Privacy Policy
WHO IS THE DATA CONTROLLER?
In accordance with current regulations, the data subject is informed that the data provided will be processed jointly by DONOSTI EVENTOS, S.L., with NIF: B20685152 and by RPM RACING, S.L., with NIF: B61514360, which constitute the JOINT VENTURE (UTE) DONOSTI EVENTOS, S.L.- RPM RACING, S.L.U., as joint controllers (hereinafter the “Joint Controllers” or the “UTE”).
Data protection contact information:
• Registered office: Camino de Portuetxe, number 2, 20018, Donostia-San Sebastián.
• Email: info@zurichmaratonsansebastian.com
• Data Protection Officer email: dpo@rpmsports.es
FOR WHAT PURPOSE WILL YOUR PERSONAL DATA BE PROCESSED AND FOR HOW LONG?
When users provide personal data through the registration forms for the events/activities managed by the Joint Controllers, through the accessible forms, their personal data will be processed for the following purposes:
I. When users provide personal data through the contact form, the purpose is to handle the users’ requests. For this purpose, their personal data will be kept for as long as their enquiry is being handled, and even afterwards, until any liabilities arising from it have become time-barred.
II. When personal data is provided through the subscription to the Website’s commercial newsletter, the purpose is the subscription to the commercial newsletter in order to keep the user informed about the latest news and events organised by the Joint Controllers. Their data will be kept until the user withdraws their consent in both cases.
III. When users provide personal data through the registration forms for events/activities organised by the UTE, the purpose is to manage and process the user’s participation. For this purpose, their data will be kept for the duration of the event/activity for which they register and, once it has ended, for the limitation period of any legal actions that may arise from it.
IV. If you authorise it, your data will be used to provide you with personalised information about projects, services, campaigns and events in which RPM RACING S.L.U. participates or which it organises, in accordance with its privacy policy, for an indefinite period, and you may revoke your consent at any time by writing to dpo@rpmsports.es, as well as in every email you receive under the “unsubscribe” section.
V. Likewise, your data will be used to provide you with personalised information about projects, services, campaigns and events in which DONOSTI EVENTOS S.L. participates or which it organises, for an indefinite period, and you may revoke your consent at any time by writing to dpo@rpmsports.es as well as in every email you receive under the “unsubscribe” section.
VI. To manage participation in prize draws and promotions organised by RPM RACING, S.L.U. the Joint Controllers. , the legal basis for the processing being the pre-contractual and contractual relationship, in the event of winning. For this purpose, their data will be kept for the duration of the promotion and, once it has ended, for the limitation period of any legal actions that may arise from it.
VII. We also process the photograph/image for the dissemination of group images celebrating the sporting event for informational, publicity, commercial and advertising purposes. Your image and/or video, with or without sound, will be kept for as long as consent is not revoked, for a maximum period of 20 years.
VIII. When so required by the event’s Participation Regulations and as long as you do not exercise your right to erasure, we will process your data (your first name, surnames, year of birth and sex) in order to display your position in the ranking of participants in the event according to its categories.
Unless you revoke your consent, the data retention periods indicated above will apply, so it is your responsibility to keep them up to date.
WHAT IS THE LEGAL BASIS FOR THE PROCESSING OF THE DATA?
The legal bases for the processing of your data are the following:
I.- The performance of the contractual relationship, to manage and process your participation, as well as to respond to the enquiries raised, and to carry out the prize draws held by RPM RACING, S.L.U.
II.– The express consent of the user, to subscribe the user to the newsletter of the UTE’s events, and to send information about products and services of RPM Racing, SL.U., as well as of Donosti Eventos S.L., and to obtain statistical information on access to that information. You may revoke your consent at any time by writing to dpo@rpmsports.es.
III.– The legitimate interest of the Joint Controllers, to send surveys and prepare aggregated reports for statistical purposes, as well as to send personalised information based on the user’s profile, about projects, services, campaigns and events in which the Joint Controllers participate or which they organise, and on the basis of the exception provided for in article 21.2 of Law 34/2002 of 11 July on information society services and electronic commerce (LSSI).
