PRIVACY POLICY | ULTRABIKING SARDINIA 790
1) Data controller and categories of data processed
Participation in the Event and the provision of services associated with it involves the processing of personal data of participants, such as: personal data and membership data of sports companies/entities; images taken by video and photos; transit times at control points and/or timekeeping; geographical location data for participants who use a device for tracking the geographical location and services associated with it, data and copy of physical fitness certificate.
Data concerning the health of the data subject (i.e. data on pathologies obtainable from medical certificates or declared directly by the data subject) may also be processed, where strictly necessary for the purposes of registration and participation in the Event (for example, for the purposes of registration in a special category of competition reserved for disabled athletes and/or for the purposes of requesting specific assistance) and only with the explicit consent of the data subject. In such cases, the consent of the data subject is necessary for participation in the Event and failure to grant said consent prohibits registration completion.
The data controller is the Organiser Ultrabiking Sardinia Asd.
2) Purpose and conditions of processing
The use of the personal data indicated above is inherent in the sporting and public nature of the Event, in its organisational requirements and in the services offered to participants.
The Organiser uses and processes the data, also through its technical and service partners and related companies, for the following purposes: verification of participation requirements; timekeeping and tracking services; medical assistance services; photo and video services for the media and participants (also for a fee); communications to sports and public authorities; news and documentation of the Event; promotion and commercial exploitation of the Event.
The prerequisites for processing are therefore constituted by:
(i) the provision of services related to the registration of participants in the Event and the smooth running of the same (for example, in the case of managing participant registration, time recording and the publication of results or the provision of photos and videos of the Event to participants)
(ii) data subject consent (for instance, in the case of processing health-related data or data for marketing purposes, as specified below);
(iii) the pursuit of the Organiser and its business partners' legitimate interests (e.g. in the case of publishing images and results to document the Event);
(iv) compliance with legal obligations (e.g. in the case of communication with public authorities);
(v) safeguarding the vital interests of the data subject or of another person (e.g. if medical assistance is required during the Event).
The Organiser draws the attention of all participants to the fact that, during the course of the Event, video and photographic shots of the participants will be taken, both in motion and fixed; based on the above assumptions (in particular, i and iii), the Organiser may use, or allow sponsors and technical or service partners of the Event to use, such images for the following purposes: a) news and documentation of the Event;
b) the marketing of photographic and video services of the Event with the consequent offer, free of charge or for a fee, of the photos and videos, for private use only, to all participants and any subjects authorised by the them. Authorisation to take a picture in the context of the Event is a necessary requirement for participating in the Event, as long as the manner of carrying out the latter, as described in the Regulations, provides for the taking of video-photographic shots of the Event for documentation purposes with the consequent offer to all participants of services to purchase Event photos and videos; therefore, where there is no authorisation to use such images for the above purposes, as required in the Release, it is impossible to register for the Event.
3) Scope of data circulation and dissemination
The Organiser informs the participant that the Event is also organised and managed through the services of technical and commercial partners, as well as with the support of sponsors. The services provided by such partners may include: registration services, tracking services, timekeeping services, photo and video shooting services and any other such services. Some of these services may require or necessitate registration of the data subject on the partner's platform, or in any case processing carried out by the partner as an independent data controller; in such cases, the data subject is invited to carefully read the privacy policy provided by the partner. The data subject can be made aware at any time of the list of partners and sponsors, by writing a request to the Organiser.
In consideration of the public nature and purpose of the Event, participants also acknowledge and accept that data relating to their image, times and results or their position in real time, where appropriate tracking services are active, may be made publicly accessible through dissemination on the websites of the Organiser, sponsors and service partners of the Event, and/or communicated to third parties for reporting purposes, documentation and promotion of the Event itself, for the provision of specific services related to the Event, such as the sale of video-photographic services, in the fulfilment of specific legal or regulatory obligations and for the safeguarding of the vital interests of participants (e.g. communication to competent authorities and rescue personnel for rescue operations and/or the provision of medical care services within the framework of the Event).
4) Consent for the participant's image being used for advertising purposes
With the specific and free consent of the data subject, the Organiser may use footage that includes the subject's image to promote the Event and other events organised by the Organiser. The data subject may revoke this consent at any time by writing to the Organiser.
5) Processing for marketing purposes
If participants use their email address to register for the Event, the Organiser may use this address, without the prior consent of participants, to send them, also through its service partners, commercial communications relating to its products and services related to the Event, or other initiatives and events similar to the Event. The data subject may object at any time to the sending of such communications by writing to the Organiser or by following the specific instructions contained in each communication.
