Privacy policy

1. WHO IS THE DATA CONTROLLER?

In accordance with current legislation, the data subject is informed that the data provided will be processed jointly by DONOSTI EVENTOS, S.L., with Tax Identification Number: B20685152 and by RPM RACING, S.L., with Tax Identification Number: B61514360, which constitute the UNIÓN TEMPORAL DE EMPRESAS (UTE) DONOSTI EVENTOS, S.L.- RPM RACING, S.L.U., as joint controllers of the data processing (hereinafter “Joint Controllers” or the “UTE”).

Information on the data processing:

• Registered office: Camino de Portuetxe, número 2, 20018, Donostia-San Sebastián.
• E-mail: info@zurichmaratonsansebastian.com
• Email of the Data Protection Officer: dpo@rpmsports.es

• WHAT IS THE PURPOSE AND DURATION OF THE PROCESSING OF YOUR PERSONAL DATA?

When users provide personal data through the registration forms for events/activities managed by the Joint Controllers through the forms made available, their personal data will be processed for the following purposes:

I. When personal data is provided through the contact form, the purpose is to respond to users’ requests. To this end, your personal data will be kept for the duration of the management of your query, and even afterwards, until the lapse of any liabilities arising from it.

II. When personal data is provided through the subscription to the commercial newsletter of the Website, the purpose is to subscribe to the commercial newsletter to keep the user informed about the latest news and events organised by the Joint Controllers. Your data will be kept until the user withdraws their consent to both.

III. When users provide personal data through registration forms for the events/activities organised by the UTE, the purpose is to manage and process their participation. To this end, your data will be kept for the duration of the event/activity in which you register and, once the event/activity ends, for the period of limitation of the legal actions that may arise from it.

IV. If you authorise it, your data will be used to provide you with personalised information about projects, services, campaigns, events in which RPM RACING S.L.U. participates or organises, in accordance with its privacy policy, for an indefinite period of time, and you may revoke your consent at any time by contacting dpo@rpmsports.es, as well as in each email you receive in the “unsubscribe” section.

V. Likewise, your data will be used to provide you with personalised information about projects, services, campaigns, events in which DONOSTI EVENTOS S.L. participates or organises, for an indefinite period of time. You may revoke your consent at any time by writing an email to dpo@rpmsports.es, as well as in each email you receive in the “unsubscribe” section.

VI. To manage participation in prize draws and promotions organised by the Joint Controllers, the legitimate basis for the processing being the pre-contractual and contractual relationship, in the event of being a winner. To this end, your data will be kept for the duration of the promotion and, once the promotion has ended, for the period of limitation of any legal actions that may arise from it.

VII. We also process photographs/pictures for the dissemination of group pictures celebrating the sports event for informative, commercial, and advertising purposes. Your image and/or video, with or without sound, will be kept for a maximum period of 20 years until you revoke your consent.

VIII. If required by the event rules and, provided that you do not exercise your right of deletion, we will process your data (your first name, surname, year of birth and gender) in order to show your position in the ranking of participants, according to the event categories.

Unless you revoke your consent, the above storage periods for personal data will apply and it is your responsibility to keep your personal data up to date.

• WHAT ARE THE LEGAL GROUNDS FOR THE DATA PROCESSING?

The legitimate bases for the processing of your data are as follows:

I.- The execution of the contractual relationship, to manage and process your participation, as well as to respond to the queries raised.

II.- The express consent of users, to carry out their subscription to the newsletter of the UTE events, to send the information about products and services of RPM Racing, SL.U., and Donosti Eventos S.L., and to know statistical information about the access to such information. Users may revoke their consent at any time by contacting dpo@rpmsports.es. 

III.- The legitimate interest of the Joint Controllers to send surveys and aggregate reports for statistical purposes, as well as to send personalised information based on the user’s profile, on projects, services, campaigns, events in which the Joint Controllers participate or organise and based on the exception established in article 21.2 of Law 34/2002 of 11 July, on information society services and electronic commerce (LSSI).

