights mentioned in art. 9 relating to the minor’s personal data.
The Organizer shall not treat the minor’s data for marketing or commercial purposes; the Organizer may treat
the data of the parent or legal guardian for marketing or commercial purposes as indicated in art. 5.
8) Rights of the participant
The data subject can at any time exercise his/her data protection rights pursuant to articles 15-22 of the GDPR
2016/679. These rights include:
a. Access: the data subject can obtain information relating to the treatment of his/her data and
a copy of such data.
b. Rectification: the data subject can request rectification of his/her data when such data is
inaccurate or incomplete.
c. Erasure: the data subject can request the erasure of his/her data by withdrawing his/her
consent and if there is no other legal ground for the processing.
d. Restriction of processing: the data subject can obtain the restriction of processing in the cases
provided by the law (e.i. If he/she contests the accuracy or treatment of the personal data).
e. Objection: the data subject can object to the processing of data if the processing based on
the Organizer’s legitimate interest for purposes relating to his/her specific situation, unless
mandatory reasons exist that override the interest of the data subject (i.e. when the data
processing is needed to defend a right of the Organizer in a court of law).
f. Withdrawal of consent: the data subject can withdraw the consent previously given for the
purposes of data processing.
The data subject may, at any time, object to the processing of his/her data for marketing purposes and revoke
the consent previously given by following the instructions included in each commercial email.
The participant acknowledges that his/her objection (see abovementioned article), withdrawal of consent
(see art. 4) or consent (see Waiver) to using images of his likeness shall have effect as far as possible to stop
the publication of such images within reasonable costs and means. The objection and withdrawal shall not
affect the lawfulness of the usage that has been made of it in the intervening time.
The rights in question may be exercised via written communication to the Organizer.
Pursuant to existing law the data subject may also submit a complaint to the Data Protection Authority
(Garante per la Protezione dei dati personali), Piazza di Monte Citorio n. 121 – 00186, Rome, Fax: (+39)
06.69677.3785, protocollo@pec.gpdp.it