Without prejudice to the above, with the specific and free consent of the data subject, revocable at any time, the Organiser may, directly or by using its service partners:
a) use the participants' contact data (email, address and telephone number) for purposes of commercial information, market research, surveys, direct offers of its own products and services and/or the products and services of their service and commercial partners, through traditional means (i.e. paper post, telephone calls through an operator, etc.) and automated communication tools (i.e. pre-registered telephone calls, email, fax, text messages, mms, apps, etc.);
b) to transfer to certain categories of third parties (in particular, Event sponsors and other companies that provide products and services related to the organisation of the Event and, more generally, to the world of sport) the participants' contact details (email, address and telephone number) for the purposes of commercial information, market research, surveys, direct offers of its products and services, carried out via traditional methods (i.e. paper post, telephone calls through the operator, etc.) and automated communication tools (i.e. pre-recorded telephone calls, emails, faxes, text messages, MMS, apps, etc.) These third parties will act from time to time as independent data controllers, with the consequent burden of providing the data subject with their own privacy policy within the terms of the law.
6) Data storage and data processing officers
Data subjects' data will be stored in the Organiser's computer archives and protected by appropriate security measures in line with the provisions of Article 32 of EU Regulation 2016/679. The data will be kept for the time necessary in relation to the purposes for which it was collected and possibly for a further period of time if the storage of data is necessary for the protection of an Organiser or third party's right (for instance, data related to the registration to the Event will be kept for ten years, also in view of possible data subject complaints in the ordinary ten-year period of limitation; data relating to the results of the Event will be kept as long as there is a current interest in the documentation of the Event itself; contact data for sending commercial communications will be kept as long as data subjects do not exercise their right of opposition or revoke the consent previously granted; data relating to the image of the participants will be kept for as long as the Organiser can legitimately dispose of the filming of the Event).
For storage purposes and, more generally, processing, the Organiser may use third parties under its own responsibility; these subjects, if the legal requirements are met, will be appointed by the Organiser as its own data processing officers pursuant to Article 28 of EU Regulation 679/2016. In order to find out the complete list of the data processing officers appointed from time to time by the Organiser, the data subject may send a request through the contact details indicated in Article 9 below).
7) Data transfer outside the EU
In the case of international data transfers from the European Economic Area (EEA), where the European Commission has recognised that a country outside the EEA is able to guarantee an adequate level of data protection, the data of the data subject may be transferred on that basis.
For transfers to countries outside the EEA whose level of protection has not been recognised by the European Commission, the Organiser will either rely on an exemption applicable to the specific situation, or implement one of the following measures to ensure the protection of its data:
• standard contract terms approved by the European Commission; or
• binding company rules, where applicable.
To obtain a copy of these measures or details on where they are available, you can send a written request as indicated in the next Article.
8) Minors
The registration of minors in the Events is permitted only by those exercising parental or legal authority over the child or who have obtained the necessary prior authorisation from the latter.
By registering a minor, parental or legal guardians - or any other person expressly authorised for this purpose by the latter - in the name and on behalf of the minor, the photographic and video recordings of the minor within the scope of the Event must be authorised, for the purposes described in this Policy and in the Release and must give, where necessary, consent to the processing of the minor's data relating to health.
Exercisers of parental or legal responsibility over a child may exercise the rights specified in Article 9 below with regard to the child's personal data. The Organiser does not process the data of minors for marketing purposes or for the direct offer of products and services; the Organiser may still process data of the person exercising parental or legal authority for marketing purposes, or make a direct offer of products and services under the conditions indicated in Article 5 above.
9) Rights of data subjects
At any time, participants may exercise their rights regarding the processing of personal data in accordance with Articles 15-22 of the GDPR 2016/679. These rights include:
a. Access: data subjects may obtain information in relation to the processing of their data and a copy of such data.
b. Rectification: where data subjects consider their data to be inaccurate or incomplete, they may request that such data be amended accordingly.
c. Cancellation: data subjects may request cancellation of the data if they revoke their previous consent and there is no other legal basis for the processing, or in other cases provided for by law.
d. Limitation: in cases provided for by law (e.g. if they dispute the lawfulness of the processing or the accuracy of the data), data subjects may obtain a limitation on data processing without the data being erased.
e. Opposition: data subjects may object to the processing of data if the processing is based on a legitimate interest of the Organiser for reasons related to their particular situation, unless there are compelling reasons why the interests of the Organiser outweigh their rights (this is the case, for example, where the processing is necessary to defend a right of the Organiser in court).
f. Revocation of consent: data subjects may revoke consent previously given for the purposes of processing.
Data subjects may, at any time, object to the processing of their data for marketing purposes and revoke the consent previously given for this purpose, also by following the procedure and instructions contained in the text of each commercial communication.
Participants are aware that their opposition (see previous point e) or revocation of consent (see previous point 4) or authorisation (see Release) to the use of images portraying them will be effective to the extent that it will be possible to block the publication of such images via reasonable means and costs. Opposition, as well as revocation, will not, however, diminish the lawfulness of the uses that have occurred in the meantime.
The rights in question may be exercised by sending a written notice to the Organiser at the following address
info@ultrabikingsardinia.com
In accordance with current legislation, in addition to the above rights, data subjects may also submit a complaint to the Supervisory Authority for the protection of personal data, Piazza di Monte Citorio 121 - 00186, Rome, Fax: (+39) 06.69677.3785, protocollo@pec.gpdp.it