IV.- The express consent of the user, to provide information about products and services of our partners and to carry out those other activities that require their consent.

V.- In the case of images or your position in the ranking (and data associated with said publication), by registering for the event, you are authorising the use of the images as expressly indicated in the Regulations for participation in the event, without prejudice to the possibility of revoking said consent.

• WHAT CATEGORIES OF PERSONAL DATA WILL BE PROCESSED?

The UTE will process the following categories of personal data:

• Identification details: name, surname, ID card number
• Contact details: telephone, postal address, e-mail address
• Personal and social characteristics details: date of birth, gender, nationality, hobbies, affiliations
• Financial and bank details: credit or debit card
• Data resulting from customised reports on your activity with RPM.
• Images recorded at the event

Any other personal data that users provide through the forms established on our website and its subdomains.

In this regard, as established in the Rules, users are informed that their image, personal identification data and their position in the final result of the sporting event will be published on the website of the event managed by the Joint Controllers, its social networks, through collaborating entities, as well as in the media.

Please note that such data will be visible to other participants and users of the Platform.

• PERSONAL DATA OF MINORS

Users are informed that, in order to proceed with the processing of personal data of minors under 14 years of age, the consent of parents, guardians or those who hold parental authority over the minors shall be required.

Therefore, when a minor participates in any race, or in general in any event organised by RPM or its partners, identification details of parents, guardians or those persons holding parental authority will be required for the sole purpose of obtaining the necessary consent. RPM reserves the right to require the official family register or any other document that determines parentage, guardianship or in general parental authority over the minor.

• PERSONAL DATA OF THIRD PARTIES

When users provide personal data of family members, friends, partners or any other third parties related to the users, they must undertake to inform them of this privacy policy and in general of the terms set out herein and obtain the consent of those third parties for the processing of their personal data.

• DATA SECURITY

The Joint Controllers have implemented the necessary technical and organisational measures to guarantee the security of your data and prevent its alteration, loss, processing or unauthorised access, taking into account the current technology available, the nature of the data stored and the risks to which they are exposed.

• WHO ARE THE RECIPIENTS OF THE DATA SUBJECT’S DATA?

Your personal data may be disclosed to the following entities:

• Suppliers required for the proper fulfilment of the legal obligations and/or the purposes indicated above.
• Public Administrations, where required by law.
• Professionals who collaborate with the Joint Controllers to guarantee the proper attention of applicants, as well as the correct provision of the required service.
• The payment gateways: Redsys Servicios de Procesamiento, S.L.
• and PayPal (Europe) S.à r.l.
• In addition to the above, we inform you that, if you participate in sporting events organised by UTE, your name, surname, bib number and photograph may be disseminated through the official website of the event, its social networks, as well as the media.
• If you choose the option, we will disclose your bib number, name, email and phone number so that the event photographer can contact you with photos of the event attended.
• We may also disclose your personal data to our sponsors and marketing partners to enable them to market their products or services and to measure the effectiveness of their marketing campaigns, promotions and sponsorships or for other marketing purposes, provided you have consented to this.

    8. WHAT RIGHTS DOES THE DATA SUBJECT HAVE?

Data subjects have the right to:

• Access their personal data.
• Rectify inaccurate or incomplete data.
• Request the deletion of their data when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
• Oppose or limit the processing of their personal data in the cases provided for in current legislation.
• Request the portability of their data
• Revoke the consent given

As regards the images recorded during the event, we inform you that you may revoke your consent at any time, without affecting the lawfulness of the processing based on the consent prior to its withdrawal. As a consequence, you may request not to appear, you or the minor you represent, in photographs or images of groups celebrating sporting events, in which case those photographs or images in which you appear will not be used, or they will be altered so as to prevent your identification.

The data subject may contact the data protection officer of RPM by email at dpo@rpmsports.es or at the address indicated in the first paragraph. Also, when the data subjects consider that the exercise of their rights has not been effective, they may file a complaint with the Spanish Data Protection Agency.

Updated in May 2023