IV.– The express consent of the user, to provide information about products and services of our collaborators and to carry out other activities that require their consent.
V.– In the case of images or your position in the ranking (and the data associated with that publication), by registering for the event, you authorise the use of the images as expressly indicated in the event’s Participation Regulations, without prejudice to the possibility of revoking such consent.
WHAT ARE THE CATEGORIES OF PERSONAL DATA THAT WILL BE PROCESSED?
The UTE will process the following categories of personal data:
• Identification data: first name, surnames, DNI
• Contact data: telephone, postal address, email address
• Data on personal and social characteristics: date of birth, gender, nationality, hobbies, affiliations.
As well as any other personal data that users provide through the forms set up on our website and its subdomains.
In this regard, as established in the Regulations, users are informed that their image, personal identification data and their position in the final result of the sporting event will be published through the website of the event managed by the Joint Controllers, their social media, through collaborating entities, as well as the media.
Please note that this data will be visible to other participants and users of the Platform.
PERSONAL DATA OF MINORS
Users are informed that, in order to process the personal data of minors under 14 years of age, the consent of the parents, guardians or those who hold parental authority over the minor will be required.
Therefore, when a minor participates in a race, or in general in any event organised by the UTE, it will be necessary to provide the data identifying the parents, guardians or those who hold parental authority, for the sole purpose of obtaining the necessary consent. The UTE reserves the right to require the family record book or any other document establishing filiation, guardianship or, in general, parental authority over the minor.
PERSONAL DATA OF THIRD PARTIES
When users provide personal data of relatives, friends, partners or any other third parties related to the user, they must undertake to inform them of this privacy policy and, in general, of the terms set out herein, and to obtain the consent of these third parties for the processing of their personal data.
DATA SECURITY
The Joint Controllers have implemented the technical and organisational measures necessary to guarantee the security of your data and to prevent its alteration, loss, unauthorised processing or access, taking into account the state of technology, the nature of the data stored and the risks to which they are exposed.
WHO ARE THE RECIPIENTS OF THE DATA SUBJECT’S DATA?
Your personal data may be communicated to the following entities:
• To providers necessary for the proper fulfilment of the legal obligations and/or the purposes indicated above.
• To the Public Administrations to which it is legally due.
• Professionals who collaborate with the Joint Controllers to ensure the proper handling of applicants, as well as the correct provision of the requested service.
• To the following payment gateways: Redsys Servicios de Procesamiento, S.L. and PayPal (Europe) S.à r.l.
• In addition to the above, we inform you that, if you participate in sporting events organised by the UTE, your first name, surname, bib number and photograph may be disseminated through the event’s official website, its social media, as well as the media.
• If you choose this option, we will disclose your bib number, name, email and telephone number so that the event photographer can contact you with the photos of the event you attended.
• Likewise, provided that the user has given their consent, we may disclose your personal data to our sponsors and marketing partners to allow them to market their products or services and to measure the effectiveness of their marketing campaigns, promotions and sponsorships or for other marketing purposes.
WHAT RIGHTS DOES THE DATA SUBJECT HAVE?
The data subject has the right to:
• Access their personal data.
• Rectify inaccurate or incomplete data.
• Request the erasure of their data when, among other reasons, the data are no longer necessary for the purposes for which they were collected.
• Object to or request the restriction of the processing of their personal data under the circumstances provided for in current legislation
• Data portability
• Revoke the consent given, where applicable.
In relation to the images captured during the event, we inform you that you may revoke your consent at any time, without this affecting the lawfulness of the processing based on the consent given prior to its withdrawal. As a consequence, you may request not to appear, yourself or the minor you represent, in photographs or group images celebrating sporting events, in which case no photographs or images in which the data subject appears will be used, or the photograph will be subjected to a procedure that does not allow identification.
The data subject may contact RPM’s data protection officer by email at dpo@rpmsports.es or at the address indicated in the first section. Likewise, when the data subject considers that effect has not been given to the exercise of their rights, they may lodge a complaint with the Spanish Data Protection Agency.